text: Our Chief Technology Officer and our Chief Information Security Officer ("CISO") lead the Company's cybersecurity function. Our CISO supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CISO has significant global experience in managing and leading IT and cybersecurity teams, with over 20 years of experience in the cybersecurity industry in various positions. Our CISO is a Certified Information Systems Security Professional by the International Information System Security Certification Consortium. Our CISO reports to our Chief Technology Officer, who has over 25 years of software development experience and 15 years of experience in leading software engineering teams in the technology industry, including at Uber.


text: The audit committee and our risk committee, a management committee overseeing our enterprise risk management program, receive periodic reports from our CISO regarding key cybersecurity risks facing the company, our cyber risk management program, significant cybersecurity incidents involving us or our third-party service providers, and the progress of ongoing initiatives as well as the effectiveness of internal control and compliance mechanisms. The audit committee, in turn, briefs our board of directors on its cybersecurity oversight activities as appropriate or necessary.

companyName: Maplebear Inc.

ticker: CART

secItem: Item 1C


text: Our management team, through our Chief Technology Officer and CISO, stays informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which include briefings with internal security personnel, review of threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers, and receiving alerts and reports produced by security tools deployed in our IT environment. Our CISO relies on close collaboration with other internal infrastructure, product, engineering, and legal teams to implement our cybersecurity risk mitigation measures.


text: Risk Management and Strategy Allegion plc recognizes the significance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and products and protect the confidentiality, integrity, and availability of our data.

companyName: Allegion plc

ticker: ALLE


text: Managing Material Risks & Integrated Overall Risk Management Cybersecurity is a critical part of our enterprise risk management. To address cybersecurity threats, we leverage a multi-layer approach, with our Chief Information Security Officer ("CISO") leading a team that is responsible for forming our enterprise-wide information security strategy, training, policy, standards, architecture and processes to protect us against cybersecurity risks. Our risk management group works with our cybersecurity team to continuously evaluate and address cybersecurity risks. Further, we have an employee security awareness program in place and a security training program for technical personnel that provides mandatory and on-demand training.


text: Engage Third Parties on Risk Management We engage a range of external experts, including cybersecurity consultants and auditors to evaluate and test our risk management systems. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements. Our cybersecurity programs generally align with the NIST Cybersecurity Framework, and third party audits on portions of our cybersecurity program or processes apply the NIST Cybersecurity Framework controls. These partnerships provide expert knowledge and insights, which are designed to ensure our cybersecurity strategies and processes are consistent with industry best practices.


text: Oversee Third-party Risk We rely on our information technology systems and networks in connection with many of our business activities. Some of these networks and systems are managed by third-party service providers and are not under our direct control. The Company has implemented processes designed to manage the cybersecurity risks associated with its use of third-party service providers.


text: Risks from Cybersecurity Threats Despite the security measures we have implemented, certain cyber incidents could materially disrupt operational systems; result in loss of trade secrets or other proprietary or competitively sensitive information; compromise personally identifiable information regarding customers or employees; delay our ability to deliver products to customers; and/or jeopardize the security of our facilities. These risks are further described in the risk factors within Item 1A, particularly under the headings "We may be subject to risks relating to our information technology and operational technology systems", "We currently rely on third-party service providers for many of the critical elements of our global information and operational technology infrastructure, and their failure to provide effective support for such infrastructure could increase our cybersecurity risk or otherwise negatively impact our business and financial results", and "Disruptions or breaches of our information systems could adversely affect us."


text: We have not encountered any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: The Board of Directors has established oversight mechanisms designed to ensure effective governance in managing risks associated with cybersecurity threats.


text: Board of Directors Oversight Due to the importance of cybersecurity to the Company, the full Board is charged with oversight responsibility for our risk management and security strategy and policy. The Board is composed of members with diverse expertise including, risk management, information technology, engineering, manufacturing, innovation and finance, equipping them to oversee cybersecurity risks effectively. The Board receives updates from the CISO and management at its quarterly board meeting, which updates cover the Company's cybersecurity strategy, current cybersecurity risk assessment, key risk areas, current cyber trends, and any significant cyber incidents that have occurred or are reasonably likely to occur.


text: Management's Role Management is responsible for assessing and managing cybersecurity risk. Specifically, the CISO is responsible for the prevention, mitigation, detection, and remediation of cybersecurity incidents. The CISO regularly meets with the Chief Executive Officer ("CEO") and Executive Leadership Team to inform them on cybersecurity risks. These briefings encompass a broad range of topics, including: • Threat intelligence; • Risk updates with regional vice presidents; • Third-party assessments and results of tabletop exercises; • Training programs for employees; • Results of phishing simulations; • Cybersecurity technologies and best practices; and • Significant cybersecurity incidents and/or trends (if any).


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO. With over 20 years of experience in the field of information technology, the CISO brings a wealth of expertise to the role. The CISO's education includes a Master's in Cybersecurity Management. The CISO has in-depth knowledge and experience in developing and executing our cybersecurity strategies. The CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our comprehensive employee security awareness program. The CISO is also responsible for building and overseeing a cybersecurity team, including internal and external resources, who provide subject matter expertise and operational talents to achieve our cybersecurity objectives.


text: Monitor Cybersecurity Incidents The CISO and the cybersecurity team are continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, which is an important component in designing programs to prevent, detect, mitigate, and remediate cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we have a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents and informing the board of significant cyber incidents in accordance with the Company's incident response plan.


text: Risks from Cybersecurity Threats Despite the security measures we have implemented, certain cyber incidents could materially disrupt operational systems; result in loss of trade secrets or other proprietary or competitively sensitive information; compromise personally identifiable information regarding customers or employees; delay our ability to deliver products to customers; and/or jeopardize the security of our facilities. These risks are further described in the risk factors within Item 1A, particularly under the headings "We may be subject to risks relating to our information technology and operational technology systems," "We currently rely on third-party service providers for many of the critical elements of our global information and operational technology infrastructure, and their failure to provide effective support for such infrastructure could increase our cybersecurity risk or otherwise negatively impact our business and financial results," and "Disruptions or breaches of our information systems could adversely affect us."


text: The Board of Directors (the "Board") has established oversight mechanisms designed to ensure effective governance in managing risks associated with cybersecurity threats.


text: Board of Directors Oversight Due to the importance of cybersecurity to the Company, the full Board is charged with oversight responsibility for our risk management and security strategy and policy. The Board is composed of members with diverse expertise including, risk management, information technology, engineering, manufacturing, innovation and finance, equipping them to oversee cybersecurity risks effectively. The Board receives updates from the CISO and management at least quarterly at board meetings, which updates cover the Company's cybersecurity strategy, current cybersecurity risk assessment, key risk areas, current cyber trends, and any significant cyber incidents that have occurred or are reasonably likely to occur.


text: Management's Role Management is responsible for assessing and managing cybersecurity risk. Specifically, the CISO is responsible for the prevention, mitigation, detection and remediation of cybersecurity incidents. The CISO regularly meets with the Chief Executive Officer ("CEO") and Executive Leadership Team to inform them on cybersecurity risks. These briefings encompass a broad range of topics, including: • Threat intelligence; • Risk updates with regional vice presidents; • Third-party assessments and results of tabletop exercises; • Training programs for employees; • Results of phishing simulations; • Cybersecurity technologies and best practices; and • Significant cybersecurity incidents and/or trends (if any).


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K), including, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risks, and reputational risks.

companyName: USA TODAY Co., Inc.

ticker: TDAY


text: We employ various cybersecurity processes and controls to aid in our efforts to identify, assess, and manage our material risks from cybersecurity threats and to protect against, detect, and respond to cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K). To identify and assess material risks from cybersecurity threats, we consider and gather information with respect to the confidentiality, integrity, and availability of our information systems (as defined in Item 106(a) of Regulation S-K). We have adopted policies and procedures that are designed to assist us with managing identified risks at a system and organizational level and assessing the materiality of the risk, its severity, and potential mitigations or remediations. Our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process.


text: The risk identification process includes: (i) identifying information systems and assets, including physical and virtual devices, software, data, data transfers, external systems, and cloud resources; (ii) reviewing organizational business processes, identities, access, and roles (including privileged access), asset configurations, technology policies, standards, controls, and processes; (iii) analyzing the criticality of assets and business processes and sensitivity of data; and (iv) identifying vulnerabilities and threats to the identified assets, data, and processes, from both internal and external sources, including threat intelligence, previous cybersecurity incidents, and third-party assessments.


text: Our processes also consider risks associated with our use of third-party service providers and business partners, including those in our supply chain or who have access to our customer and employee data or our information systems. Third-party service provider and business partners risks are included within our cybersecurity risk management program, as well as the risk identification and assessment processes, both of which are discussed above. In addition, cybersecurity and privacy considerations affect the selection and oversight of our third-party service providers and business partners, as well as third-party specific integration plans. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in a specified manner, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We employ a range of tools and services to inform our risk preparedness, identification, assessment and remediation processes, including, among others, continuous monitoring, regular reoccurring security and compliance activities, training, threat intelligence, business processes, change management, strategic planning, annual assessments, and periodic testing and assessments performed by qualified security personnel and by third-party firms. As part of the above-described processes, we engage with third-party firms to perform independent assessments, including internal and external penetration tests, social engineering tests, configuration assessments, security plan and program assessments, compliance assessments, and incident response readiness exercises to help identify areas for continued focus, improvement and/or compliance.


text: Identified risks are evaluated and assessed by the Company's security review council, comprised of various security, technology, and privacy staff members and management. A member of management is assigned as the risk owner and takes an active role in managing the risk, including determining the risk response and risk treatment plan, as well as participates in assessing any residual risk. Our Chief Information Security Officer oversees our cybersecurity risk management program.


text: In the event of a potential material risk, the risk is reported to the Chief Information Security Officer, the Chief Technology Officer, and to the appropriate member of senior management responsible for the function where the risk has been identified. The risk is then reviewed by the Disclosure Committee, which includes among others, the Company's Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, and Chief Accounting Officer to make a determination of whether the risk is material.


text: In 2023, our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Risks Related to Cybersecurity and Artificial Intelligence" under Risk Factors in this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board of Directors and management. Our Board of Directors is responsible for the oversight of risks from cybersecurity threats. Each quarter or as needed, the Board of Directors receives an overview from management of our cybersecurity program and strategy covering topics such as cybersecurity incidents and response, progress towards pre-determined risk-mitigation-related goals, results from third-party assessments, cybersecurity staffing, compliance status, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to any such risks. In such sessions, our Chief Information Security Officer is available to the Board of Directors to discuss any relevant cybersecurity matters. In addition, at least bi-annually, the Chief Information Security Officer and Chief Technology Officer report to the Board of Directors about cybersecurity threat risks, among other cybersecurity related matters.


text: Our cybersecurity risk management and strategy processes discussed above, are led by our Chief Information Security Officer and Chief Technology Officer, both of whom are Certified Information Systems Security Professionals ("CISSP"). Specifically, our Chief Information Security Officer has approximately nine years of experience developing cybersecurity strategy, incident response, and implementing cybersecurity programs for public media companies and our Chief Technology Officer has approximately 15 years of experience developing cybersecurity strategy, incident response, and implementing cybersecurity programs.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K), including, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risks, and reputational risks.


text: We employ various processes and controls to aid in our efforts to identify, assess, and manage our material risks from cybersecurity threats and to protect against, detect, and respond to cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K). To identify and assess material risks from cybersecurity threats, we consider and gather information with respect to the confidentiality, integrity, and availability of our information systems (as defined in Item 106(a) of Regulation S-K). We have adopted policies and procedures that are designed to assist us with managing identified risks at a system and organizational level and with assessing the materiality of the risk, its severity, and potential mitigations or remediations. Our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process.


text: The cybersecurity risk identification process includes: (i) identifying information systems and assets, including physical and virtual devices, software, data, data transfers, external systems, and cloud resources; (ii) reviewing organizational business processes, identities, access, and roles (including privileged access), asset configurations, technology policies, standards, controls, and processes; (iii) determining if those systems or assets process or store customer and/or employee personal data, (iv) analyzing the criticality of systems, assets and business processes and sensitivity of data; and (v) identifying vulnerabilities and threats to the identified systems, assets, data, and processes, from both internal and external sources, including through threat intelligence, previous cybersecurity incidents, and third-party assessments.


text: Our processes also consider cybersecurity risks associated with our use of third-party service providers and business partners, including those in our supply chain and those who have access to our customer and employee data or our information systems. Identified third-party service provider and business partner risks are managed by our cybersecurity risk management program. In addition, cybersecurity and privacy considerations affect the selection and oversight of our third-party service providers and business partners, as well as third-party specific integration plans. Additionally, we generally require those third parties that could introduce significant cybersecurity or data privacy risk to us to agree by contract to comply with applicable data protection laws, and to manage their cybersecurity risks by implementing appropriate technical and organizational measures, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We employ a range of tools and services to inform our risk preparedness, identification, assessment and remediation processes, including, among others, continuous monitoring, regular reoccurring security and compliance activities, training, threat intelligence, business processes, change management, strategic planning, annual assessments, and periodic testing and assessments performed by qualified security personnel and by third-party firms. As part of the above-described processes, we engage with third-party firms to perform independent assessments, including internal and external penetration tests, configuration assessments, security plan and program assessments, compliance assessments, and incident response readiness exercises to help identify areas for continued focus, improvement and/or compliance.


text: Identified risks are evaluated and assessed by the Company's security review council, comprised of various security, technology, legal and privacy staff members and management. A member of management is assigned as the risk owner and takes an active role in managing the risk, including approving the risk response and risk treatment plan, as well as participating in assessing any residual risk after implementation of the treatment plan. Our Chief Information Security Officer oversees our cybersecurity risk management program.


text: In the event of a potential material risk, the risk is reported to the Chief Information Security Officer, the Chief Technology Officer, the Chief Privacy Officer and to the legal department and the appropriate member of senior management responsible for the function where the risk has been identified. The risk is then reviewed by the Disclosure Committee, which includes among others, the Company's Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, and Chief Accounting Officer to determine whether the risk is material for disclosure purposes in accordance with applicable rules and regulations.


text: In 2024, our business strategy, results of operations, and financial condition were not materially affected by risks from cybersecurity threats but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Risks Related to Cybersecurity and Artificial Intelligence" under Risk Factors in this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board of Directors and management. Our Board of Directors is responsible for the oversight of risks from cybersecurity threats. Each quarter or as needed, the Board of Directors receives an overview from management of our cybersecurity program and strategy covering topics such as cybersecurity incidents and response, progress towards pre-determined risk-mitigation-related goals, results from third-party assessments, cybersecurity staffing, compliance status, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to any such risks. In such sessions, our Chief Information Security Officer is available to the Board of Directors to discuss any relevant cybersecurity matters. In addition, at least bi-annually, the Chief Information Security Officer and Chief Technology Officer report to the Board of Directors about cybersecurity threat risks, among other cybersecurity related matters.


text: Our cybersecurity risk management and strategy processes discussed above, are led by our Chief Information Security Officer and Chief Technology Officer, both of whom are Certified Information Systems Security Professionals. Specifically, our Chief Information Security Officer has approximately 10 years of experience developing cybersecurity strategy, incident response, and implementing cybersecurity programs for public media companies and is a certified boardroom Qualified Technology Expert and our Chief Technology Officer has approximately 16 years of experience developing cybersecurity strategy, incident response, and implementing cybersecurity programs.


text: The Company maintains a comprehensive information security and cybersecurity program (the "Cybersecurity Program") guided by established best practice and tailored to the Company's business needs. The Cybersecurity Program is an extension of the Company's enterprise risk management program that seeks to identify and manage risks throughout the Company by having its Chief Financial Officer meet with members of each of the Company's various departments annually to solicit feedback regarding risks affecting the Company, which is then reported to the audit committee of our board of directors.

companyName: OUTFRONT Media Inc.

ticker: OUT


text: Under the Cybersecurity Program, systems and networks under Company control are monitored for anomalies using various security tools that identify potential cybersecurity threats and alert the Company's internal cybersecurity team to suspicious activity. If a potential cybersecurity incident is identified, it is investigated by the Company's internal cybersecurity team (including the Company's Chief Information Security Officer (the "CISO")) to assess whether a cybersecurity incident has occurred, its severity and the risk involved, in accordance with internal processes and procedures and the Company's incident response plan. The CISO is responsible for management of these cybersecurity processes, and reports to the Company's Chief Information Officer (the "CIO"). The CISO and CIO will receive input from, and coordinate with, the Company's Chief Privacy Officer (the "CPO"), as necessary. If a cybersecurity incident is discovered, it must be reported by the CIO and the CISO to the Company's senior management, including the Company's Chief Financial Officer and the Company's General Counsel for further assessment regarding scope, mitigation, remediation and disclosure obligations, as applicable. The audit committee of our board of directors oversees the Company's information security and cybersecurity risks, compliance and protections, and receives quarterly cybersecurity updates from the CISO and CIO (with input from the CPO, as appropriate) and results of the Company's incident response plan testing at least annually.


text: The Cybersecurity Program team members, including the CISO and the CIO, have extensive work experience in cybersecurity, information technology engineering and the media and advertising industries, with some members holding degrees in cybersecurity and professional certifications in cybersecurity. The Cybersecurity Program team members are subject to ongoing employee trainings in cybersecurity procedures.


text: We perform regular third-party assessments of the Cybersecurity Program, and retain specialized third-party forensics experts for escalation of certain cybersecurity incidents. In addition, we have processes, including formal security reviews and suspicious activity monitoring, to assess cybersecurity risks associated with our use of third-party service providers.


text: To date, we have not identified any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. For additional information about our cybersecurity risks, see "Item 1A. Risk Factors—If we experience a cybersecurity incident, we may suffer reputational harm and significant legal and financial exposure."


text: Under the Cybersecurity Program, systems and networks under Company control are monitored for anomalies using various security tools that identify potential cybersecurity threats and alert the Company's internal cybersecurity team to suspicious activity. If a potential cybersecurity incident is identified, it is investigated by the Company's internal cybersecurity team (including the Company's Chief Information Security Officer (the "CISO")) to assess whether a cybersecurity incident has occurred, its severity and the risk involved, in accordance with internal processes and procedures and the Company's incident response plan. The CISO is responsible for management of these cybersecurity processes, and reports to the Company's Chief Information Officer (the "CIO"), who reports to the Company's Chief Technology Officer (the "CTO"). The CISO and CIO will receive input from, and coordinate with, the CTO and the Company's Chief Privacy Officer (the "CPO"), as necessary. If a cybersecurity incident is discovered, it must be reported by the CIO and the CISO to the Company's senior management, including the CTO, the Company's Chief Financial Officer and the Company's General Counsel for further assessment regarding scope, mitigation, remediation and disclosure obligations, as applicable. T he audit committee of our board of directors oversees the Company's information security and cybersecurity risks, compliance and protections, and receives quarterly cybersecurity updates from the CISO and CIO (with input from the CTO and the CPO, as appropriate) and results of the Company's incident response plan testing at least annually.


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: TriplePoint Venture Growth BDC Corp.

ticker: TPVG


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on its Chief Compliance Officer ("CCO") and the expertise of legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with its use of such entities.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the Adviser regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, manage the Company's cybersecurity program. The CCO of the Company oversees the Company's oversight function generally and relies on the Adviser's technology team to assist with assessing and managing material risks from cybersecurity threats. The CCO has been responsible for this oversight function as CCO of the Company for one year and has worked in the financial services industry for more than 30 years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company.


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats and cybersecurity incidents. The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cybersecurity risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the Adviser regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting or which are reasonably likely to impact the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, manage the Company's cybersecurity program. The CCO of the Company oversees the Company's oversight function generally and relies on the Adviser's technology team to assist with assessing and managing material risks from cybersecurity threats. The CCO has been responsible for this oversight function as CCO of the Company for one year and has worked in the financial services industry for more than 30 years, during which time our CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company did not identify any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Risk Management and Strategy We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cyber risk awareness. Our Vice President, Information Technology and our information technology group endeavor to evaluate and address cyber risks in alignment with our business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology (NIST) and CIS Critical Security Controls frameworks.

companyName: LGI Homes, Inc.

ticker: LGIH


text: We have processes and procedures in place to monitor the prevention, detection, mitigation and remediation of cybersecurity risks. These include but are not limited to: • Maintaining a defined and practiced incident response plan; • Employing appropriate incident prevention and detection safeguards; • Maintaining a defined disaster recovery policy and employing disaster recovery software, where appropriate; • Educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and • Reviewing and evaluating new developments in the cyber threat landscape.


text: Recognizing the complexity and evolving nature of cybersecurity risk, we engage with a range of external support, including cybersecurity consultants, in evaluating, monitoring and testing our cyber management systems and related cyber risks. Our collaboration with these third parties includes audits, threat and vulnerability assessments, company-wide monitoring of cybersecurity risks and consultation on security enhancements.


text: We recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and we have processes in place to oversee and manage these risks. We conduct annual and periodic assessments of these third-party engagements to evaluate compliance with our cybersecurity standards.


text: To our knowledge, we have not been subject to cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, the Company, its operations or financial standing.


text: Our cybersecurity risk management program is overseen by management at multiple levels. Our Vice President, Information Technology plays a key role in assessing, monitoring and managing our cybersecurity risks with support from dedicated information technology and security personnel. Our cybersecurity and risk management protocols are led by our Vice President of IT, who has served in this role since 2019. Our Vice President, Information Technology has an MS in Engineering and Technology Management and over 20 years of experience in managing and leading information technology or cybersecurity teams and oversees a team of information technology professionals who identify, assess, and manage cybersecurity threats on an ongoing basis.


text: Our information technology group monitors the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. We have implemented and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we are equipped with a defined and practiced incident response plan, which includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Our Board of Directors is responsible for overseeing our cyber risk. Our Vice President, Information Technology or other members of our information technology group provide at least semi-annual in-person updates to the Board that encompass a broad range of topics, including: • Current cybersecurity threat landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from unique cybersecurity events, including those of other companies; and • Compliance status and efforts with regulatory requirements and industry standards.


text: Furthermore, at the Board meetings at which our Vice President, Information Technology or other members of our information technology group do not provide in-person updates to the Board, our CEO or another executive team member provides current updates to the Board. In addition, our information technology group provides updates to the full Board upon request, or timely updates regarding unique developments such as regulatory updates or vulnerability developments. Our Board is composed of directors with diverse qualifications, skills and expertise, including risk management, technology and finance, that equips them to oversee cybersecurity risks effectively.


text: For additional information concerning cybersecurity risks we face, see "General Risk Factors — Information system failures, cyber incidents or breaches in security could adversely affect us" in Item 1A. Risk Factors in Part I of this Annual Report on Form 10-K.


text: Risk Management and Strategy We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cyber risk awareness. Our Vice President, Information Technology and our information technology group endeavor to evaluate and address cyber risks in alignment with our business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology (NIST) and Center for Internet Security (CIS) Critical Security Controls frameworks.


text: Cybersecurity Risk Management and Strategy We have established processes to assess, identify, and manage significant risks from cybersecurity threats as part of our broader enterprise-wide risk management system and processes, which is overseen by our Board of Directors and our Audit Committee, along with our executive management. Our cybersecurity policies, standards, processes, and practices are part of our information security management program, which is aligned to ISO 27001, an international standard to manage information security. ISO 27001 is published by the International Organization for Standardization (ISO), the world's largest developer of voluntary standards, and the International Electrotechnical Commission (IEC).

companyName: A10 Networks, Inc.

ticker: ATEN


text: Our information technology ("IT") cybersecurity team, led by our Head of Information Security, is tasked with monitoring and assessing cybersecurity and operational risks related to information security and system disruption. The team employs measures designed to protect against, detect, and respond to cybersecurity threats, and has implemented processes and procedures aligned with our information security management system. These include: • Enterprise-wide security framework and cybersecurity standards; • Cybersecurity awareness and training programs; • Security assessments and monitoring: • Restricted physical access to critical areas, servers and network equipment; • Cyber incident response, crisis management, business continuity and disaster recovery plans; and • Third-party IT vendor risk management process to identify, assess, and manage risks presented by our IT vendors and business partners.


text: Our IT cybersecurity team maintains an incident response plan designed to respond to potential cybersecurity threats, such as security breaches and cyberattacks, and to protect and preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company. Our incident response plan coordinates the activities that we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate significant cybersecurity incidents to our global crisis management plan, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. We conduct tabletop exercises for tactical response readiness, perform regular security scans of our environment both from an external and internal perspective, as well as work with a qualified third-party vendor to perform penetration tests of our environment. These penetration tests are focused on specific objectives to assist us in managing our cybersecurity threat risks. Any identified risks are included in our overall risk management program, which we validate on a regular basis.


text: We conduct organization-wide cybersecurity training and compliance exercises in connection with our information security program. This training consists of educational material and compliance testing administered to, and completed by, all of our employees on an annual basis, which is tracked and recorded throughout the year. Results are shared with executive management, the Audit Committee, and the Board of Directors. Additionally, employee phishing tests are conducted on a regular basis.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our Enterprise Risk Management Assessment framework. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.


text: In our risk factors, we describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have significantly affected or are reasonably likely to significantly affect us, including our business strategy, results of operations, or financial condition. See our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Board of Directors, executive management and Audit Committee are actively engaged in the oversight of IT risk management, including cybersecurity risk. Executive management and the Audit Committee share responsibility for overseeing our risk exposure to information security, cybersecurity, and data protection, as well as the steps management has taken to monitor and control such exposure. The Board of Directors, executive management and the Audit Committee receive quarterly reports on IT controls and information security. Additionally, on at least an annual basis, the Audit Committee reviews and discusses with management our policies and programs with respect to the oversight of IT risk and cybersecurity threats.


text: Oversight for assessing and managing cybersecurity risk is performed by our IT cybersecurity team, with additional oversight performed by our Human Resources, Internal Audit and Legal Departments. Our executive management is briefed at least quarterly from these teams. Members of the Board of Directors, Audit Committee, and executive management are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our executive management, the Audit Committee, and the Board of Directors are notified of any significant cybersecurity incidents through an escalation process that is established in our incident response plan and incorporated into our disclosure controls and procedures. Additionally, we maintain a third-party vendor relationship which is available to the team for on-demand incident response and investigation, as needed.


text: Our IT cybersecurity team is led by our Head of Information Security, Sean Pike. Mr. Pike has over 25 years of experience leading and scaling cybersecurity practices across regulated industry and critical infrastructure. Most recently, he served as CISO at Business Wire, where he was responsible for transforming the security and compliance organizations to meet the needs of a globally distributed SaaS newswire. Prior to Business Wire, Mr. Pike held leadership positions at VMware, IDC, and Nielsen Radio. His work at the Company includes aligning cybersecurity, product security, and security compliance initiatives to business goals. Mr. Pike holds a JD in law from Syracuse University and a M.S. in telecommunications and network management from Syracuse University.


text: Our IT cybersecurity team maintains an incident response plan designed to respond to potential cybersecurity threats, such as security breaches and cyber-attacks, and to protect and preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company. Our incident response plan coordinates the activities that we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate significant cybersecurity incidents to our global crisis management plan, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. We conduct tabletop exercises for tactical response readiness, perform regular security scans of our environment both from an external and internal perspective, as well as work with a qualified third-party vendor to perform penetration tests of our environment. These penetration tests are focused on specific objectives to assist us in managing our cybersecurity threat risks. Any identified risks are included in our overall risk management program, which we validate on a regular basis.


text: Our IT cybersecurity team is led by our Head of Information Security, Sean Pike. Mr. Pike has over 25 years of experience leading and scaling cybersecurity practices across regulated industry and critical infrastructure. Most recently, he served as Chief Information Security Officer at Business Wire, where he was responsible for transforming the security and compliance organizations to meet the needs of a globally distributed SaaS newswire. Prior to Business Wire, Mr. Pike held leadership positions at VMware, IDC, and Nielsen Radio. His work at the Company includes aligning cybersecurity, product security, and security compliance initiatives to business goals. Mr. Pike holds a Juris Doctor in law from Syracuse University and a M.S. in telecommunications and network management from Syracuse University.


text: Like all modern businesses within the global economy, we are susceptible to cybersecurity threats. Our suppliers, vendors, and customers face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, financial position, business strategy, and results of operations. As discussed in more detail below, we have policies and procedures in place as part of our overall risk management strategy to, among other things, monitor our systems, train and raise awareness of cybersecurity threats amongst employees, and detect intrusions on our systems.

companyName: Installed Building Products, Inc.

ticker: IBP


text: Notwithstanding our efforts at cybersecurity, no system of prevention is impenetrable, and we cannot guarantee that we will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. From time to time, we have experienced cybersecurity incidents in the normal course of our business. As of the date of this report, we are not aware of any cybersecurity incident or threat that has materially affected or is reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future cybersecurity incidents could materially affect our strategy, results of operations or financial condition. See Item 1A. Risk Factors for additional information on how risks could materially affect the Company.


text: CYBERSECURITY RISK MANAGEMENT AND STRATEGY As part of our Enterprise Risk Management ("ERM") program, we maintain processes to assess, identify, manage, mitigate, and respond to material risks from cybersecurity threats. Central to these processes is a committee comprised of our head of Internal Audit, our Chief Information Officer ("CIO"), members of our executive team, and other senior members of management that evaluates cybersecurity risks and designs, and ensure implementation of, appropriate controls, protections and training. This committee periodically reviews overall risks to the Company as part of the ERM program and ensures the alignment of cybersecurity efforts with the overall risk management framework. The committee has identified cybersecurity threats as one of the primary categories of risk to the Company.


text: Our information systems align with industry security standards. Our cybersecurity program, where appropriate, aligns with the Center of Internet Security ("CIS") Control framework, which itself is modeled after the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework ("CSF").


text: Our policies and procedures concerning cybersecurity matters include processes to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, detect intrusions into our systems, and respond to cybersecurity incidents. We also regularly review our incident response and business continuity plans to ensure readiness if and when an incident does occur, and we test our incident response plan through tabletop exercises. Furthermore, we have established a cyber safety program which consists of a team of employees who concentrate on raising cybersecurity awareness in office and home-office environments to educate employees connected to the systems we use on how to identify and report security threats or breaches.


text: We continually evaluate cybersecurity risks on an ongoing basis as part of our overall risk management strategy. We assess and identify cybersecurity risks through periodic risk assessments, penetration testing, and vulnerability scans, among other procedures and practices. We also receive cybersecurity alerts and threat intelligence from our peers, government agencies, information sharing and analysis centers and cybersecurity-related groups or associations. These and other measures are used to evaluate cybersecurity risks in a timely manner and to allocate resources in alignment with the overall risk management program. In the event of an incident, we intend to follow our detailed incident response policy, which outlines the steps to be followed from incident detection to eradication, recovery and notification. In addition, we regularly engage various third-parties to assess or test our systems and processes to enhance our detection and management of cybersecurity risks or assist with implementation of our risk management strategies, including consultants who assist with assessing risks, information security experts who conduct tabletop exercises with participation from company management, and our external auditor who performs cybersecurity reviews as part of our annual audit.


text: Our operations rely on third-party suppliers, vendors, software programs, hardware products, and network systems, including cloud-based technologies, and we have processes to identify and evaluate cybersecurity risks and incidents associated with certain identified third-party providers.


text: CYBERSECURITY GOVERNANCE The Board of Directors' Oversight of Cybersecurity Risks Our Board of Directors (the "Board") maintains principal oversight responsibility for our ERM program. This oversight is facilitated primarily through the Audit Committee of the Board of Directors, which is responsible for oversight of our cybersecurity risk management processes. The chairman of our Audit Committee has earned a CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors, which aids the Audit Committee's understanding of cybersecurity risks and assists the Audit Committee in overseeing the risk management program.


text: The Audit Committee and the Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. Senior leadership, including our CIO, briefs the Board of Directors and the Audit Committee on cybersecurity risks and the effectiveness of our cybersecurity program as part of updates on our overall ERM program. Our head of Internal Audit also provides the Audit Committee with an assessment of any material changes to cybersecurity risks and controls as a result of cybersecurity threats on at least a semi-annual basis.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Management is responsible for assessing and managing our cybersecurity risk management program. We have various teams and committees charged with monitoring risks, implementing controls, developing information security policies and procedures, and assessing cyber events. In addition to our Information Technology (IT) department, we have an Information Security (IS) department that provides oversight of our cybersecurity-related controls, including assistance in the development of related policies and procedures. The IT department is overseen by an Chief Technology Officer (CTO) who has an undergraduate degree in network and systems administration as well as significant experience in the development, operation, monitoring and management of information system operations, including but not to limited to cybersecurity oriented controls. The IS department is overseen by a Senior Cybersecurity Manager who holds a Master of Science degree and has varied experience in the field of information technology. Both the IT and IS departments report to the CIO, who holds various certifications in systems and cybersecurity methodologies and has over two decades of experience in the management of various aspects of information systems operations. The CIO approves the information security policies and procedures, implementation of controls, monitoring and detection programs, and employee training on cybersecurity risks. The CIO also is responsible for reporting on cybersecurity matters to the Board.


text: IT and/or IS inform the CIO concerning cybersecurity risks and events, including any mitigation and remediation efforts. Cybersecurity incidents are escalated to an incident response team ("IRT"), which is headed by the CIO. The IRT is responsible for overseeing our incident response strategy, including remediation. For ongoing events, those responsible for investigating the incident are required to continuously update the IRT and the CIO until the event is considered to be resolved. Significant cybersecurity incidents are referred to a committee responsible for evaluating whether the incident is material using criteria based on our ERM program. This committee is comprised of a cross functional team of various senior members of management including the areas of Finance, Accounting, Legal, IT Security, and Risk.


text: If a cybersecurity incident is deemed to have the potential for a material impact on the Company, our Incident Response, Reporting and Management Policy dictates procedures for promptly briefing the Audit Committee. In addition, our CIO reports all cybersecurity incidents, whether ongoing or first experienced during the quarter, to the Audit Committee at each quarterly meeting, and more frequently if necessary.


text: CYBERSECURITY RISK MANAGEMENT AND STRATEGY As part of our Enterprise Risk Management ("ERM") program, we maintain processes to assess, identify, manage, mitigate, and respond to material risks from cybersecurity threats. Central to these processes is a committee comprised of our Vice President of Internal Audit, our Chief Information Officer ("CIO"), members of our executive team, and other senior members of management that evaluates cybersecurity risks and designs and ensures implementation of appropriate controls, protections and training. This committee periodically reviews overall risks to the Company as part of the ERM program and ensures the alignment of cybersecurity efforts with the overall risk management framework. The committee has identified cybersecurity threats as one of the primary categories of risk to the Company.


text: We continually evaluate cybersecurity risks on an ongoing basis as part of our overall risk management strategy. We assess and identify cybersecurity risks through periodic risk assessments, penetration testing, and vulnerability scans, among other procedures and practices. We also receive cybersecurity alerts and threat intelligence from our peers, government agencies, information sharing and analysis centers and cybersecurity-related groups or associations. These and other measures are used to evaluate cybersecurity risks in a timely manner and to allocate resources in alignment with the overall risk management program. In the event of an incident, we intend to follow our detailed incident response policy, which outlines the steps to be followed from incident detection to eradication, recovery and notification. In addition, we regularly engage various third-parties to assess or test our systems and processes to enhance our detection and management of cybersecurity risks or assist with implementation of our risk management strategies, including consultants who assist with assessing risks and information security experts who conduct tabletop exercises with participation from company management.


text: The Audit Committee and the Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. Senior leadership, including our CIO, briefs the Board of Directors and the Audit Committee on cybersecurity risks and the effectiveness of our cybersecurity program as part of updates on our overall ERM program. Our Vice President of Internal Audit also provides the Audit Committee with an assessment of any material changes to cybersecurity risks and controls as a result of cybersecurity threats on at least a semi-annual basis.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Management is responsible for assessing and managing our cybersecurity risk management program. We have various teams and committees charged with monitoring risks, implementing controls, developing information security policies and procedures, and assessing cyber events. In addition to our Information Technology ("IT") department, we have an Information Security ("IS") department that provides oversight of our cybersecurity-related controls, including assistance in the development of related policies and procedures. The IT department is overseen by an Chief Technology Officer ("CTO") who has a degree in networking as well as significant experience in the development, operation, monitoring and management of information system operations, including but not to limited to cybersecurity oriented controls. The IS department is overseen by a Senior Cybersecurity Manager who holds a Master of Science degree and has varied experience in the field of information technology. Both the IT and IS departments report to the CIO, who holds various certifications in systems and cybersecurity methodologies and has over two decades of experience in the management of various aspects of information systems operations. The CIO approves the information security policies and procedures, implementation of controls, monitoring and detection programs, and employee training on cybersecurity risks. The CIO also is responsible for reporting on cybersecurity matters to the Board.


text: Given the critical importance of cybersecurity, including data privacy, we believe we have developed a comprehensive cybersecurity program, supported by robust risk management and oversight procedures. We are committed to implementing leading data protection standards and have a comprehensive set of written policies and standards that take into account the guidance of industry-standard cybersecurity frameworks.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: Management and Board Oversight We have dedicated cybersecurity resources led by our Chief Information Officer ("CIO"), who regularly provides reports to our executive officers, including the CEO and CFO. Our CIO has over 20 years of experience in the cybersecurity and IT fields and holds multiple degrees, including a Bachelor of Science in Information Science and a Master of Business Administration. Additionally, our CIO is a Certified Information Security Manager.


text: We have developed a cybersecurity incident response plan ("CSIRP") for cybersecurity incidents that may jeopardize the confidentiality, integrity, or availability of our IT systems. Our CSIRP guides the internal response to cybersecurity incidents, following a process that generally aligns with the industry-standard cybersecurity frameworks. Pursuant to the CSIRP and its escalation protocols, we engage the incident response team ("IRT"), which includes designated personnel responsible for: (1) analyzing the severity of the incident and associated threat; (2) notifying management of the threat; (3) containing the threat; (4) eradicating the threat; (5) restoring data and access to systems; (6) working with management to determine the reporting and disclosure obligations associated with the incident; and (7) performing post-incident analysis and improvements. The IRT is led by an incident response coordinator, which in the event of a cybersecurity incident would generally be the CIO, and includes members of our IT resources, risk management, legal, communications, finance, and accounting teams, in addition to any other necessary personnel depending on the particular facts and circumstances of the incident. When a cybersecurity incident is detected, the incident response coordinator notifies relevant members of management, as appropriate and consistent with the escalation protocols of the CSIRP, such as the CEO, CFO, and General Counsel, and provides an assessment of the incident and containment strategy, if applicable.


text: We consider cybersecurity as part of our broader consideration of business strategy and risk management. Our board of directors has delegated to the Audit Committee the responsibility of overseeing our risk management program, including risk assessment, risk management, and risk mitigation policies and programs. A key part of this responsibility is overseeing the cybersecurity program. The Audit Committee receives quarterly updates from our CIO with respect to the cybersecurity program, including current threat levels and ongoing program enhancements. The Audit Committee oversees our compliance with the industry-standard cybersecurity frameworks, our cybersecurity insurance coverage, cybersecurity-related internal controls, penetration testing, the CSIRP, business continuity plans, and threat assessments. The Audit Committee also periodically evaluates our cyber strategy to ensure its effectiveness, including benchmarking against our peers.


text: Processes for Assessing, Identifying, and Managing Material Risks from Cybersecurity Threats Our cybersecurity program has four components: (1) preparation and prevention; (2) detection and analysis; (3) incident response including containment, eradication, recovery, and reporting; and (4) post-incident analysis and program enhancements.


text: Preparation and Prevention We utilize a variety of tools, processes, software, and hardware that are managed and monitored by our IT resources and third-party vendors, as applicable, to prevent and prepare for cybersecurity threats. We conduct regular internal and external security audits and vulnerability assessments to reduce the risk of a cybersecurity incident and we implement business continuity, contingency, and recovery plans to mitigate the impact of an incident. As part of these efforts, we engage a third party to conduct penetration testing and an external review of our vulnerabilities. We continue to strengthen access management mechanisms including broad adoption of multi-factor authentication, geolocation-based blocking, and network segmentation. To support our preparedness, we perform tabletop exercises at least once a year to test our CSIRP.


text: We recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of our prevention efforts is comprehensive employee training to recognize and respond to cybersecurity threats. All new hires receive mandatory privacy and information security training. Employees must also complete mandatory ongoing annual cybersecurity and data trainings, which are supplemented throughout the year by regular phishing and other cyber-related testing. Additionally, we conduct specialized training for our high-risk employees on an annual basis and specialized training for employees with access to certain sensitive information systems. These trainings and tests are tracked throughout the year for each employee and are directly tied to their overall compensation.


text: We recognize that our third-party vendors can be subject to cybersecurity incidents which may impact us. To mitigate third-party risk, vendor access to network resources is reviewed, authorized, and monitored by our IT resources, including requirements for our third-party vendors' cybersecurity, estimated termination dates for network access, and regular reviews of all third-party vendor accounts and after access is granted, it is managed through various security tools. Third-party IT vendors are also subject to additional diligence such as questionnaires, inquiries, and relevant certifications.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means and indicators, which may include, but are not limited to, alerts from customers, employees, vendors, service providers, other third parties, and/or automated event-detection notifications. Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response coordinator follows the procedures pursuant to the CSIRP to investigate the potential incident, including classifying the nature and severity of the event (e.g. malware, ransomware, service interruption, denial of service, distributed denial of service, personal data breach, intellectual property breach, theft, or fraud) and sensitivity of any compromised data.


text: Containment, Eradication, Recovery, and Reporting With every cybersecurity incident, the highest priority for the IRT is to contain the cybersecurity incident as quickly as possible. A cybersecurity incident is considered contained when the attacker's ability to affect the network resources has been effectively controlled or stopped, the affected system(s) have been identified, and compromised data, memory image, and disks have been collected for analysis. The IRT is responsible for deciding on a containment strategy to respond to the cybersecurity incident, coordinating resources, and communicating to management with subsequent notification to the Audit Committee, if warranted.


text: The IRT also directs and coordinates eradication and recovery efforts. Eradication and recovery activities depend on the nature of the cybersecurity incident, which may include, but are not limited to, rebuilding systems and/or hosts, replacing compromised files with clean versions, validation of files or data that may have been affected, increased network monitoring or logging to identify recurring attacks, or employee re-training.


text: Containment, eradication, and recovery may be aided by third-party vendors or investigators. The incident response coordinator, in consultation with the IRT and management, will engage all third parties involved in the incident.


text: Our CSIRP provides clear communication protocols, including with respect to members of management, including the members of the IRT, CEO, CFO, CIO, General Counsel, Audit Committee, and external counsel, particularly with respect to legal obligations to report the incident to tenants, regulators, and law enforcement and, if applicable, our SEC reporting obligations.


text: Post-Incident Activity After recovery, the IRT gathers and preserves all incident-related documentation and conducts a post-incident analysis to identify and implement enhancements to the cybersecurity program that can mitigate the risk and/or severity of future incidents. The results of these reviews are shared with management and the Audit Committee. The incident response coordinator typically oversees the preparation of the formal incident report, its distribution, and the implementation of any enhancements identified through these reviews.


text: Cybersecurity Risks As of December 31, 2023, we have not had any material incidences involving cybersecurity attacks. However, we face risks associated with security breaches, whether through cyber-attacks or cyber-intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachments to emails, phishing attempts, or other scams. Although we make efforts to maintain the security and integrity of our networks and systems including the proprietary, confidential, and personal information that resides on or is transmitted through them, and we have implemented various cybersecurity policies and procedures to manage the risk of a security incident or disruption. However, there can be no assurance that our cybersecurity efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. See "We and our tenants face risks relating to cybersecurity attacks that could cause the loss of confidential information or other business disruptions" in Item 1A. "Risk Factors" for further information relating to cybersecurity risks.


text: Given the critical importance of cybersecurity, including data privacy, we have developed a cybersecurity program, supported by risk management and oversight procedures. The cybersecurity program includes written policies and standards that take into account the guidance of well-recognized industry cybersecurity frameworks.


text: Management and Board Oversight We have dedicated cybersecurity resources led by our Chief Information Officer ("CIO"), who regularly provides reports on cybersecurity to our executive officers, including the CEO and CFO. Our CIO has significant experience in the cybersecurity and IT fields and holds multiple degrees, including a Bachelor of Science in Information Science and a Master of Business Administration. Additionally, our CIO is a Certified Information Security Manager.


text: We have developed a cybersecurity incident response plan ("CSIRP") for cybersecurity incidents that may jeopardize the confidentiality, integrity, or availability of our IT systems. Our CSIRP guides the internal response to cybersecurity incidents, following a process consistent with well-recognized industry cybersecurity frameworks. Pursuant to the CSIRP and its escalation protocols, we engage the incident response team ("IRT"), which includes designated personnel responsible for: (1) analyzing the severity of the incident and associated threat; (2) notifying management of the threat; (3) containing the threat; (4) eradicating the threat; (5) restoring data and access to systems; (6) working with management to determine the reporting and disclosure obligations associated with the incident; and (7) performing post-incident analysis and improvements. The IRT is led by an incident response coordinator, which in the event of a cybersecurity incident would generally be the CIO, and includes members of our IT resources, risk management, legal, communications, finance, and accounting teams, in addition to any other personnel depending on the particular facts and circumstances of the incident.


text: We consider cybersecurity as part of our broader consideration of business strategy and enterprise risk management. Our board of directors has delegated to the Audit Committee the responsibility of overseeing our risk management program, including for the cybersecurity program. The Audit Committee receives quarterly updates from our CIO with respect to the cybersecurity program. As part of its oversight, the Audit Committee may, for example, receive updates regarding assessments of our alignment with certain industry cybersecurity frameworks, our cybersecurity insurance coverage, cybersecurity-related internal controls, results of penetration testing, revisions to the CSIRP, business continuity plans, and threat assessments.


text: Preparation and Prevention We utilize a variety of tools, processes, software, and hardware that are managed and monitored by our IT resources including third-party vendors, as applicable, to prevent and prepare for cybersecurity threats. We conduct regular internal and external security audits and vulnerability assessments to reduce the risk of a cybersecurity incident and we implement business continuity, contingency, and recovery plans to mitigate the impact of an incident. As part of these efforts, we engage a third party to conduct periodic penetration testing and an external review of our vulnerabilities. We continue to strengthen access management mechanisms including broad adoption of multi-factor authentication, geolocation-based blocking, and network segmentation. To support our preparedness, we perform tabletop exercises at least once a year to test our CSIRP.


text: We recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of our prevention efforts is training employees to recognize and respond to cybersecurity threats. All new hires receive mandatory privacy and information security training. Employees must also complete mandatory ongoing annual cybersecurity and data trainings, which are supplemented throughout the year by regular phishing and other cyber-related awareness activities. Additionally, we conduct specialized training for our high-risk employees on an annual basis and specialized training for employees with access to certain sensitive information systems. These trainings and tests are tracked throughout the year for each employee and are directly tied to their overall compensation.


text: We recognize that our third-party vendors can be subject to cybersecurity incidents which may impact us. To mitigate third-party risk, vendor access to our network resources is reviewed, authorized, and monitored for appropriateness. Third-party IT vendors that are determined to present a higher risk are also subject to additional diligence such as questionnaires, inquiries, and relevant certifications.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means and indicators, which may include, but are not limited to, alerts from customers, employees, vendors, service providers, other third parties, and/or automated event-detection notifications. Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response coordinator follows the procedures pursuant to the CSIRP to investigate the potential incident, including classifying the nature and severity of the event.


text: Containment, Eradication, Recovery, and Reporting The IRT is responsible for deciding on a containment strategy to respond to the cybersecurity incident, coordinating resources, and communicating to management with subsequent notification to the Audit Committee, if warranted.


text: The IRT also directs and coordinates eradication and recovery efforts. Eradication and recovery activities depend on the nature of the cybersecurity incident, which may include, but are not limited to, rebuilding systems and/or hosts, replacing compromised files with clean versions, or validation of files or data that may have been affected. Containment, eradication, and recovery may be aided by third-party vendors or investigators.


text: Our CSIRP provides clear communication protocols, including with respect to members of management, which may include, depending on the incident's classification and other circumstances, members of the IRT, CEO, CFO, CIO, General Counsel, Audit Committee, and external counsel. In addition, the CSIRP considers communications and reporting to tenants, regulators, and law enforcement.


text: Post-Incident Activity After recovery, the IRT conducts a post-incident analysis to identify potential enhancements to the cybersecurity program that can mitigate the risk and/or severity of future incidents. The results of these reviews are shared with management and the Audit Committee.


text: Cybersecurity Risks As of December 31, 2024, we have not had any known instances of material cybersecurity incidents. However, there can be no assurance that our cybersecurity efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. See "We and our tenants face risks relating to cybersecurity attacks that could cause the loss of confidential information or other business disruptions" in Item 1A. "Risk Factors" for further information relating to cybersecurity risks.


text: Risk Assessment and Management We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including, among other things, intellectual property, trade secrets, confidential information that is proprietary, strategic or competitive in nature, and personal data.

companyName: Twist Bioscience Corp

ticker: TWST


text: Our Chief Information Officer ("CIO") together with our Senior Director of IT Infrastructure, Security and Compliance and other members of the Information and Business Technology ("IBT") Security team, are responsible for establishing and implementing cybersecurity policies and procedures, which includes developing and updating our Security Incident Response Policy ("IRP"), managing incident response, and overseeing any policy exceptions and potential compensating controls.


text: Our cybersecurity program is based on the ISO 27001 security controls. We maintain an ISO 27001:2022 certification and we undergo routine audits by an independent, certified accreditation body to maintain this certification. We also provide annual, mandatory cybersecurity training for employees to equip our workforce with the knowledge to identify and respond to cybersecurity threats, such as phishing attempts.


text: Our process for assessing, identifying, and managing material risks from cybersecurity threats is integrated into our overall enterprise risk management process. As part of our overall enterprise risk management process, we have a cybersecurity risk management strategy based on National Institute of Standards and Technology (NIST) Special Publication. 800-30 "Guide for Conducting Risk Assessments" that provide guidelines and principles for information technology security risk management.


text: Incident Response We have a dedicated Information Security team within the IBT team responsible for managing and coordinating incident response efforts. This team collaborates closely with other teams within the company, including Legal and Finance, in identifying, analyzing, and responding to cybersecurity incidents, which includes tracking cybersecurity incidents to help identify any related incidents. When cybersecurity incidents are identified, our practice is to respond to and address them utilizing incident classifications and escalation protocols, in accordance with applicable governmental regulations and other legal requirements.


text: Engagement of Third Party Advisors We engage third party advisors, including assessors, cybersecurity consultants, and auditors to assess, validate, and enhance our cybersecurity program. We benefit from engaging third parties to provide specialized skills, knowledge, tools, and resources. These third parties also help reduce costs, increase efficiency, improve quality, mitigate risks, and review cybersecurity strategy, trends, and threat landscape. We refine and mature our cybersecurity roadmap and strategy based on findings and their risk standing.


text: Third-Party Service Provider Risk Management We have a process in place to oversee and identify risks from cybersecurity threats associated with our use of key third-party service providers during the course of engagement. The company maintains a formal risk management program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks. Our vendor security assessment process evaluates key vendors and, where appropriate, assesses vendor's controls for IT security, privacy, business continuity, and other third-party risks. Following an evaluation, the company determines and prioritizes risks based on their potential impact, which help inform the appropriate level of additional due diligence and ongoing compliance monitoring.


text: Material Risks from Cybersecurity Threats We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. For additional information regarding these risks, please refer to Item 1A, "Risk Factors — If we, or our partners or suppliers, experience a significant disruption in, or breach in security of, information technology systems or other cybersecurity incidents, our business could be adversely affected" in this Form 10-K.


text: Cybersecurity Governance Board Oversight of Risks from Cybersecurity Threats The Board oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our CIO regularly briefs the Board on cybersecurity matters. We have procedures led by our CIO which govern our assessment, response and notification of internal and external parties upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our executive team, to evaluate the overall impact and appropriate or required external notifications. Based on its nature and severity, the Board would be informed of an incident by our executive team.


text: Management's Role in Assessing and Managing Materials Risks from Cybersecurity Threats Under the IRP, cybersecurity incidents are escalated based on a defined incident severity to management as appropriate. Management, including the CIO, is involved in assessing and managing our cybersecurity risks. Our CIO has 14 years of experience managing information technology in complex environments. As noted above, the company's IRP includes standard processes for escalating significant cybersecurity incidents to management, including the CIO, who then informs the Board based on the nature and severity of the incident. The company's incident response team also coordinates with external legal advisors, cybersecurity forensic firms, communication specialists, and other outside advisors and experts, as appropriate.


text: Risk Management and Strategy We take a layered approach to cybersecurity leveraging multiple levels of controls designed to mitigate and minimize cybersecurity risks and protect the confidentiality, integrity, and availability of our critical systems and information. We have established and implemented policies and processes designed to assess, identify, and manage risks from cyber security threats, including product and SaaS security, and have integrated these into our operating model and enterprise risk management processes. We monitor for, and assess, material risks from cyber security threats such as unauthorized occurrences or events on or conducted through our information systems that may result in adverse effects to the confidentiality, integrity, or availability of our information systems or information, including personal information, proprietary information and intellectual property.

companyName: Life360, Inc.

ticker: LIF


text: Identification and Assessment To identify and assess risk, we maintain a cybersecurity risk register which is reviewed regularly and updated as appropriate. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damages that could result from such risks (to the extent known), and the potential sufficiency of existing mitigating policies, procedures, systems, and safeguards. Risk is scored based on the potential impact to the business (inherent risk) and re-scored based on mitigations in place (residual risk). Following this assessment, we determine opportunities for further mitigating identified risks.


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats, including product and SaaS security. These measures vary depending on the environment and threat. For example, we monitor our information systems, networks, and devices for potential threats, utilizing multiple mechanisms. We maintain Network Security Operations (NSO) and Site Reliability Engineering (SRE) teams to respond to potential threats or anomalies. We update vendor-provided tools (e.g. data management systems, financial reporting systems and infrastructure systems) in an effort to address identified vulnerabilities or threat vectors arising through vendor-provided products and services. We have adopted policies and standards aimed at implementing product security, including: conducting third-party penetration testing of our SaaS solutions; developing code based on a Security Software Development Lifecycle (SSDLC) process; and using automated tools for static code analysis and open-source scanning.


text: Changes to material systems are governed by our change management processes. Certain systems are scanned for static and dynamic vulnerabilities. Automatic and manual penetration tests of certain environments are performed frequently and often through third-party testing groups.


text: We have processes in place designed to control access to material systems and such processes are reviewed and updated as appropriate. We utilize certain controls such as two-factor authentication, intelligent anomaly detection and centralized identity and access management tools, designed to mitigate the risk of inappropriate access to internal user accounts.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example dynamic vulnerability testing, third party library vulnerability scanning, end-point management, enterprise monitoring tool, Attack Surface Management, web application firewall (WAF)/distributed denial-of-service (DDoS)/constant delivery network (CDN)/domain name server (DNS) protection, and backups and recovery. We also utilize service providers to assist with cybersecurity risk assessments.


text: Vendor Management In providing our products and services, we make extensive use of third-party vendors and applications. We onboard material vendors through a vendor review process, which includes a security assessment and a determination of what is required (for example, policies, procedures, technical controls, or physical controls) in an effort to securely configure any interaction with them. Vendors providing certain services may be subject to greater scrutiny, including reviews of any relevant certifications and/or independent testing of their products or systems. Certain vendors are reviewed annually in an effort to assess continued compliance with their obligations to us, and as relevant, the risk that they pose to our cybersecurity posture. Such reviews typically depend on the nature of the data and/or systems that these vendors may have access to or with which they otherwise interact.


text: Additional Information For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Risk Factors—Risks Related to Privacy and Cybersecurity."


text: Responsibilities of the Board of Directors Our Board provides oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure and the mitigation and remediation of cybersecurity incidents, and our executive officers (including our CEO, CFO, and COO) are responsible for the day-to-day management of the material risks we face, including cybersecurity risks. Our Board administers its cybersecurity risk oversight function as a whole, as well as through the Audit and Risk Committee ("ARC"). Our corporate security team informs the Board and ARC of certain cybersecurity risks and threats during quarterly meetings and provide materials shared in connection with such meetings, as well as ad hoc updates when there are material developments or changes that may impact cybersecurity risk to the company. Refer to "Item 10. Directors, Executive Officers and Corporate Governance" section of this Annual Report for additional information regarding the ARC and other committees of the Board as well as the ARC charter.


text: Responsibilities of Management Our corporate security team consists of the Manager of Security Engineering, a Senior Security Engineer, a Senior SRE and a Security Engineering Contractor. The corporate security team is primarily responsible for assessing and managing material risks from cyber security threats, defining and overseeing our corporate security program, reviewing technical designs and vendors for security risks, and managing our security tools and infrastructure. Our corporate security team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology systems environment, including those described in "Risk Management and Strategy." The corporate security team reports to the Senior Manager of Information Technology, who reports to the Senior Director of Engineering Operations which maintains responsibility for our cyber security program.


text: The corporate security team has a combined professional experience of several decades in cybersecurity and related fields, including software and hardware engineering, information technology systems, devops, and security program management. They hold a range of certifications in security and technology, such as in LCSPC, ISO/IEC 27001:2013, OSCP, SANS SEC, CSSLP and AWS. Several team members participate in groups that focus on information security such as OWASP, Open Security Summit and other professional organizations and projects.


text: Our Manager of Security Engineering provides frequent briefings to management regarding the Company's cyber security risks and risk-mitigation efforts, which may include recent incidents and related responses, newly identified risks, changes to the security program, and activities of third parties and vendors, as appropriate. Management provides cybersecurity updates to executive management and the Board through meetings and materials shared in connection with those meetings, as well as ad hoc updates when there are material developments or changes.


text: Incident Response Procedures Our cybersecurity incident response procedures are designed to escalate certain cyber security incidents to our executive officers and the Board as appropriate. Upon initial discovery of a potential incident, a member of the corporate security team leads the initial potential incident response efforts. Potential incidents are scored based on impact (including potential impact), and if certain criteria are met, the technical response team is broadened to include a representative from the Company's legal team and other relevant stakeholders (such as executive management) as appropriate. Our incident response team or its designee, provides relevant updates to the Chief Executive Officer or other Company senior management and the Board, as appropriate.