text: Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] oversight from our board of directors, our advisor and our senior management have implemented an enterprise-wide information security program designed to identify, protect against, detect, assess, respond to, and manage reasonably foreseeable cybersecurity risks and threats. Our cybersecurity processes have been integrated into our overall risk management system. To protect our information systems from cybersecurity threats, our advisor uses various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting and monitoring and detection tools. Our advisor also employs third parties to identify, prioritize, assess, mitigate and remediate information system risks; however, our advisor relies on such third parties to implement security programs commensurate with their risk, and our advisor cannot ensure in all circumstances that their efforts will be successful.


text: Cybersecurity Risk Board of Directors Oversight [Text Block] advisor's Vice President - Communications leads our advisor's information security group responsible for overseeing our information security program. Our advisor's Vice President - Communications has over 18 years of industry experience.

companyName: Moody National REIT II, Inc.

secItem: Item 1C


text: threats of all types, such as attacks from computer hackers, cyber criminals, nation-state actors, social engineering and other malicious internet-based activities, continue to increase. We believe that our current preventative actions and response planning provide adequate measures of protection against cybersecurity risks. While we have implemented measures to safeguard our information technology systems, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: CPI AEROSTRUCTURES INC

ticker: CVU


text: Director of Information Technology leads our cybersecurity program and is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The Director of Information Technology manages a team of information technology professionals with broad experience, including in cybersecurity threat assessments and detection, mitigation technologies, incident response, insider threats and regulatory compliance. Our Director of Information Technology brings extensive experience in cybersecurity, including conducting DIBCAC (Defense Industrial Base Cybersecurity Assessment Center)


text: audit and overseeing NIST (National Institute of Standards and Technology) internal audits. This expertise ensures our organization aligns with strict industry standards and maintains robust compliance measures.


text: we lack a formal risk assessment policy or analysis and no process has been integrated into our management system, a risk assessment would likely include identification of any reasonably foreseeable internal and external risks, any likelihood and potential damage that could result from such risks, and whether existing safeguards are sufficient to manage such risks. If appropriate and necessary, we would implement reasonable safeguards to minimize identified risks and address any identified gaps in existing systems. Board.

companyName: Texas Mineral Resources Corp.

ticker: TMRC


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, employee personal information, and clinical trial data, or Information Systems and Data.

companyName: Alto Neuroscience, Inc.

ticker: ANRO


text: We leverage a third party service provider under the direction of our Chief Financial Officer, or CFO, to help management identify, assess and manage our cybersecurity threats and risks. With the assistance of our third-party service provider, we identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, automated tools for ransomware and virus protection, identity verification tools aimed at ensuring authorized environment access, and ongoing vulnerability assessments.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example data encryption for certain data, network security controls, data segregation for certain data, access controls, physical security controls, monitoring for certain systems, asset management and tracking, and employee training. We also maintain cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are taken into account in our overall risk management processes. For example, we evaluate identified material risks from cybersecurity threats against our overall business objectives and will report material risks, if identified, to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist management to identify, assess, and manage material risks from cybersecurity threats, including for example, a managed security provider and professional services firms, including outside legal counsel.


text: We use third-party service providers to perform a variety of functions throughout our business, including, for example, application providers, hosting companies, contract research organizations, and contract manufacturing organizations. We have certain vendor management processes to help manage cybersecurity risks associated with our use of certain of these providers, and, depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, those processes may involve different levels of assessment and risk mitigation measures, including, for example, the imposition of contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see the sections titled "Risk Factors—Risks Related to our Business and Operations—If our telecommunications or information technology systems, or those used by our collaborators, CROs, CMOs, clinical sites, third-party logistics providers, distributors, or other contractors, consultants, or third party service providers upon which we rely, are or were compromised, become unavailable, or suffer security breaches, loss, or leakage of data or other disruptions, we could suffer adverse consequences resulting from such compromise, including but not limited to, operational or service interruption, harm to our reputation, litigation, fines, penalties and liability, compromise of sensitive information related our business, and other adverse consequences." and "Risk Factors—Risks Related to Government Regulations—Actual or perceived failures to comply with applicable data protection, privacy and security laws, regulations, standards, and other requirements could adversely affect our business, results of operations, and financial condition."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including our CFO, leveraging the expertise of our third party service provider. Our CFO has two years of oversight responsibilities for cybersecurity elements and has been involved in the oversight of the implementation of the Company's current cybersecurity measures.


text: Currently, our CFO is responsible for hiring appropriate personnel, managing external third-party providers, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including to our CFO. As part of those processes, members of management, including our CFO, would work to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes are designed to report certain cybersecurity incidents to the audit committee of the board of directors.


text: The audit committee receives periodic reports from management concerning our cybersecurity risks and the processes we have implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our Senior Director, Information Technology, in conjunction with a third party service provider, under the direction of our Chief Financial Officer, or CFO, help management identify, assess and manage our cybersecurity threats and risks. With the assistance of our Senior Director, Information Technology and third-party service provider, we identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, automated tools for ransomware and virus protection, identity verification tools aimed at ensuring authorized environment access, and ongoing vulnerability assessments.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: data encryption for certain data, network security controls, data segregation for certain data, access controls, physical security controls, monitoring for certain systems, asset management and tracking, and employee training. We also maintain cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are taken into account in our overall risk management processes. For example, we evaluate certain identified material risks from cybersecurity threats against our overall business objectives and will report material risks, if identified, to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see the sections titled: "Risk Factors—Risks Related to our Business and Operations—If our telecommunications or information technology systems, or those used by our collaborators, CROs, CMOs, clinical sites, third-party logistics providers, distributors, or other contractors, consultants, or third party service providers upon which we rely, are or were compromised, become unavailable, or suffer security breaches, loss, or leakage of data or other disruptions, we could suffer adverse consequences resulting from such compromise, including but not limited to, operational or service interruption, harm to our reputation, litigation, fines, penalties and liability, compromise of sensitive information related our business, and other adverse consequences." and "Risk Factors—Risks Related to Government Regulations—We and the third parties with whom we work are subject to stringent and evolving U.S. and foreign laws, regulations, and rules, contractual obligations, industry standards, policies and other obligations related to data privacy and security. Actual or perceived failures to comply with applicable data protection, privacy and security laws, regulations, standards, and other requirements could adversely affect our business, results of operations, and financial condition."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including our CFO, leveraging the expertise of our Senior Director, Information Technology and third party service provider. Our CFO has three years of oversight responsibilities for cybersecurity elements and has been involved in the oversight of the implementation of the Company's current cybersecurity measures. Our Senior Director, Information Technology has approximately 20 years of oversight responsibilities for cybersecurity elements and has been involved in the oversight of the implementation of the Company's current cybersecurity measures.


text: Currently, our CFO and Senior Director, Information Technology are collectively responsible for hiring appropriate personnel, managing external third-party providers, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including to our CFO. Senior Director, Information Technology, and General Counsel. As part of those processes, members of management, including our Senior Director, Information Technology and CFO, would work to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes are designed to report certain cybersecurity incidents to the audit committee of the board of directors.


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify, and manage risks arising from the cybersecurity threats confronting Morgan Stanley ("Cybersecurity Program"). Morgan Stanley's Cybersecurity Program helps protect the Firm's clients, customers, employees, property, products, services, and reputation by seeking to preserve the confidentiality, integrity, and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems, including as applicable to the Company and its stockholders. Morgan Stanley continually adjusts its Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.

companyName: North Haven Net REIT


text: The Adviser manages the Company's day-to-day operations, and the Company uses the Cybersecurity Program to assess, identify and manage material cybersecurity risks affecting the Company and its operations. The Company's business is dependent on the communications and information systems of Morgan Stanley, including but not limited to the Cybersecurity Program, and other third-party service providers.


text: Processes for Assessing, Identifying, and Managing Material Risks from Cybersecurity Threats Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and shareholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley cyber threat detection team, which develops and implements strategies designed to defend against these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Morgan Stanley's vulnerability management team, as well as Morgan Stanley's Non-Financial Risk function ("NFR") review external cybersecurity incidents that may be relevant to Morgan Stanley and the Company, to further inform the design of the Cybersecurity Program. To assess the efficacy of Morgan Stanley's controls and defenses designed to mitigate cybersecurity risk, it utilizes internal and external testing, including penetration testing and red team engagements. The results of these assessments are used to strengthen the Cybersecurity Program. Additionally, Morgan Stanley maintains a global training program covering cybersecurity risks and requirements, including heightened security training to specialized employees, and conducts regular phishing email simulations for its employees and consultants as preventative measures.


text: When a threat is identified in Morgan Stanley's environment, its incident response team follows an incident response plan to evaluate the impact to Morgan Stanley and coordinate appropriate remediation. If warranted, the cybersecurity incident will be reported to applicable regulators, authorities, impacted clients or counterparties, as appropriate. The Firm's cybersecurity incident response and remediation processes, including assessing materiality and reporting requirements, are reviewed through tabletop exercises.


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to Morgan Stanley or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity programs to identify the impact of their services on the cybersecurity risks to Morgan Stanley or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or an audit by Morgan Stanley of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's minimum cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable, to the board of trustees of the Company. Annually, key elements of the Cybersecurity Program are subject to review by an independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley and Company Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by Morgan Stanley's Head of Cyber, Technology, and Information Security Non-Financial Risk ("Head of NFR CTIS"), is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact Morgan Stanley and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company.


text: The Adviser is responsible for overseeing the Company's risk management function and generally relies on the CIO, CISO, and Head of NFR CTIS to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of NFR CTIS has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies.


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from management of Morgan Stanley as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of NFR CTIS report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to Morgan Stanley's Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our board of trustees.


text: Board of Trustees' Oversight of Risks from Cybersecurity Threats Our board of trustees provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our board of trustees receives periodic updates from the Adviser, the CIO, the CISO, and the Head of NFR CTIS, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Material cybersecurity risks are addressed by Morgan Stanley management-level ERM committees with escalation to the BOTC and our board of trustees, as appropriate. The BOTC has primary responsibility for assisting the MS Board in its oversight of significant operational risk exposures of Morgan Stanley and its business units, including IT, information security, fraud, third-party oversight, business disruption and resilience, and cybersecurity risks (including review of cybersecurity risks against established risk management methodologies) and the steps management has taken to monitor and control such exposures.


text: In accordance with its charter, the BOTC receives quarterly reports from (i) Technology, including the CIO or the CISO; (ii) Operations; and (iii) NFR. Such reporting includes updates on Morgan Stanley's Cybersecurity Program, risks from cybersecurity threats, Morgan Stanley's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment, and NFR's assessment of cybersecurity risks. Senior officers in Technology and NFR also provide an annual report to the BOTC on the status of Morgan Stanley's broader information security program in compliance with the GLB Act, which includes a discussion of risks arising from cybersecurity threats. At least annually, senior management representatives in Technology and NFR discuss the status of the Cybersecurity Program and key cybersecurity risks with the MS Board and, in accordance with the MS Board's Corporate Governance Policies, all board members are invited to attend BOTC meetings and have access to meeting materials. The BOTC, which meets at least quarterly, also reviews and approves significant policies related to cybersecurity, receives an annual independent assessment of key aspects of Morgan Stanley's Cybersecurity Program from an independent third party and holds joint meetings with the BAC and BRC, as necessary and appropriate. The chair of the BOTC regularly discusses cybersecurity developments with senior Morgan Stanley management and reports to the MS Board on cybersecurity risks and threats and other related matters.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2024, the Company has not identified any risks from cybersecurity threats that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Key elements of our cybersecurity risk management program and strategy include but are not limited to the following: • Adhering to principles of Security by Design and Security by Default • Conducting third-party vulnerability scans, and penetration testing • Access controls enforcing principles of Least Privilege, Zero Trust, and Role-Based Access Controls with MFA requirements for critical systems and accounts • Cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents • A third-party risk management evaluation process for key service providers based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors with access to our information systems or data • An employee cybersecurity awareness training program including awareness training and simulated attacks • A dedicated team responsible for incident identification, management, and remediation • Implementation of cybersecurity controls with ongoing monitoring and improvement internally, with assistance from external auditors • Third-party security vendors and auditors, where appropriate, to assess, test otherwise assist with aspects of our security processes.

companyName: PACS Group, Inc.

ticker: PACS


text: We have not identified cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Security breaches, cybersecurity incidents, or our inability to effectively integrate, manage and keep our information systems secure and operational could violate security laws, disrupt our operations, and subject us to significant liability."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the Committee) oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program. The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also regularly receives briefings from management on our cyber risk management program, as well as presentations on cybersecurity topics from our Vice President of Technology Support, internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including the Vice President of Technology Support and Director of IT Service Management, is primarily responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our internal information technology management team has over 15 years of tenure with the Company and over 45 years of experience in the information technology space. We also leverage a third party cybersecurity team from FIT Solutions to assist with cybersecurity governance and operations. Our third party team has over 65 years of experience across cybersecurity leadership, information technology engineering, and operations. Further, both our internal and retained consultants have obtained industry certifications, including Certified Information Systems Security Professional (CISSP), Rapid7 Certified Security Analyst, GIAC Security Operation Center Analyst (GSOC), GIAC Certified Incident Handler (GCIH), GIAC Penetration Tester (GPEN), Microsoft Security Certifications, and AWS Practitioner, among others.


text: Risk Management and Strategy The Company employs a comprehensive, cross-departmental approach designed to continuously identify, assess, and mitigate potential cybersecurity risks. Our cybersecurity risk management program involves collaboration between our employees, the Information Technology ("IT") team, and the Information Security ("InfoSec") team, which is led by our Chief Information Security Officer ("CISO"). The Company's cybersecurity policies, standards, and processes are integrated into the Company's overall risk management program, and we regularly consider cybersecurity risks in the context of material risks to the Company.

companyName: Bowhead Specialty Holdings Inc.

ticker: BOW


text: Our cybersecurity risk management program categorizes cybersecurity risks into five distinct areas: identify, protect, detect, respond, and recover, as defined by the National Institute of Standards and Technology Cybersecurity Framework. We regularly assess the evolving cybersecurity threat landscape, employing a layered cybersecurity strategy that emphasizes prevention, detection, and mitigation through a variety of technical and operational measures. As part of our cybersecurity risk management program, our information security program is tailored to address identified risks, while aligning with pertinent business requirements.


text: Cybersecurity is a shared responsibility across the Company, and all our employees are subject to periodic email phishing simulation campaigns and mandatory quarterly cybersecurity training to enhance awareness and readiness against potential common cyber threats. Certain roles require additional role-based, specialized cybersecurity training, such as tabletop exercises to ensure proactive preparation and effective coordination in the event of a security incident. We conduct tabletop exercises annually or as needed to review our incident response plan, as well as to identify and prioritize opportunities for improvement within our cybersecurity program and associated security controls. To help protect our data and information systems, we maintain Company-wide cybersecurity policies and procedures regarding encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and internet, social media, email, and wireless device usage. Our IT and InfoSec teams review and update such policies and procedures to adapt to the evolving cybersecurity threat landscape, industry best practices, and regulatory updates. Our CISO conducts thorough reviews of these updates on an annual basis or as needed to help ensure their continued relevance and effectiveness in safeguarding the Company's assets and business interests.


text: We continually seek to update our cybersecurity posture, encompassing end-user awareness training, layered defenses, critical asset identification and protection, enhanced monitoring and alerting. We engage with third-party experts to evaluate the efficacy of our security measures which includes network penetration testing. We also regularly evaluate cybersecurity risks associated with our use of third-party service providers, conducting an annual review of hosted applications and assessing their cybersecurity readiness. In addition, we annually obtain Service Organization Control ("SOC") reports on the suitability and operating effectiveness of the service providers' controls, known as a SOC 1 Type 2 Report. The report is prepared by an independent service auditor. We review such reports to confirm the existence of effective security controls over unauthorized access at third party service providers.


text: To date, there have been no cybersecurity events in the past that have materially affected, or are reasonably likely to materially affect, the Company's business strategy, results of operations, or financial condition. Although we believe our defenses against cyber-intrusions are sufficient, we continue to update our prevention programs to help respond to sophisticated and rapidly evolving threats that may try to circumvent our security measures.


text: Our Board, with the assistance of our Audit Committee, oversees our cybersecurity efforts performed by senior management, which is responsible for the identification and assessment of materials risk from cybersecurity incidents. In particular, our CISO is responsible for leading the management and assessment of material cybersecurity threats, and works closely with our head of IT, head of IT Operations and General Counsel. Our CISO has over 20 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies and managing information systems and protecting computer networks against cyber intrusions. Also, our IT Operations team meets regularly with the InfoSec and the head of Internal Audit.


text: Our Board and our Audit Committee receive reports on the Company's cyber security program, including an assessment of that our cybersecurity risk management program, annually or as needed. In addition, the Board and Audit Committee receive reports on the cybersecurity program, including any material cybersecurity risks, periodically or as needed.


text: Risk Management and Strategy. The Company's information security program consists of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, sensitive data management, electronic communication, risk/security reporting, incident response planning and business continuation planning. The information technology department ("IT Department"), which includes the cybersecurity department ("IT Security Department"), is responsible for implementing such processes and coordinating with the Human Resources Department to align training and onboarding efforts with such processes. The IT Security Department carries out risk management primarily by outsourcing risks to those companies and agencies that specialize in handling such risks and that have the appropriate resources to do so. Additionally, the IT Department assesses and improves the Company's cybersecurity risk management processes on an annual basis by: (i) engaging its cyber insurance broker, AON, plc, to a complete a benchmarking evaluation to compare the Company's cybersecurity posture against peers and (ii) engaging cyber risk readiness and response company, Netdiligence, to conduct vulnerability and penetration testing, which produces a report that specifies any possible risk area and devices. Such report is presented to the IT Department for analysis and for the purpose of developing subsequent action plans to remediate any vulnerabilities. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial conditions, except as otherwise noted.

companyName: Stirling Hotels & Resorts, Inc.


text: Governance. Management is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer, Vice President of IT, and the Information Security Manager. The Information Security Manager provides a weekly report to the Vice President of IT, which contains an overview of the activity in the department, any United States Computer Emergency Readiness Team alerts processed and all findings from the preventative maintenance tools. The Vice President of IT provides such report to the Chief Financial Officer on a quarterly basis. The board of directors is then briefed each quarter on the occurrence of any cybersecurity incidents. The Board will also be provided an overview of the information security program on an annual basis, including updates on the IT team, IT training, implementation of IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.


text: Risk Management and Strategy. The Company relies on Ashford Inc. and the Company's managers to protect the electronic assets of the Company. Their programs consist of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, electronic communication, risk/security reporting, incident response planning and business continuity planning. The information technology department of Remington Lodging & Hospitality, LLC ("Remington Hospitality") ("IT Department"), which includes a cybersecurity department ("IT Security Department"), is responsible for implementing processes and coordinating with the Human Resources Department to align training and onboarding efforts of Ashford Inc. and Remington Hospitality employees handling the Company's electronic assets.


text: Governance. Management, provided by Ashford Inc. is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer of Ashford Inc. and the Chief Technology Officer for Remington Hospitality. A Cyber Incident Response Team comprised of Ashford Inc. and Remington Hospitality employees meets bi-weekly to review incidents that have occurred and/or impacted the Company's electronic assets. The Chief Technology Officer of Remington Hospitality reviews weekly reports that contain an overview of the activity in the department, any United States Computer Emergency Readiness Team alerts processed and all findings from the preventative maintenance tools. The Chief Technology Officer provides such report to the Chief Financial Officer on a quarterly basis. The Audit Committee of the board of directors is then briefed each quarter on the occurrence of any cybersecurity incidents. The board of directors will also be provided an overview of the information security program on an annual basis, including updates on Remington Hospitality's IT team, IT training, implementation, IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.


text: Cybersecurity Risk Management Cybersecurity risk management is a critical priority for our Company, and we recognize the increasing sophistication and prevalence of cyber threats globally. We face ongoing risks related to cyber-attacks, data breaches, and system disruptions, which could materially impact our operations, financial results, and reputation. These risks encompass a broad spectrum, including potential disruptions to our critical energy infrastructure, compromise of confidential or sensitive operational and commercial data, theft of intellectual property, and financial losses resulting from business interruption, remediation costs, and regulatory penalties. Our cybersecurity program is designed to align with industry-leading standards, including the widely recognized NIST Cybersecurity Framework (CSF), and provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers. This framework guides our approach to cybersecurity risk management through five core principles Identify, Protect, Detect, Respond, and Recover, which enable what we believe is a comprehensive and proactive security posture. Our cybersecurity program is comprised of policies, procedures, controls, and tools designed to mitigate cybersecurity risks. We maintain a risk assessment process which includes steps for identifying cybersecurity threats, assessing the severity and impact, identifying the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. This program includes preventative controls, continuous monitoring, incident detection and response capabilities, and regular security assessments and updates. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements.

companyName: Venture Global, Inc.

ticker: VG


text: We are committed to complying with all applicable cybersecurity regulations, including those relevant to the operation of US LNG export terminals and natural gas pipelines. Our facilities and maritime operations are subject to the Maritime Transportation Security Act, and we are dedicated to meeting its applicable cybersecurity-related requirements as enforced by the US Coast Guard and relevant guidance from agencies such as the Cybersecurity and Infrastructure Security Agency. We are committed to continuously enhancing our cybersecurity defenses and incident response plans to adapt to the evolving threat landscape and protect our assets and stakeholders. Given the nature of our operations, a particular area of focus is the security of our Operational Technology and Industrial Control Systems, which are essential for the safe and continuous operation of our liquefaction plants, terminals, and related infrastructure. Protecting these systems from cybersecurity threats is paramount to prevent operational disruptions, ensure safety, and maintain the reliability of our energy delivery.


text: Our board of directors has overall oversight responsibility for our risk management, and, following our IPO, delegates cybersecurity risk management oversight to the audit committee. The audit committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The audit committee reports material cybersecurity risks to our full board of directors. Cybersecurity governance is overseen by senior management, which is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs.


text: Leadership for our cybersecurity program is provided by our Chief Information Officer, or CIO, who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CIO is a seasoned executive with over 25 years of experience in Information Technology, including 18 years in cybersecurity leadership roles specifically within the energy industry. The CIO's expertise is further underscored by prior service on the American Gas Association's Distribution Natural Gas Information Sharing and Analysis Center and as a former President of Oregon's InfraGard chapter, a partnership between the FBI and the private sector. Notably, the CIO also serves as our Chief Information Security Officer and is supported by a cybersecurity team with many years of experience led by a Vice President of Cybersecurity.


text: Management, including the Chief Financial Officer and CIO, will update the audit committee on our cybersecurity programs, material cybersecurity risks, program assessments and mitigation strategies. The CIO will provide periodic cybersecurity reports that cover these topics and industry developments.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A.— Risk Factors —Risks Relating to Intellectual Property, Data Privacy and Cybersecurity—Hostile cyber intrusions, or other issues with our information technology, could severely impair our operations, lead to the disclosure of confidential information, damage our reputation and otherwise have a material adverse effect on our business of this Form 10-K.


text: We recognize the critical importance of maintaining the trust and confidence of our patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST, the International Organization for Standardization and other applicable industry standards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST framework as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Inhibrx Biosciences, Inc.

ticker: INBX


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a cybersecurity program designed to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer, General Counsel, and Director of Information Technology.


text: At least annually, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards predetermined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our audit committee generally receives materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Director of Information Technology. Our audit committee also receives prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led primarily by our Director of Information Technology, who has several years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. Our Director of Information Technology is informed with regard to and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, our management team reports to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually.


text: Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: Onyx Acquisition Co. I


text: Our information security program is guided by the Chief Information Security Officer (CISO) who reports to the Chief Information Officer (CIO), who reports to the Company's Interim CEO. The current CISO has approximately twenty five years of experience serving in information security leadership roles across financial, software, government and life sciences industries, including previously operating in the role of the CISO for several large companies, and possesses the requisite education, skills, experience and industry certifications expected of an individual assigned to these duties. The IT Security Team, which is comprised of certain other cybersecurity focused team members, is responsible for addressing the dynamic threats against our electronic systems and assisting the workforce with handling system incidents, including centralizing the reporting, detection and response to incidents. Incident management and response processes define the recommended teams, actions and procedures needed to recognize and respond to an incident; assess the situation quickly and effectively; notify the appropriate individuals and organizations about the incident; organize the Company's response activities, including activating a command center; escalate the Company's response efforts based on the severity of the incident; and support the business recovery efforts being made in the aftermath of the incident. Additionally, third-party security experts are regularly engaged to monitor, assess, review and analyze the information technology landscape. The Company's incident response framework also defines the roles with respect to cybersecurity risk oversight and assigns responsibility to the IT Security Team. The IT Security Team members have: (i) completed extensive cybersecurity training; (ii) have experience assessing cybersecurity incidents; (iii) actively participate in industry and government forums; and (iv) collaborate with our peers to understand and improve cybersecurity intelligence, vulnerability management and defense strategies.

companyName: Endo LP


text: Our internal audit team performs audits of our information systems and network security. The audit scope, timing and frequency of our cybersecurity control framework is integrated into the Company's overall risk management process and the planning for, and results of, those audits are reviewed with the Audit & Finance Committee.


text: We regularly assess and monitor our cybersecurity risks and incidents and report them to our senior management and Audit & Finance Committee. Our Audit & Finance Committee oversees our cybersecurity strategy and governance and reviews our cybersecurity policies and practices on a periodic basis. Additionally, and as further discussed above, the Audit & Finance Committee is briefed multiple times a year or as needed by the CISO and/or CIO and, if applicable as determined by the Company's senior leadership, external advisors on the current and emerging cybersecurity threats and trends and the effectiveness of our cybersecurity controls and response capabilities.


text: As of the date of this report, we have not experienced any cybersecurity threats or incidents that have materially affected, or reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. Refer to "Our operations could be disrupted if our information systems fail or are not upgraded or are subject to cyber-attacks" in Part I, Item 1A of this report for additional information on risks from cybersecurity threats.


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Company has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Company's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: The Company has implemented technical safeguards that are designed to defend the Company's information systems from cybersecurity threats. These safeguards include network security capabilities such as firewalls, intrusion prevention and detection systems; endpoint protection capabilities such as anti-malware functionality; and access controls, which are evaluated for accuracy on a quarterly basis. The Company has also implemented email protection to minimize phishing attacks and ensure integrity in digital communications. We baseline our assets according to the technical controls recommended in the National Institute of Standards and Technology Special Publication 800-171 ("NIST SP 800-171"). • Cyber Intelligence & Continuous Monitoring: The Company has established continuous monitoring of our environment through a third party and receives alerts on threats and policy violations to ensure we meet our 96 hour window to report material matters to the SEC. The Company is a member the Defense Industry Base ("DIB") and receives cyber intelligence based on current threat actors and tactics, techniques and procedures ("TTP's") from the DIB organization, the Federal Bureau of Investigation ("FBI") cyber division, Department of Homeland Security, and the National Security Agency Cybersecurity Collaboration Center ("NSA CCC"). • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Company's response to a cybersecurity incident. The Company conducts annual tabletop exercises that simulate a cyber attack to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on the Company's cybersecurity systems. • Education and Awareness: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.

companyName: Amentum Holdings, Inc.

ticker: AMTM


text: The CISO has served in various roles in information technology and information security for over 20 years, including serving as the Chief Information Security Officer of PAE Incorporated prior to its acquisition by Amentum. The CISO holds an undergraduate degree in computer science from the University of Maryland and a graduate degree in information security and assurance from Carnegie Mellon University. The CISO has attained the professional certifications of Certified Information Systems Security Professional ("CISSP") and Certified Information Systems Manager.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We maintain a strategic plan to protect our information and to manage and mitigate emerging cybersecurity threats. Our cybersecurity team, led by our Chief Information Security Officer ("CISO"), oversees our cybersecurity efforts on a day-to-day basis. Our cybersecurity team, in partnership with third parties, designs, implements and operates our data security and cybersecurity programs, risk assessments, monitoring procedures, and training programs for our associates.

companyName: Ferguson Enterprises Inc. /DE/

ticker: FERG


text: Cybersecurity risk management is integrated into our overall enterprise risk management program ("ERM Program") and our cybersecurity, legal, infrastructure, privacy and other cross-functional teams work together to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Cybersecurity risk management is also integrated into our broader risk management framework through information technology general controls that are independently tested by our Internal Audit team and the findings reported to the Audit Committee.


text: As part of our cybersecurity risk management and strategy, the Company invests in processes, resources and incremental technical defenses to help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. We have enterprise-level compliance processes, policies and insurance coverage in place, including related to data protection and cybersecurity. We utilize the ISO 27001:2022 information security standard to drive our risk assessment and to identify and prioritize technology and process investments. Additionally, Ferguson maintains a Security Operations Center ("SOC") with enterprise event visibility.


text: The Company maintains a Cybersecurity Incident Response Plan ("CIRP") that establishes a foundation for capture, containment, escalation, and response to cybersecurity events across the Company. The CIRP details how the Company, including the SOC and cybersecurity team, prioritize and respond to cybersecurity events and incidents, including when and how incidents are escalated to key members of management who in turn determine whether further escalation to the Audit Committee or Board is appropriate. The CIRP also includes actions designed to enhance processes and responsiveness to address and prevent future incidents.


text: Ferguson invests in associate training and education to prevent cyber attacks, including customized, role-based training provided to targeted internal audiences. In addition, we conduct periodic awareness campaigns and regular phishing email simulation tests to reinforce prior training and promote ongoing awareness of risks. We also periodically conduct tabletop exercises with management and other associates to practice cyber incident response and to improve our processes and strategies.


text: In addition, Ferguson regularly engages with independent third-party partners, including cybersecurity assessors, consultants, and auditors, to assess and consult on our cybersecurity capabilities, prioritize areas of risk and assist with execution of our risk management systems and strategic plans. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements. To mitigate data or security incidents that may originate from third-party suppliers, we have a third-party risk management program that works to classify service provider or business partner risk based on several factors, including but not limited to data type accessed and/or retained. Using a risk-based approach, we perform diligence and security risk assessments for certain vendors and service providers, including appropriate obligations in our contractual arrangements where applicable.


text: As of the date of this Annual Report, cybersecurity incidents and risks, separately or in aggregate, have not materially affected our business strategy, results of operations, and financial condition. However, we face ongoing risks from cybersecurity threats and there can be no assurance that our security efforts and measures, and those of our third-party vendors, will prevent breakdowns or incidents to our or our third-party vendors' systems that could adversely affect our business. See "Risk Factors—If we are unable to protect our sensitive data and information systems against data corruption, cybersecurity incidents or network security breaches, or if we are unable to provide adequate security in the electronic transmission of sensitive data, it could adversely affect our business, financial condition and results of operations" and "—A failure of a key information technology system or process could adversely affect the operations of our business" in Item 1A of this Annual Report for more information on our cybersecurity-related risks.


text: Role of the Board Our Board is ultimately responsible for the risk oversight of the Company, including risks from cybersecurity threats. The Board has delegated to the Audit Committee responsibility for monitoring the overall adequacy and effectiveness of the ERM Program, and the Audit Committee is specifically charged with discussing the Company's cybersecurity risk exposures and the steps management has taken to monitor and control these exposures. The Board and/or the Audit Committee receives periodic reports, briefings and presentations on data protection and cybersecurity matters from senior information technology leaders, including our Chief Digital and Information Officer ("CDIO") and CISO, as well as from our Internal Audit team. In addition, our Chief Legal Officer provides reports on the ERM Program. Periodically, our Board receives reports and/or presentations on cybersecurity matters prepared by third-party cybersecurity experts. In addition to these Board and Audit Committee updates, our CIRP provides that significant developments or incidents, even if immaterial to the Company, will be reviewed regularly by a cross-functional team to determine whether further escalation to the Audit Committee or Board is appropriate, enabling Audit Committee and Board oversight that is timely and responsive.


text: Role of Management Pursuant to our ERM Program charter, our Executive Committee is responsible for assessing and managing the Company's exposure to enterprise risks. The Executive Committee is composed of the CEO and his direct reports, including the CDIO. Our CISO and the cybersecurity teams are primarily responsible for identifying, assessing, monitoring and managing our cybersecurity threats. They receive information regarding cybersecurity incidents and threats from the SOC and through internal escalation procedures detailed in the CIRP. The CISO then provides periodic reports to the Executive Committee, including reporting on significant cybersecurity incidents and resulting remedial actions, the cybersecurity team's strategic plan, the results of associate trainings, and any other notable cybersecurity matters.


text: Our CISO has 25 years of industry experience, including in developing and leading cybersecurity risk management programs for Fortune 100 companies. Additionally, our CISO and members of the cybersecurity team hold a number of industry recognized certifications, such as Certified Information Systems Security Professional, Payment Card Industry Data Security Standard Internal Security Assessor, Certified Information Security Manager, Certified in Risk and Information Systems control, and Certified Ethical Hacker, among others.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We maintain a strategic plan to protect our information and to manage and mitigate emerging cybersecurity threats. Our cybersecurity team, led by our Chief Information Security Officer ("CISO"), who reports to our Chief Digital & Information Officer ("CDIO"), oversees our cybersecurity efforts on a day-to-day basis. Our cybersecurity team, in partnership with third parties, designs, implements and operates our data security and cybersecurity programs, risk assessments, monitoring procedures, and training programs for our associates.


text: Cybersecurity risk management is integrated into our overall enterprise risk management program ("ERM Program") and our cybersecurity, legal, infrastructure, privacy and other cross-functional teams work together to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Cybersecurity risk management is also integrated into our broader risk management framework through information technology general controls that are independently tested by our Internal Audit team, the findings of which are reported to the Audit Committee.


text: Ferguson invests in associate training and education on cybersecurity and risk management thereof. Ferguson provides annual phishing training to all associates who are issued a Company device, and our annual Code of Conduct training often features information technology subjects, such as protection of company and personal information and identifying and reporting cybersecurity and phishing incidents. In addition, we maintain a cybersecurity awareness hub on our company intranet, regularly distribute cyber newsletters and cyber tips, and conduct regular phishing email simulation tests, including customized role-based tests, to reinforce prior training and promote ongoing awareness of risks. We also periodically conduct tabletop exercises with management and other associates to practice cyber incident response and to improve our processes and strategies.


text: As of the date of this Annual Report, cybersecurity incidents and risks, separately or in aggregate, have not materially affected our business strategy, results of operations, and financial condition. However, we face ongoing risks from cybersecurity threats and there can be no assurance that our security efforts and measures, and those of our third-party vendors, will prevent or minimize cybersecurity risks. See "Risk Factors—If we are unable to protect our sensitive data and information systems against data corruption, cybersecurity incidents or network security breaches, or if we are unable to provide adequate security in the electronic transmission of sensitive data, it could materially adversely affect our business, financial condition and results of operations" and "—A failure of a key information technology system or process could materially adversely affect the operations of our business" in Item 1A of this Annual Report for more information on our cybersecurity-related risks.


text: Role of the Board Our Board is ultimately responsible for the risk oversight of the Company, including risks from cybersecurity threats. The Board has delegated to the Audit Committee responsibility for monitoring the overall adequacy and effectiveness of the ERM Program, and the Audit Committee is specifically charged with discussing the Company's cybersecurity risk exposures and the steps management has taken to monitor and control these exposures. Our Chief Legal Officer provides reports on the ERM Program twice a year. The Board and/or the Audit Committee receives periodic reports, briefings or presentations on data protection and cybersecurity matters from senior information technology leaders, including our CDIO or CISO, as well as from our Internal Audit team. In addition to these Board and Audit Committee updates, our CIRP provides that significant developments or incidents, even if immaterial to the Company, will be reviewed regularly by a cross-functional team to determine whether further escalation to the Audit Committee or Board is appropriate, enabling Audit Committee and Board oversight that is timely and responsive.


text: Role of Management Pursuant to our ERM Program charter, our Executive Committee is responsible for assessing and managing the Company's exposure to enterprise risks. The Executive Committee is composed of the CEO and members of senior management appointed by the CEO, including the CDIO. Our CDIO has delegated to our CISO and the cybersecurity teams primary responsibility for identifying, assessing, monitoring and managing our cybersecurity threats. They receive information regarding cybersecurity incidents and threats from the SOC and through internal escalation procedures detailed in the CIRP. The CISO then provides periodic reports to the Executive Committee, including reporting on significant cybersecurity incidents and resulting remedial actions, the cybersecurity team's strategic plan, the results of associate trainings, and any other notable cybersecurity matters.


text: Our CDIO has over 25 years of executive experience leading information technology teams and providing strategic vision for multiple Fortune 500 companies. For further details about our CDIO's background, see the "Information About Our Executive Officers" section of Part I of this Annual Report. Our CISO has over 25 years of industry experience, including in developing and leading cybersecurity risk management programs for Fortune 100 companies. Additionally, our CISO and members of the cybersecurity team hold a number of industry recognized certifications, such as Certified Information Systems Security Professional, Payment Card Industry Data Security Standard Internal Security Assessor, Certified Information Security Manager, Certified in Risk and Information Systems control, and Certified Ethical Hacker, among others.


text: Risk Management and Strategy As an externally managed company, the Company relies on our Manager's corporate information technology, accounting and financial reporting platforms, enterprise applications and related systems (the "Information Systems") in connection with the Company's day-to-day operations. Pursuant to an administrative services agreement, our Manager in turn relies on the Information Systems of TCG Services LLC, an affiliate of our Manager, to fulfill its obligations to the Company. Our Manager has adopted a written information security program (the "Written Information Security Policy"), which is designed to address applicable requirements under Regulation S-P and the FTC Safeguards Rule. Consequently, the Company also relies on the processes for assessing, identifying, and managing material risks from cybersecurity threats under the Manager's Written Information Security Policy. The processes include, among other things, maintaining secure digital or physical access to information assets, using manual and automated detection methods for malicious code, due diligence of third-party vendors, and engaging a leading provider of cybersecurity services to assess and manage cybersecurity risk. For third-party service vendors that perform a variety of important functions for our business, we seek to engage reliable, reputable service vendors that maintain cybersecurity programs.

companyName: Sunrise Realty Trust, Inc.

ticker: SUNS


text: All of the Company's personnel are employees of the Manager or one of its affiliates and are subject to the Manager's policies and procedures. Our Manager, through an affiliate, utilizes a third-party managed & cybersecurity services provider (the "MSSP") for cybersecurity services, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery and general cybersecurity education and awareness. Our Manager and the MSSP engage in periodic assessment and training regarding the policies, standards and practices designed to address cybersecurity threats and incidents. Our cybersecurity risk management is integrated into our overall enterprise risk management and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management.


text: Cybersecurity Governance The Company is managed by the Adviser. As an indirect subsidiary of KKR, the Adviser is subject to and participates in KKR's processes for assessing, identifying, and managing risks from cybersecurity threats, as detailed below.

companyName: KKR Enhanced US Direct Lending Fund-L Inc.


text: KKR's Chief Information Security Officer (the "KKR CISO") leads an information security team (the "KKR information security team") whose responsibilities include securing data from unauthorized use or access. The cybersecurity strategy and program at KKR's asset management business includes, among other things, annual employee training about cybersecurity risks and new employee onboarding about KKR's security policies.


text: The KKR CISO is a member of KKR's Operational Risk Committee. The Operational Risk Committee is comprised of senior employees from across KKR's asset management business and operating functions. The committee focuses on significant operating and business risks, which includes among others, regulatory, cybersecurity, operational, geopolitical, and reputational risks, and is responsible for ensuring risks are identified, assessed, managed and mitigated effectively. The cybersecurity risk environment for KKR's asset management business, which includes identifying and monitoring KKR's technology risks, including those related to information security, business disruption, fraud and privacy related risks, and also promoting cybersecurity awareness at KKR. The Operational Risk Committee reports to KKR's Risk and Operations Committee, which is comprised of senior employees from across KKR's asset management and insurance businesses and operating functions. KKR's Risk and Operations Committee includes KKR's Chief Financial Officer, Chief Operating Officer, Chief Legal Officer, General Counsel, and Chief Compliance Officer. At least annually, management will present to the Audit Committee and the Risk Committee of KKR's Board of Directors on various topics relating to KKR's technology risks, including KKR's cybersecurity program, the current cybersecurity threat landscape, and risk management.


text: Cybersecurity Risk Management and Strategy KKR's asset management business has a cybersecurity incident response plan, which was developed taking into account industry standard guidance provided by institutes such as the National Institute of Standards and Technology. This plan is a key component of the cybersecurity program, which is generally incorporated within our enterprise risk management framework. The KKR CISO and KKR's Chief Compliance Officer co-chair a cybersecurity incident response team ("KKR CIRT"), which aims to manage and mitigate the risk and impact of cybersecurity breach events at KKR's asset management business, including those arising from third-party service providers, including those providers that have access to KKR's customer and employee data. Cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform cybersecurity-related diligence on third parties that have access to our systems, data or facilities. In addition to the KKR CISO and KKR's Chief Compliance Officer, the KKR CIRT includes members of KKR's legal, technology, compliance, risk, public affairs, human capital and finance groups. KKR has established a notification decision framework to determine when the KKR CIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including the Risk and Operations Committee, senior members of management, and KKR's Board of Directors and its committees.


text: As of the date of this Annual Report on Form 10-K, we do not believe that our business strategy, results of operations or financial conditions have been materially affected by any cybersecurity incidents for the period covered by this report. However, institutions like KKR, as well as KKR's employees, service providers and other third parties, have experienced information security and cybersecurity attacks in the past and will likely continue to be the target of increasingly sophisticated cyber actors. For a discussion of how risks from cybersecurity threats may affect us, see "Item 1A. Risk Factor - Cybersecurity Risks."


text: Board Oversight of Cybersecurity Risks The Board of Directors of the Company provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Company's Chief Information and Technology Officer ("CITO") and Chief Information Security Officer ("CISO") provide annual written reports and quarterly briefings on the Company's cybersecurity program to the Board of Directors. They also provide quarterly cybersecurity updates to the Audit and Compliance Committee. The reports to the Board of Directors include details and metrics on, among other things, the Company's quarterly Cybersecurity Framework assessment updates, internal and external threat intelligence, quarterly information security program progress, business associate risk assessments and ongoing monitoring, company-wide awareness training, device security compliance, routine resilience efforts including disaster recovery exercises, tabletop security incident response exercises, and cyber penetration tests.

companyName: Concentra Group Holdings Parent, Inc.

ticker: CON


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CITO and CISO, is responsible for assessing and managing material risks from cybersecurity threats. The Company's CITO and CISO have one and 20 years of experience in cybersecurity, respectively. The Company provides formalized cybersecurity training for newly-hired employees and annually for existing employees. In addition, the Company provides cybersecurity awareness training and education throughout the year. The annual cybersecurity training curriculum includes modules on information security, the employee's role in protecting Company information, recognizing different cybersecurity incidents, identifying phishing emails, understanding the appropriate personnel to approach with information or questions, and acceptance of the Company's Information Security Policy. The Company's management is informed of cybersecurity incidents through ongoing monitoring and, in some cases, through receipt of notifications from third-party service providers. The CISO maintains and annually updates a Cybersecurity Incident Response Plan, which is a guide for the Company's cybersecurity team to respond effectively to cybersecurity incidents in a coordinated manner in the interest of minimizing the risk of harm. The team works with colleagues in various departments throughout the Company, including Information Technology, Legal, Risk Management and Compliance, to prevent, mitigate and remediate cybersecurity incidents impacting the Company.


text: Assessment of Cybersecurity Risk Management continuously assesses the potential impact of risks from cybersecurity threats on the Company, and regularly evaluates how such risks could materially affect the Company's business strategy, operational results, and financial condition. As noted above, an assessment of the cybersecurity program leveraging the Cybersecurity Framework is completed annually by an independent and qualified external third-party cybersecurity assessor. Additionally, Concentra receives a certified System and Organization Controls 2, Type 1 assessment, a voluntary compliance standard for ensuring that the Company properly manages and protects the sensitive data in its care, conducted by an independent and qualified external third-party assessor. The Company has not experienced a cybersecurity breach or information security breach during the past three fiscal years. The Company, from time to time, has been notified of third-party information cybersecurity breaches, but none of them has had a material impact on the Company's operations or financial results. The Company annually purchases a cybersecurity risk insurance policy to help defray the costs associated with any covered cybersecurity incident. Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted.


text: Management and Board of Trustees Oversight Our Board of Trustees oversees risk management for the Company, including through its approval of the investment policy and other policies of the Company and its oversight of the Advisor. For certain risks, our Board of Trustees has delegated oversight responsibilities to committees of our Board of Trustees. For example, the Nominating Committee assists our Board of Trustees with assessing risks associated with conflicts of interest. Cybersecurity risk management is integrated into this broader risk management framework. Our Board of Trustees has delegated to the Audit Committee oversight of management's programs and policies to identify, assess, manage, mitigate and monitor significant business risks of the Company, including privacy, information technology and cybersecurity risks.

companyName: Franklin BSP Real Estate Debt BDC


text: Information Technology and Cybersecurity Risks We have no employees and rely on the Advisor, a wholly-owned subsidiary of Franklin Templeton, to manage our day-to-day operations pursuant to the Investment Advisory Agreement. Therefore, we rely heavily on Franklin Templeton's information systems and its program for defending against and responding to cybersecurity threats and incidents. Franklin Templeton maintains a robust cybersecurity defense program, including a dedicated cybersecurity team led by its Chief Security Officer ("CISO"). The CISO, who reports directly to the Franklin Templeton Executive Vice President and Chief Risk and Transformation Officer, has 28 years of experience in the information technology and cybersecurity field and has been at Franklin Templeton for 12 years. In addition, the CISO provides regular briefings for our Board of Trustees and senior officers of the Company on cybersecurity matters, including on threats, events, and program enhancements. The Chief Compliance Officer of the Company also provides periodic updates to our Board of Trustees and senior officers of the Company on cybersecurity threats and material risks from cybersecurity threats with respect to the Company.


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems the Advisor uses to provide services to us pursuant to the Investment Advisory Agreement, Franklin Templeton's cybersecurity team utilizes a regularly updated cybersecurity incident response plan that was developed based on, and is periodically benchmarked to, applicable third-party cybersecurity standards and frameworks. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the response team is led by the CISO or their delegee. In addition, senior officers of the Company have implemented a Company policy that supplements the Franklin Templeton incident response plan with respect to cybersecurity incidents that have or may impact the Company, including by impacting the Advisor's ability to provide services to the Company pursuant to the Investment Advisory Agreement. Pursuant to this policy, the Advisor and Franklin Templeton are required to notify and update the Company's senior officers and our Audit Committee with respect to certain matters related to cybersecurity incidents specified under the policy.


text: The Audit Committee oversees, on behalf of our Board of Trustees, the Company's privacy, information technology and security and cybersecurity risk exposures, including (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation, (ii) the programs and steps implemented by management to monitor and mitigate any exposures, (iii) the Company's information governance and information security policies and programs, and (iv) major legislative and regulatory developments that could materially impact the Company's privacy, data security and cybersecurity risk exposure. On a quarterly basis, the CISO or their delegee report to our Board of Trustees or Audit Committee on information technology and cybersecurity matters, including a detailed threat assessment relating to information technology risks.


text: Franklin Templeton and the Advisor recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of their prevention efforts is employee training on their data privacy and cybersecurity procedures. For example, all new hires of Franklin Templeton and the Advisor receive mandatory privacy and information security training. In addition, current employees of the Advisor must complete mandatory annual cybersecurity and data trainings, which are supplemented by regular phishing and other cyber-related testing and trainings that the Advisor conducts throughout the year.


text: We recognize that third parties that provide information systems used by the Advisor to provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To mitigate third party risk, Franklin Templeton maintains a vendor code of conduct, which is designed to require third party vendors to comply with our requirements for maintenance of passwords, as well as other confidentiality, security, and privacy procedures. All third party vendors must complete a cyber incident reporting questionnaire to ensure timely notification of any potential cybersecurity breaches. Third-party IT vendors are also subject to additional diligence requirements.


text: Cybersecurity Risks As of December 31, 2024, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. We and our Advisor routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachments to emails, phishing attempts, extortion or other scams; however, we have been able to prevent or sufficiently mitigate harm from such risks. Although the Advisor and Franklin Templeton, on our behalf, make efforts to maintain the security and integrity of the information technology systems the Advisor uses on our behalf, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them are subject to the risk of a security incident or disruption, and there can be no assurances regarding our security efforts and measures or those of our third party providers. See " Item 1A–Risk Factors – Our business could suffer in the event our Advisor or any other party that provides us with services essential to our operations experiences system failures or cyber-incidents or a deficiency in cybersecurity."


text: Risk Management and Strategy At Sandisk, our management team is charged with managing risk and bringing to our Board of Directors' attention all material risk exposures to our company. Our enterprise risk management ("ERM") process is designed to facilitate the identification, assessment, management, reporting and monitoring of material risks our company may face over the short-term and long-term and promote regular communication with our Board of Directors and its committees regarding these risks. Through our ERM process, we have determined that the compromise, damage or interruption of our technology infrastructure, information systems or products by cybersecurity incidents is a key risk to our company that may have a material negative impact on our business. To help mitigate the potential impact of cybersecurity incidents on our business and protect against cybersecurity threats, we have established organizational structures, procedural measures and response plans that define roles and responsibilities related to cybersecurity risk management.

companyName: Sandisk Corp

ticker: SNDK


text: Sandisk's Information Security organization addresses cybersecurity risks with a broad spectrum of technologies, controls, and processes that focus on mitigating these risks. Our cybersecurity strategy is designed to be dynamic and adaptive to combat the rapidly-evolving cybersecurity threat landscape and is influenced by commonly leveraged frameworks such as the NIST-CSF (National Institute of Standard and Technologies – Cyber Security Framework). Our program includes, but is not limited to, endpoint protection and response systems, network security protocols, electronic communications protections, vulnerability management programs, least-privilege access controls, third-party risk management procedures, workforce education and training exercises, and compliance programs.


text: Additionally, we have established a Cyber Incident Response Plan that follows the structure of the Incident Handling Guide published by the U.S. National Institute of Standards and Technology (SP 800-61r2) and that serves as an operational guide for handling cybersecurity incidents at Sandisk. Our Cyber Incident Response Plan provides procedural and strategic guidance that is designed to be flexible enough to apply to a variety of different incidents, but also specific enough to provide guidelines for incident prevention, detection, analysis, escalation and notification, and containment, eradication and recovery.


text: As part of our ongoing information security program, the Company utilizes periodic independent third-party experts to conduct assessments of our program's effectiveness. These experts are also leveraged to design and orchestrate tabletop exercises where multiple business functions and leadership levels navigate incident scenarios based on industry trends and relevant threats, to help determine our level of preparedness for various cybersecurity incidents.


text: As part of our business operations, the Company engages with a number of third parties, including but not limited to, online software service providers, vendors, consultants, and partners. These third parties are analyzed based on business criticality and impact and must be cleared through a formal cybersecurity risk assessment process before being allowed to integrate with Sandisk's information systems, access confidential data, or provide electronic services to members of our workforce.


text: The Company has in the past experienced cybersecurity incidents of varying degrees involving our technology infrastructure and information systems. While these incidents have at times resulted in some disruptions to our business operations, as of the date of this Annual Report on Form 10-K, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incident, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all such cybersecurity incidents or threats or that we will not experience such an incident in the future. Further details about the cybersecurity risks we face are described under "The compromise, damage or interruption of our technology infrastructure, information systems or products by cybersecurity incidents, data security breaches, other security problems, design defects, information system failures or other events could have a material negative impact on our business" in Part I, Item 1A., Risk Factors of this Annual Report on Form 10-K.


text: The Company has implemented a governance framework related to cybersecurity that includes operational risk-mitigation practices and Board-level cybersecurity risk oversight.


text: Our management team is charged with managing cybersecurity risk and identifying material cybersecurity risk exposures to our company and carries out this function primarily through our Information Security organization, which is led by our Chief Information Security Officer ("CISO") who has a CISO executive certification from the Heinz College at Carnegie Mellon University, a bachelor's degree in Electrical Engineering, over a decade of information security leadership, and over twenty years of consolidated IT leadership experience. Additionally, our Cyber Incident Response Plan discussed above calls for the establishment of a management Impact Assessment Committee, which consists of key leadership representatives from the organization and is convened on an ad hoc basis to assess the detailed business impact of a cybersecurity incident. The Impact Assessment Committee is led by our Chief Information Security Officer and includes key representatives from the Company's functional groups, including human resources, ethics and compliance, labor, privacy, internal audit, finance, communications, legal, risk and accounting. The Impact Assessment Committee receives updates and communications from the Security Operations Center on a fixed cadence determined by incident severity and follows our pre-established escalation framework to communicate with and include executive leadership, outside counsel and the Board of Directors, as appropriate. The Impact Assessment Committee works with the Company's internal and external legal counsel to determine and facilitate appropriate communications with the Board of Directors.