text: Our management team, including our CIO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO has over three decades of IT experience in life sciences organizations. Her cybersecurity work includes the development and implementation of cybersecurity policies, platforms, and robust end-user training curriculums. Our CIO and IT Information Security Group work together to monitor and r eport cybersecurity trends and threats to management. Additionally, we work with an external IT partner and external cybersecurity counsel to assess, identify, and manage risks from cybersecurity threats. The IT Information Security Group undertakes table-top business disruption, disaster recovery and related response strategies, and plans on a periodic basis, and aims to review, and if appropriate update, applicable policies and procedures annually.


text: Our management team and IT Information Security Group takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Seres Therapeutics, Inc.

ticker: MCRB

secItem: Item 1C


text: Board of Directors Oversight The Audit Committee of the Board of Directors is tasked with providing oversight related to cybersecurity topics. At least quarterly, the Audit Committee receives a report of any cybersecurity incidents and other key monitoring metrics from a representative of the Cybersecurity Steering Committee. For each incident, the Audit Committee is briefed on the nature of the incident, points of vulnerability, scope of the incident, and the Company's response. The Audit Committee will then communicate cyber-related issues with the Board as needed. Our Board monitors our existing cybersecurity program and related policies, including, among other things, the Board's role within our cybersecurity risk management infrastructure.

companyName: Aveanna Healthcare Holdings, Inc.

ticker: AVAH


text: Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on the Company's cybersecurity-related risks.

companyName: AWARE INC /MA/

ticker: AWRE


text: Our information security function is led by our third party security consultant ("IT consultant") with whom we have worked since formation, and it helps identify, assess and manage the Company's cybersecurity threats and risks. The information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example automated tools, subscribing to reports and services that identify certain cybersecurity threats, conducting threat assessments for internal and external threats, engaging third parties for threat assessments, and conducting assessments to identify vulnerabilities. Our assessment and management of material risks from cybersecurity threats are integrated into our risk management processes. For example, our IT consultant and certain management, including our CFO, evaluate material risks from cybersecurity threats against our overall business objectives and our CFO periodically reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.

companyName: IN8BIO, INC.

ticker: INAB


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the rick factor entitled "If our information technology systems, or those of the third parties with whom we work, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to, a significant disruption of our product development programs and our ability to operate our business effectively, regulatory investigations or actions, litigation, fines and penalties, reputational harm, loss of revenue or profits, and other adverse consequences."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the CFO, the Chief Operating Officer ("COO") and the IT consultant having over 30 years of information security experience. The CFO and COO each have over 10 years of experience in roles with responsibility for overseeing information technology and security functions.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the CFO, COO and CEO, who help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the audit committee for certain cybersecurity incidents.


text: Our Chief Legal Officer, with the assistance of and informed by our Head of IT, and our external consultants, is primarily responsible for overseeing our cybersecurity risk management framework, including assessing and managing our material risks from cybersecurity threats, as well as monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Chief Legal Officer has experience as a senior legal, compliance and operations executive in highly regulated companies, including in roles with executive-level responsibility for overseeing data privacy and security compliance. Our Head of IT has experience overseeing the IT function, including cybersecurity, for private and public biotechnology.

companyName: Enliven Therapeutics, Inc.

ticker: ELVN


text: We identify, assess and manage material risks from cybersecurity threats by following written policies and procedures, which are in compliance with the International Organization for Standardization (ISO) 27001 Information Security Management System. The output of this process is then integrated with our enterprise risk management (ERM) program. The ERM program is managed cross-functionally, with input from various senior management representatives across our business operations, and is used to assess risks to our business based on their potential likelihood and magnitude of impact. Our information technology organization provides the inputs to our ERM process related to material cybersecurity risks and mitigation plans. The information technology team is responsible for the prevention, detection, mitigation and remediation of cybersecurity incidents. Cybersecurity incidents are documented and triaged in accordance with a defined process. Incidents deemed to be significant are escalated to the Audit Committee of our Board of Directors after appropriate assessment by the information technology organization and other internal stakeholders. In the event an incident highlights an emerging or previously unidentified cybersecurity risk, such risk is then synthesized into the ERM process.

companyName: REGENXBIO Inc.

ticker: RGNX


text: The Audit Committee of our Board of Directors oversees our ERM program regarding material risks arising from cybersecurity threats impacting our business. Management provides quarterly reporting on our material enterprise risks to the Audit Committee. In addition to material risks identified through the ERM process, our information technology management provides periodic reporting, at least semi-annually, on our cybersecurity risk profile and risk mitigation strategies to the Audit Committee. This reporting is also made available to the full Board of Directors.


text: The Company relies on the cybersecurity strategy and policies implemented by the Advisor. The cybersecurity program seeks to address cybersecurity risks and support the Company's operational resilience.

companyName: 5C Lending Partners Corp.


text: Cybersecurity Program Overview The Advisor has established a cybersecurity program designed to identify, evaluate, and mitigate risks from cybersecurity threats applicable to the Company.


text: The program encompasses: • Risk Assessments: Regular evaluations to identify and address potential vulnerabilities and threats to the Company's systems and data. • Security Measures: Implementation of cybersecurity controls, technologies, and protocols to protect against unauthorized access and mitigate risk. • Monitoring: Surveillance of systems, networks, and potential threats to timely detect and respond to evolving cyber risks. • Incident Response: Monitors systems for unauthorized access or data breaches. Follows an incident response plan to contain, investigate, and resolve incidents as well as reports significant incidents to senior management and regulatory authorities as needed.


text: The Advisor through the Resource Sharing Agreement utilizes external cybersecurity vendors and consulting firms to perform internal and external penetration testing, vulnerability assessments, and cybersecurity reviews. These independent evaluations assess the effectiveness of the Advisor's, and in turn the Company's, cybersecurity framework and risk management practices and help identify areas for continued focus and improvement.


text: The Company leverages the Advisor's expertise in cybersecurity risk management and compliance, including the assessment and ongoing oversight of risks associated with our use of third-party vendors, suppliers, and service providers critical to the Company's business functions. Any material risks identified by the Advisor's chief technology officer (the "CTO"), will be reported to the Advisor's chief operating officer (the "COO") and the Company's chief compliance officer (the "CCO").


text: Board Oversight of Cybersecurity Risks The Company's Board of Directors is primarily responsible for overseeing the Company's management of cybersecurity risks. The Company's CCO, consults with the Advisor's CTO and COO to develop cybersecurity updates that the Company's CCO, along with the Advisor's CTO, delivers periodically to the Board of Directors on topics including: • Updates on the Advisor's cybersecurity program as it impacts us. • The effectiveness of the Company's cybersecurity program. • Current and emerging cybersecurity threats. • Significant cybersecurity incidents impacting the Company and its operations.


text: Management's Role in Cybersecurity Risk Management The Advisor's management team, including its CTO, collaborates to execute and oversee the Company's cybersecurity program. Responsibilities include: • Incident Management: Addressing and remediating cybersecurity incidents that may impact the Company. • Compliance Oversight: Ensuring adherence to regulatory standards and best practices for cybersecurity. • Risk Evaluation: Ongoing assessment of risks posed by third-party service providers and internal operations. • Enhancements to the Program: Ongoing improvements necessitated by the changing environment.


text: At 5C's Executive Committee meetings the CTO provides an executive summary report disclosing needed changes to our cybersecurity program, incidents, and potential threats. The Advisor's CTO has over twenty years of specialized experience in managing cybersecurity and information security programs for financial services organizations.


text: The Company's CCO has over twenty-seven years of experience in the financial services industry, including eighteen years specializing in compliance and nine years in technology. The Company's CCO is actively involved in monitoring and addressing cybersecurity risks in consultation with the Advisor's CTO and COO. The Company's CCO is informed of incidents, vulnerabilities, and control enhancements in order to ensure robust and effective cybersecurity practices.


text: Cybersecurity Incidents and Material Impacts The Company has not experienced any cybersecurity incidents that materially affected our business strategy, operational results, or financial condition. The Company remains vigilant in monitoring and mitigating potential cybersecurity risks to safeguard its long-term resilience and operational integrity, but there is no guarantee that any risks from cybersecurity threats will not materially affect us in the future. For additional discussion of the Company's risks from cybersecurity threats, see "Item 1A. Risk Factors—Risks Related to the Company's Business and Structure—Cybersecurity risks and cyber incidents may adversely affect the Company's business or the business of the Company's portfolio companies by causing a disruption to the Company's operations or the operations of the Company's portfolio companies, a compromise or corruption of the Company's confidential information or the confidential information of the Company's portfolio companies and/or damage to the Company's business relationships or the business relationships of the Company's portfolio companies, all of which could negatively impact the business, financial condition and operating results of the Company or the Company's portfolio companies."


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance," Apollo's Board of Directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer ("CISO") and the Chief Information Security Officer of Athene Holding Ltd. ("AHL's CISO"), a subsidiary of Apollo, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, and also receive support, as appropriate, from our executive officers and other representatives of the Adviser and its affiliates. • Collaborative Approach. Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with our management and our Board, as applicable, in a timely manner. • Technical Safeguards. Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.

companyName: Apollo Debt Solutions BDC


text: Cybersecurity threat risks have not materially affected our company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Business and Structure - Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, a misappropriation of funds, and/or damage to our business relationships, all of which could negatively impact our financial results."


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of our Board, our audit committee regularly interacts with, and receives reports from, our management, the Adviser, Apollo, and other service providers. The audit committee of our Board receives presentations and reports on cybersecurity risks from Apollo's CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Apollo's peers and third parties. Additionally, Apollo and other service providers periodically report to management as it relates to our cybersecurity practices.


text: Our cybersecurity risk management processes are supported by third-party service providers, including a managed services provider that assists the Company with, among other things, threat monitoring and cybersecurity incident response and escalation services. We rely on a third-party service provide r to assist us with our cybersecurity practices, including for vulnerability assessments, penetration testing, and managing IT environments. Our process for onboarding new vendors with access to critical systems or data includes vendor questionnaires, contractual obligations, and if deemed appropriate, review of vendor audit reports.

companyName: Candel Therapeutics, Inc.

ticker: CADL


text: Our incident management processes include reporting to senior management, including the Chief Financial Officer (CFO), Chief Executive Officer, Vice President Quality Assurance, and Director GxP Systems, and, where appropriate, to the board of directors. To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats that could affect our information or systems. For more information, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: Our Senior Director, IT engages in regular meetings with our third-party managed IT service provider and the Director, IT to review and assess our cybersecurity risk management processes. The Senior Director, IT reports such findings to our CFO who annually presents updates on cybersecurity risks, mitigation strategies, and, if necessary, incident response activities to our Audit Committee. Further, our Audit Committee updates the full board of directors on matters relating to cybersecurity risk management, as necessary.


text: Internally, the cybersecurity program is managed by the Company's Senior Vice President and Chief Information Officer. She has held senior management positions in information technology, management information systems and information security for over 30 years. She reports regularly to the risk and audit committees of the Board of Directors about the prevention, detection, mitigation, and remediation of cybersecurity incidents. Additionally, the full board annually assesses all critical risks of the Company, including cybersecurity risks, and also receives periodic updates relating to key cybersecurity issues as part of their oversight.

companyName: Ponce Financial Group, Inc.

ticker: PDLB


text: The Company's Senior Vice President and Chief Information Officer also regularly reports to the Company's executive risk management ("ERM") committee, which oversees Company-wide risk at the management level, regarding cybersecurity risks. Members of the ERM committee include our President and Chief Executive Officer.


text: Our board recognizes the critical importance of maintaining the trust and confidence of our patients, business partners and employees. Our board is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management, or ERM. Through our ERM program, risks are identified, assessed and managed at the organization level, mission and business process level, and information system level. Our cybersecurity program, policies and procedures are fully integrated into our ERM program and are maintained in accordance with industry good standards. We also have an Information Security program that more specifically addresses cybersecurity risks and is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: SUTRO BIOPHARMA, INC.

ticker: STRO


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any cybersecurity threats that have materially affected or are likely to affect us, including our business strategy, results of operations or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the "Risk Factors" disclosures in Item 1A of this Annual Report on Form 10-K.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management process. In addition, we have implemented a cybersecurity third-party risk management process designed to assess the cybersecurity practices and monitor certain critical third parties, and to assist the business in making risk-informed technology services decisions. Our practice is to perform due diligence on certain third parties who maintain Sensitive Information, including CROs that manage and administer our clinical trials, and our CDMOs that manufacture our drug product to be used in clinical trials. Additionally, we monitor these third parties through frequent program management meetings as well as joint steering committee meetings in certain cases.

companyName: aTYR PHARMA INC

ticker: ATYR


text: For a description of the risks from cybersecurity threats that may materially affect us and how those threats may do so, see our risk factors under Part 1. Item 1A. "Risk Factors - If our information technology systems or data, or those maintained by the third-parties with whom we work, are or were compromised, this could result in a Material Adverse Impact."


text: The Audit Committee receives annual reports concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our enterprise risk management committee ("ERMC") is composed of senior management, including the CIO and other senior executives. The ERMC monitors and oversees risk areas that potentially could pose a high impact to the business, and cybersecurity currently is one of the ERMC's priority focus areas. The ERMC reports on our top identified risks and steps to address those risks to the full Board on a semi-annual basis. Our CIO has over twenty years of information technology experience.

companyName: REPLIGEN CORP

ticker: RGEN


text: Our IT Infrastructure & Security Operations teams manage the day-to-day administration of our cybersecurity program. We also work with a managed security service provider to monitor for vulnerabilities and threats. The service provider has the authority to take actions to remediate critical and high vulnerabilities, and these are reported to the IT Infrastructure & Security Operations team and up to the CIO and other members of senior management, where appropriate. We engage employees in our cybersecurity efforts through a quarterly process for employees to complete mandatory security and awareness training as well as monthly simulated phishing campaigns. We also conduct specific training and tabletop exercises for key personnel involved in cybersecurity risk management.


text: Cybersecurity Risk Management and Strategy We maintain a cybersecurity program, which is informed by industry standards, that includes processes for identification, assessment, and management of cybersecurity risks and which is integrated into our larger enterprise-wide risk management program. We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify areas of enhancement, and develop strategies for the mitigation of cyber risks. We also conduct regular security penetration testing and have established a vulnerability management process supported by security testing, for the treatment of identified security risks based on severity. Third-parties that access, process, collect, share, create, store, transmit or destroy our information or have access to our systems may have additional contractual controls.


text: Our IT Infrastructure & Security Operations team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks through various means, including by leveraging managed security service providers and other third-party security software and technology services. In addition, we institute processes and technologies for the monitoring of security alerts from internal parties and external resources, including from information security research sources. We also have implemented processes and technologies for network monitoring and data loss prevention procedures.


text: We have been subject to cybersecurity incidents in the past, including the publicly disclosed July 2024 security incident. Although we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents have materially affected us, our business strategy, results of operations or financial condition, there is no guarantee that past security incidents and any future incidents will not have a material impact on our business strategy, results of operations, or financial condition in the future. See Item 1A, "Risk Factors," to this report for more information.


text: Risks from Cyber Threats Like many businesses, the Bank faces numerous cybersecurity risks in connection with providing services to our customers. Guaranty does not currently believe that any current or previous risks from cybersecurity threats have materially affected, or are reasonably likely to materially affect the Bank, including its business strategy, results of operations, or financial condition. Unfortunately, the sophistication of cyber threats continues to increase, and the Bank's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. No cybersecurity program will be able to anticipate all cyber threats and breach attempts, and there may exist limitations to the ability to effectively implement preventive measures against such breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Bank's business strategy, results of operations or financial condition, please refer to "Item 1A. Risk Factors."

companyName: GUARANTY BANCSHARES INC /TX/


text: Cybersecurity Risk Management and Strategy Astrana Health operates in an increasingly interconnected and digitized world, where the protection of sensitive information and the resilience of our information technology systems are paramount to our mission of delivering exceptional healthcare services. Cybersecurity is a critical component of our enterprise risk management program, reflecting our commitment to safeguarding the privacy and security of the patients, employees, and others who entrust us with their data.

companyName: Astrana Health, Inc.

ticker: ASTH


text: As a healthcare organization, we manage large quantities of protected health information ("PHI"), personally identifiable information ("PII"), and other sensitive data. Recognizing the heightened risks posed by cyber threats, we have implemented a comprehensive cybersecurity framework that is designed to proactively identify, assess, and mitigate the risks associated with these threats. This includes protection against ransomware, phishing attacks, data breaches, and the evolving tactics of sophisticated cyber adversaries, as well as other types of cyber threats. Our cybersecurity program is built upon industry-recognized standards and, and we continuously adapt our program to defend against the changing threat landscape.


text: Cybersecurity Governance Astrana Health's governance framework reflects our commitment to managing cybersecurity risks with accountability and transparency. This framework is rooted in collaboration between executive leadership, employee operational teams, and the Board of Directors, resulting in comprehensive oversight at every level of the organization.


text: The Board of Directors oversees cybersecurity as part of its enterprise risk management responsibilities. The Audit Committee reviews cybersecurity risks, including IT internal controls, the use of artificial intelligence, business continuity plans, disaster recovery programs, and data protection initiatives. The Audit Committee also receives regular reports from management, including the CISO (as defined below), on key cybersecurity metrics, threat landscapes, risk mitigation strategies, and significant cybersecurity or data privacy incidents (if any).


text: Executive Leadership Our cybersecurity program is led by the Chief Information Security Officer ("CISO"), a Certified Information Systems Security Professional (CISSP) with over 25 years of experience in technology, cybersecurity strategy, risk management, and regulatory compliance, including extensive industry experience. The CISO works closely with the Company's executive leadership to implement and oversee the Company's cybersecurity initiatives. The CISO is also responsible for broader IT governance and risk management, resulting in a cohesive approach to protecting our technology infrastructure and sensitive data.


text: AI Policy and Governance Astrana Health recognizes the transformative potential of artificial intelligence ("AI") in healthcare and the corresponding responsibility to implement it ethically and securely. Our AI policy and governance framework emphasizes transparency, fairness, and accountability in the use of AI technologies across our operations. This includes rigorous data privacy safeguards, continuous monitoring to mitigate algorithmic bias, and adherence to industry best practices and regulatory standards. An internal committee comprising experts in technology, legal, compliance, and healthcare operations works to ensure that AI deployments meet ethical and cybersecurity standards. Periodic audits and risk assessments are conducted to evaluate the performance, reliability, and security of AI systems in critical workflows.


text: Cross-Functional Collaboration Astrana Health utilizes a cross-functional governance structure that engages enterprise risk management, compliance, IT, legal, privacy, and data governance teams. Our risk management / cyber working group, which includes certain of our senior leaders, including operations, finance, internal audit, IT, cyber, legal, and communications, meets at least four times per year to discuss significant risks to the Company identified by our enterprise-wide risk management process, including cybersecurity risks identified by our cybersecurity risk management program. The group also discusses the steps management has taken to identify, monitor, assess, and control or avoid such exposures and reviews performance measures against the Company's risk appetite and tolerance and provides recommendations of corrective action where appropriate. This collaborative approach enables a holistic evaluation of cybersecurity risks and aims to ensure that identified threats are promptly addressed.


text: Cybersecurity Program Components Astrana Health's cybersecurity program employs a multi-layered approach, incorporating a wide range of policies, technologies, and processes to detect, prevent, and respond to cyber threats.


text: Proactive Monitoring and Threat Detection We leverage advanced security technologies and tools to continuously monitor our IT systems and networks. Our 24/7 Security Operations Center is equipped to detect anomalies and respond to emerging threats in real-time, aiming to minimize the risk of undetected cyberattacks.


text: Employee Training and Awareness Astrana Health fosters a culture of cybersecurity awareness through mandatory training programs, phishing simulations, and engagement campaigns. These efforts seek to enable employees to identify and report potential threats, thereby reducing organizational vulnerability to common attack vectors.


text: Data Encryption and Access Controls Robust encryption protocols safeguard sensitive data, both in transit and at rest. Multi-factor authentication and role-based access controls further restrict unauthorized access, ensuring that only authorized personnel can access critical systems and information.


text: Incident Response and Recovery Our comprehensive incident response plan outlines detailed procedures for addressing and recovering from cybersecurity incidents. This plan, which is integrated with our business continuity and disaster recovery strategies, aims to ensure operational resilience and timely remediation of affected systems.


text: Third-Party Risk Management Vendors and service providers are rigorously vetted through a structured third-party risk management program. This process includes security assessments, contractual requirements for compliance with cybersecurity standards, and ongoing monitoring to ensure alignment with Astrana Health's security policies.


text: Independent Audits and Assessments External firms conduct regular penetration testing, Service Organization Controls (SOC) 2 audits, and other assessments to validate the effectiveness of our cybersecurity controls and identify areas for improvement.


text: Industry Standards and Benchmarks Our cybersecurity program is aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Additionally, periodic tabletop exercises simulate real-world scenarios to test our readiness and improve our incident response capabilities.


text: Cybersecurity Incidents Although we have been subject to breaches of our IT systems, including breaches of the IT systems of third-party service providers, the impact of such attacks has not been material to our business strategy, operations or results of operations, financial position, or cash flows through the date of this report. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect the Company. For additional information on the risks we face from cybersecurity threats, please refer to Part I, Item 1A, "Risk Factors" of this Form 10-K.


text: While all vendors are subject to our vendor management process, those with access to our data and data centers are subject to more rigorous initial and ongoing due diligence. This includes the reviews of Service Organization Control 2 ("SOC 2") reports, financial information, and other policies and procedures related to such third-party vendors and their various programs, including vendor management.

companyName: CSB Bancorp, Inc.

ticker: CSBB


text: Although the Company has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition, there can be no guarantee that the Company will not experience such an incident in the future. For additional information regarding the risk the Company faces from cybersecurity threats, please see the risk factors titled "We use information technology in our operations and offer online banking services to our customers, and unauthorized access to our customers' confidential or proprietary information as a result of a cyber-attack or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers" and " We depend on outside third parties for the processing and handling of our records and data, which exposes us to additional risk for cybersecurity breaches and regulatory action." included in Part I. Item 1A. – Risk Factors of this report.

companyName: FIRST US BANCSHARES, INC.

ticker: FUSB


text: The Partnership established a Privacy and Information Security Incident Response Plan ("IRP") addressing the identification, communication, and classification of, and the response to, potential cybersecurity incidents and other disruptions of information systems. All investigation and reporting pursuant to the IRP is conducted at the direction of the Partnership's Chief Privacy Officer. Associates are required to report and address any suspicious or inappropriate activity and can leverage a tool to report suspected cybersecurity threats via email. Pursuant to the IRP, once a cybersecurity event is identified, it is ascribed a severity level and/or associated tasks and cases in order to appropriately track and handoff any response and remediation efforts across our teams. The IRP provides for the communication of roles, responsibilities, and on-call escalation paths to communicate incidents to key stakeholders. Information security events are managed by designated teams whose roles and responsibilities are defined to facilitate quick, effective, and orderly responses. The Chief Privacy Officer, in collaboration with the CISO, is required to review the IRP on at least an annual basis, which may include the incorporation of any lessons learned from prior incidents.

companyName: JONES FINANCIAL COMPANIES LLLP


text: The Partnership has an enterprise-wide business resiliency program, policy and framework to assist in planning for, and mitigating disruption to the Partnership's business operations from, incidents including cybersecurity events, through risk assessment, business impact analysis, response plan development, training, testing, and ongoing maintenance. The Business Resilience Department is responsible for creating and maintaining the Partnership's business resilience policy and framework and overseeing the program's implementation in collaboration with sponsors and leaders from the Firm's business areas. A Business Resilience Oversight Group comprised of general partners meets at least semi-annually and provides oversight of business resilience strategy, risk management, resources, performance, and integration into business processes. Specific elements of business continuity plans vary based on the nature of the processes involved but include planning related to human capital, real estate, third-party relationships and technology infrastructure. As part of its business resiliency planning, the Partnership has data centers in two geographically distinct locations and reviews the data center locations of its third-parties. A prolonged interruption at any site or of critical systems or software may result in an extended delay of service to the Partnership's clients and substantial costs and expenses.


text: Risk Identification and Management The Company has a cybersecurity Risk Management Policy in place that governs the life cycle in which cybersecurity risks, including: • Risk Identification: through various initiatives performed, including, annual assessments, penetration tests, Incident Response tabletop exercises, vulnerability scans, system monitoring activities, and cybersecurity reviews of critical third-party vendor engagements, etc. • Risk Evaluation & Treatment: Identified issues, vulnerabilities, and exposures are captured within the Company's Risk Register, which is updated periodically to reflect the most up to date treatment option selected by the Risk Owners. • Risk Reporting and Ongoing Management: Potentially material risks are shared as part of a monthly Cybersecurity Governance Forum, that's attended by leadership. Risk Mitigations are tracked to completion through various project updates.

companyName: Drilling Tools International Corp

ticker: DTI


text: Engagement of Third Parties The Company uses an IT Managed Service Provider in conjunction with a Cybersecurity Advisory firm to perform various functions, guiding the Company's cybersecurity posture, and providing ongoing support to the Company's cybersecurity program. The Company has Incident Response retainer services that can be leveraged, when needed. The Company uses a cybersecurity advisory firm to conduct annual risk assessments and penetration tests.


text: The Adviser also reviews the Fund service providers' compliance and risk management policies and procedures related to cybersecurity matters, monitors such service providers' use of information systems which have the potential to subject the Fund to information technology vulnerabilities and receives regular reports from the Fund's service providers regarding cybersecurity threats and incidents. T he CCO provides quarterly reports to the Board of Trustees regarding significant risks to the Fund, including, among others, those relating to cybersecurity. In addition, the CCO informs the Board of Trustees regarding material cybersecurity risks as they arise.

companyName: Silver Point Specialty Lending Fund


text: The Trust does not have a board of directors; therefore, the Trustee is responsible for oversight of the Trust’s risks from cybersecurity threats. The Trustee has dedicated personnel responsible for assessing and managing the Trust’s cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee’s information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. External partners are a key part of the Trustee’s cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.

companyName: PERMIAN BASIN ROYALTY TRUST

ticker: PBT


text: Other non-technical protocols include securing of documents and work areas that could contain personal, non-public information and independent verification of information changes by outside vendors.


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust’s business, financial condition, results of operations, or cash flows. See Item 1A “Risk Factors – Business and Operational Risks – The Trustee may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.”


text: The Sponsor, Fidelity Management & Research LLC, and their respective affiliates operating as a business organization (collectively, "Fidelity") and its Enterprise Cybersecurity organization, on behalf of the Trust, have established a comprehensive risk management program, which includes processes to identify, assess, and manage cybersecurity risks, including material risks from cybersecurity threats, and to put in place appropriate controls to mitigate these risks and reduce the potential impact to the Trust and its Shareholders. The Trust does not have any employees and relies upon Fidelity and its Enterprise Cybersecurity organization for the Trust's day-to-day operations and to establish strategies, policies, and standards for the security of, and operations in, cyberspace.

companyName: Fidelity Ethereum Fund

ticker: FETH


text: The CRMC is responsible for assessing and managing material risks from cybersecurity threats. In connection with the Trust's reliance on Fidelity and its Enterprise Cybersecurity organization, the CRMC relies on the cybersecurity expertise of Fidelity's CISO and members of the CISO's staff to assist in assessing and managing the Trust's material risks from cybersecurity threats. The CISO has over thirty years of experience as a technology and information risk management leader, holding global senior management roles with large, diversified financial services companies. He has served as Fidelity's CISO since May 2024.


text: As a foundation of this approach, we have implemented a layered governance structure to help assess, identify, manage and report cybersecurity risks. Our cybersecurity program leverages the NIST Framework, which outlines the core components and responsibilities necessary to sustain a healthy and well-balanced cybersecurity program. To protect our network and information systems from cybersecurity threats, we use various security tools and policies that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools.

companyName: Gogo Inc.

ticker: GOGO


text: With respect to third-party service providers, we obligate our vendors to adhere to privacy and cybersecurity measures through various contractual provisions to the extent possible, and we perform risk assessments of vendors as appropriate from time to time, which includes a vendor's ability to protect data from unauthorized access. As described in Item 1A "Risk Factors," our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor misconduct and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business, including the loss of customer confidence, reputational harm, our operating results and our financial condition. We have insurance designed to cover certain expenses relating to cybersecurity incidents; however, damage and claims arising from a cybersecurity incident may exceed the amount of any insurance available. While we have experienced cybersecurity incidents, to date, we do not believe that we experienced a material cybersecurity incident during the fiscal year ended December 31, 2024.


text: Our Senior Vice President, Chief Information Security Officer ("CISO"), leads our cybersecurity team and has over 15 years of experience establishing and leading comprehensive cybersecurity programs. Our CISO retired from the United States Navy, where he served in various roles with increasing responsibility, most recently serving as the Director of Operations – Navy Cyber Defense Operations Command. In that role, our CISO led a team of 450 personnel overseeing networks with more than 800,000 endpoints and more than 200 IT, Cloud, Legacy, and Operational Technology networks globally. We believe that our CISO's technical expertise and background assist us with the navigation of the extensive regulatory framework to which we are subject as a federal contractor, including the achievement of the Cybersecurity Maturity Model Certification ("CMMC") program. We believe we are well-positioned to meet the requirements of CMMC and are preparing for certification.


text: We also have management level committees and a cybersecurity incident team who support our processes to assess and manage cybersecurity risk as follows: • The Cybersecurity Cross Functional Team (the "Cybersecurity CFT"), led by our CISO, brings together IT, legal, compliance and other function heads. The Cybersecurity CFT meets at least quarterly (or more frequently as needed) and provides a forum for these cross-functional members of management to: consider emerging technologies, such as artificial intelligence and emerging cybersecurity risks; review cybersecurity and privacy regulations; approve, review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. • The Gogo Executive Cybersecurity Committee (the "GECC") is comprised of executive leadership and members of the cybersecurity, operations, risk, legal, and internal audit teams. The GECC liaises with the Cybersecurity CFT and provides oversight of all aspects of Gogo's cybersecurity program and, at regular intervals through the year, evaluates key cybersecurity metrics as well as planned and ongoing initiatives to reduce cybersecurity risks. • The Incident Response Management Team (the "IRMT"), which includes senior executives and members of our cybersecurity leadership team, was established to support our incident response plan and reports into the GECC. Members of the IRMT are alerted as appropriate to cybersecurity incidents, natural disasters and business outages. The IRMT annually assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss the event and response options. The IRMT also engages with the Company's Board and the Audit Committee depending on the severity of the cybersecurity incident.


text: The output of each of the foregoing committees are collected and analyzed on a regular basis and our CISO briefs the Audit Committee, through quarterly updates as well as on an ad hoc basis between regular updates to the extent needed.


text: With respect to third party service providers, we obligate our vendors to adhere to privacy and cybersecurity measures, and we perform risk assessments of vendors, including their ability to protect data from unauthorized access.


text: Cybersecurity Risk Management and Strategy Cybersecurity is an important part of our overall risk management systems and processes and an area of focus for our Board and management. We have developed and implemented an enterprise-wide information security program designed to identify, protect, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity and privacy threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools, third-party Security Operations Center monitoring and incident response services, proactive patching and risk mitigation, and a third-party penetration testing program to allow security researchers to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors. We also maintain a third-party risk management program to ensure we understand the security posture of the partners we integrate with or build business reliance upon, ensure they can meet our cybersecurity standards and policies, and take precautions and mitigations designed to limit our exposure to supply chain attacks; however, there are circumstances in which the efforts of the third parties upon which we rely to maintain risk management programs have not been successful and we cannot ensure in all circumstances that the efforts of the third parties upon which we rely to maintain risk management programs will be successful in the future.

companyName: Emerald Holding, Inc.

ticker: EEX


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. This data is consolidated in centralized repositories, assessed using industry-standard practice risk quantification models, and prioritized for remediation based on risk and impact to the business. We have in the past used widely adopted risk quantification models, including those described in National Institute of Standards and Technology (NIST) special publications as well as the FAIR Institute's Factor Analysis of Information Risk (FAIR) methodology for Quantifying and Managing Risk to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards, and may continue to use these or other models in the future. We conduct regular reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and continuously improve our security measures and planning. We have a role-based security training program under which all staff undergo mandatory periodic security awareness training, with additional on-the-job security training and coaching provided to our IT and technology personnel by an external third-party cybersecurity firm. We continuously enhance our cybersecurity measures by providing ongoing simulated phishing exercises to our employees to increase their preparedness to address potential threats. The results of these assessments are reported to the Audit Committee as discussed below under "--Cybersecurity Governance."


text: In the last ten years, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect us, including our business, financial condition, cash flows and results of operations. However, we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our business, financial condition, cash flows and results of operations. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents could materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "We face continually evolving cybersecurity and similar risks, which could result in loss, disclosure, theft, destruction or misappropriation of, or access to, our confidential information and cause disruption to our business, damage to our brands and reputation, legal exposure and financial losses," which is incorporated by reference into this Item 1C.


text: Cybersecurity Governance The Board oversees our annual enterprise risk assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats. Specifically, our Audit Committee is responsible for the oversight of risks from cybersecurity threats and receives regular updates from senior management including our Senior Vice President of Information Technology on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. Our cybersecurity protocol requires that the Chair of the Audit Committee and senior management be immediately notified upon any cybersecurity incident.


text: Our Senior Vice President of Information Technology, who has over 20 years of experience in the information technology sector, leads our global information security team responsible for overseeing the Emerald information security program. In addition, the team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies. This team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel, analysis of threat intelligence and review of other information obtained from governmental, public or private sources (including external consultants engaged by us), and alerts and reports produced by security tools deployed in the IT environment. The team provides regular reports to senior management and other relevant teams on various cybersecurity threats, assessments, and findings.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For more information regarding cybersecurity risks that may affect or Company, see "Item 1A. Risk Factors" included in this Report.

companyName: NEKTAR THERAPEUTICS

ticker: NKTR


text: Our cybersecurity function, which comprises, in part, our information technology ("IT") security director and other members of our technical staff management, along with our legal advisors, risk management team, and overall information security function, helps identify, assess and manage our cybersecurity threats and risks. Our IT security department, under the direction of our Chief Information Officer ("CIO") and led by our IT security director, identifies and assesses risks from cybersecurity threats by monitoring cybersecurity and operational risks using various security tools designed to protect against, detect, and respond to cybersecurity threats, and has implemented processes and procedures aligned with our information security management system to support and promote resilient programs. This includes automated tools, security assessment and monitoring; restricted physical access to servers and network equipment, system audits and third party assessments, third-party IT vendor risk management process to assess and manage risk presented by our IT vendors, third party threat assessments, evaluating threats reported to us, and annual review of cybersecurity insurance policies and the associated levels of coverage based on current risks.

companyName: biote Corp.

ticker: BTMD


text: Our IT security department, which assesses and manages our risks from cybersecurity threats, is led by our CIO, who reports to our chief executive officer. We have in place an incident response plan to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards. Our CIO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CIO meets with the audit committee periodically to review our information technology systems and discuss key cybersecurity risks. Additionally, we maintain a qualified third-party vendor relationship which is available to the team for on-demand incident response and investigation, as needed.


text: Board Oversight and Cybersecurity Governance Our cybersecurity strategy is firmly anchored in a governance structure that emphasizes board oversight. The Board of Directors work to ensure our cybersecurity posture and cybersecurity risks are adequately evaluated and managed in alignment with our business objectives. To this end, the Board receives regular updates on our critical cybersecurity initiatives, risk management practices, and incident response measures. This oversight ensures that cybersecurity remains a top priority at the executive level and that strategic decisions reflect our commitment to safeguarding our digital assets.

companyName: Urgent.ly Inc.

ticker: ULY


text: The Board is supported by the Cybersecurity Risk Committee, a specialized group that includes senior executives and departmental representatives from IT, legal, human resources, and operations. This committee is charged with the development of cybersecurity policies, evaluation of defense mechanisms, and oversight of the company's response to cyber incidents.


text: Our Cybersecurity Risk Committee, led by our Chief Financial Officer, receives input from third party cybersecurity risk advisors that bring decades of experience in designing, implementing, and managing cyber security risk programs. They are experts in the assessment, identification, and management of cybersecurity risk. Our Cybersecurity Risk Committee members meet and collaborate regularly with our information technology and operations teams, stay abreast of industry trends and relevant regulations, and regularly inform management of various cybersecurity risks, trends, threats, and countermeasure techniques.


text: Cybersecurity Risk Management Program Our Cybersecurity Risk Management Program is designed around the Center for Internet Security (CIS) Controls version 18. The CIS Controls offer a strategic framework that directs our implementation of effective cybersecurity defenses across 18 critical areas, ranging from asset management to data protection and network security.


text: A cornerstone of our cybersecurity governance is the annual performance of comprehensive cybersecurity risk assessments performed by third party cybersecurity advisors. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as monitor and test our safeguards. The insights gained from these assessments inform the continuous refinement of our cybersecurity strategies and defense mechanisms. As a core component of our risk management process, all employees are required to participate in annual information security training.


text: We engage third parties annually to evaluate our information security posture, risks and third-party service provider solutions as part of our overall risk management activities. We maintain an inventory of vendors and third-party service providers and evaluate those service providers for cybersecurity risks annually at a minimum.


text: Cybersecurity Incidents and Responses As of the date of this Annual Report on Form 10-K, we have no t identified any risks from cybersecurity threats that have materially impacted our Company, our business operations, and our financial condition. Recognizing the potential impact of significant disruptions, we remain committed to fortify our systems against evolving threats. Any significant disruption to our ability to transact business could adversely affect our business performance as well as our reputation. For additional detail about the cybersecurity risks facing our Company, and whether they are reasonably likely to affect our Company, please see the discussion in Item 1A, "Risk Factors."


text: Our commitment to cybersecurity resilience includes an ongoing monitoring program and a well-defined incident response plan that provides guidelines for mitigating the impact of cyber threats. These processes are periodically reviewed and updated to address emerging threat intelligence and other matters.


text: Future Directions Looking ahead Urgently is dedicated to maintaining a vigilant stance against cyber threats. We will continue to invest in cutting-edge cybersecurity technologies, enhance our staff training programs, and foster collaborations with leading cybersecurity experts. Our board-driven, proactive approach to cybersecurity risk management is integral to our mission of delivering unparalleled value to our customers, employees, and shareholders, safeguarding our reputation, and ensuring the long-term success of our Company.


text: The Sponsor, Fidelity Management & Research Company LLC, and their respective affiliates operating as a business organization (collectively, "Fidelity") and its Enterprise Cybersecurity organization, on behalf of the Trust, have established a comprehensive risk management program, which includes processes to identify, assess, and manage cybersecurity risks, including material risks from cybersecurity threats, and to put in place appropriate controls to mitigate these risks and reduce the potential impact to the Trust and its Shareholders. The Trust does not have any employees and relies upon Fidelity and its Enterprise Cybersecurity organization for the Trust's day-to-day operations and to establish strategies, policies, and standards for the security of, and operations in, cyberspace.

companyName: Fidelity Wise Origin Bitcoin Fund

ticker: FBTC


text: Inland has established a Computer Security Incident Response Team ("Inland CSIRT"), which aims to manage and mitigate the impact of cybersecurity breach events, including those arising from or impacting our Advisor, Dealer Manager and service providers (including the transfer agent), tenants, borrowers, and other business contacts. Members of the Inland CSIRT include Inland's VP Director of IT Infrastructure & Information Security, who has more than 20 years of experience in information technology security and leads Inland's cybersecurity program, and its Head of Technology Strategy, as well as members of the firm's legal, risk, and communications groups. Inland has established a notification decision framework to determine when the Inland CSIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including members of our Advisor's management, and our Board and Audit Committee, as appropriate.

companyName: InPoint Commercial Real Estate Income, Inc.

ticker: ICR-PA


text: Risk Management and Strategy Enterprise risk management is the responsibility of our executive management team consisting of our chief executive officer, chief financial officer, chief legal officer and our vice presidents of operations, business development and environmental, health and safety. Our executive management team meets on a weekly basis and discusses cybersecurity on an ad hoc basis when it is relevant. Our director of Information Technology, who reports directly to our chief executive officer, and our director of Internal Audit are primarily responsible for management of cybersecurity risk. Our director of Information Technology is an active ISC2 accredited member with 15 years of information technology experience, namely in developing solutions focused on private and hybrid cloud computing systems for small scale organizations. In accordance with our overall enterprise risk management process, our executive management team supervises our director of Information Technology to assess, identify, report and manage material risks from cybersecurity threats and relies on our director of Internal Audit to assess, identify and report those risks. As part of this process, we rely significantly on third-party providers to assist us with our cybersecurity risk management and strategy. These providers supply ongoing services including consulting services, access to a virtual CISO, threat monitoring and detection, threat response and mitigation strategies, updates on emerging trends and developments with policy and procedure guidance. Other service providers offer targeted assistance such as security and forensic expertise on an as needed basis. We also maintain cybersecurity insurance.

companyName: Montauk Renewables, Inc.

ticker: MNTK


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected us, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, "Cybersecurity and Information Technology Risks" in this Form 10-K.


text: We are committed to protecting our information systems against cybersecurity threats. Any cybersecurity incident can adversely affect our business and disrupt our operations as described in greater detail in our Risk Factors relevant to cybersecurity risks. Our senior leadership, in consultation with our board of directors, has assigned responsibilities for ensuring and overseeing the operation of our information security program to the Marchex Information Security Committee ("ISC") comprised of senior representatives of departments across our organization.

companyName: MARCHEX INC

ticker: MCHX


text: The ISC also oversees day-to-day cybersecurity risk mitigation efforts, which include, but are not limited to monitoring systems for availability, performance, and security issues, periodic vulnerability scans, penetration testing performed at least annually by independent, reputable, third-party vendors, as well as evaluating any risks associated with prospective third-party service providers who require access to sensitive customer data and implementing any additional controls to address significant risks identified. Furthermore, the ISC meets quarterly to discuss and analyze any relevant developments within the organization and industry relative to cybersecurity, reviews our internal policies and operational procedures relevant to cybersecurity at least annually, and promulgates updates when deemed necessary or advisable.


text: Risk Management and Strategy We continue to develop and implement a framework designed to safeguard our organization's digital assets from threats and vulnerabilities as part of our overall risk management system. It involves a systematic approach of identifying, assessing, and mitigating risks associated with our technology systems, data, and operations.

companyName: Xponential Fitness, Inc.

ticker: XPOF


text: Key components of this include: • Vulnerability assessments - initiating regular evaluations to identify potential weaknesses in our systems. • Security controls and policies - establishing robust security measures and formal company-wide policies. • Employee training - training programs to ensure all employees are equipped to prevent and respond to cyber threats effectively. • Incident response plan - designing and implementing a well-defined plan for addressing cybersecurity incidents. • Continuous monitoring - establishing mechanisms for proactive monitoring of our environment to detect and respond to anomalies.


text: To ensure alignment with industry best practices we engage consultants or other third parties in conducting periodic assessments and testing of our policies, standards, processes, and practices.


text: The Chief Technology Officer works together with our board of directors, audit committee, and members of executive management ("Cybersecurity Team") to set the strategic digital landscape. The Cybersecurity Team provides strategic guidance and oversight to ensure our cybersecurity posture is robust and aligned with our overall objectives. The Cybersecurity Team does this by establishing cybersecurity policies and setting risk tolerance levels, approving budgets for security initiatives, and ensuring compliance with relevant regulations and standards. The Cybersecurity Team engages in regular and ad hoc discussions regarding incident response strategies to assess the preparedness for cyber threats and continually evaluates our incident response plans. The Incident Response Team ("IRT") is led by the Senior Vice President of Information Technology, who is the overall incident response coordinator. The IRT, under the guidance of the Chief Technology Officer, assesses risk and materiality of an incident and engages members of Cybersecurity Team as needed.


text: Through ongoing communications with these teams, the Chief Technology Officer and the Cybersecurity Team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the board of directors and the audit committee when appropriate.


text: Our Chief Technology Officer's experience includes various roles in information technology, data analytics, and information security at both public and private companies. Members of the Cybersecurity Team each hold undergraduate and, in some cases, graduate degrees in their respective fields, and each have experience managing risk at the Company or at similar companies, and assessing cybersecurity threats.


text: The Company recognizes that the security of our operations is critical to protecting our customers and maintaining the reputation of the Company. Management is committed to managing Information Security ("IS") risk, which includes cybersecurity, that may impact the Company. The Enterprise Risk Committee ("ERC") of the Board of Directors provides oversight of the Company's written Information Security Management and Information Technology Governance Programs (the "Programs"). Through the Programs, the Company has established polices, processes, controls, and systems designed to identify, assess, measure, manage, monitor, and report risks related to cybersecurity and help prevent or limit the effect of possible cybersecurity threats and attacks. As cybersecurity threats continue to evolve, the Company expects to continue to monitor and enhance the current controls and systems in place to detect and prevent cybersecurity attacks and to remediate discovered vulnerabilities.

companyName: LAKE SHORE BANCORP, INC.


text: The Company's Information Security Officer ("ISO") is responsible for the design and execution of the Information Security Management Program and the information and cyber security aspects of the Information Technology Governance Program. The ISO works in concert with members of the Information Technology ("IT") Department, including the Bank's Chief Information Officer ("CIO"), to ensure the execution of the Programs. The aforementioned individuals meet with management on a monthly basis through an IT Steering Committee in which management assesses IS and IT risk.


text: Additionally, the ISO provides the ERC with regular reports on the status and effectiveness of the Programs and risk management activities, as well as cyber and IS issues that may affect the Company.


text: The ISO has served various roles involving anti-money laundering, law enforcement, security, and information technology for over 7 years. The ISO holds an undergraduate degree in Legal Studies and master's degree in Criminal Justice and Criminology. The ISO reports to the Chief Financial Officer ("CFO") as well as the Chairperson of the ERC. The CIO has served various roles in audit, information risk, information technology, and information security in multiple industries for over 12 years. The CIO holds an undergraduate degree in Management Information Systems and has attained the ISACA Certification in Certified Information Systems Auditor ("CISA"). The CIO reports to the Chief Executive Officer ("CEO").


text: The Company utilizes the following guidelines and frameworks to develop and maintain the Information Security Management Program: Federal Financial Institutions Examination Council ("FFIEC") Information IT Examination Handbooks, FFIEC Cybersecurity Assessment Tool ("CAT"), Center for Internet Security Critical Security Controls, National Institute of Standards and Technology Special Publication 800 Series, National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), 12 CFR Appendix B to Part 30 - Interagency Guidelines Establishing Standards for Safety and Soundness Gramm-Leach-Bliley Act ("GLBA") 501(b).


text: The Information Security Management Program features layered controls of network and endpoint intrusion detection and prevention, enterprise malware protection, threat-monitoring, and a Security Operations Center that provides full time support and additional operational measures to monitor and respond to data breaches and cyberattacks. The Company leverages regular assessments to identify current and potential threats and vulnerabilities within the Company's environment. Technical vulnerabilities are identified through regular automated vulnerability scans and periodic vulnerability and penetration testing performed by independent third parties. Non-technical vulnerabilities are identified through the IT and IS Assurance Program by conducting regular process and procedural reviews as well as risk assessments. The Company uses the FFIEC CAT and NIST CSF to help identify cybersecurity risks and determine our cybersecurity preparedness. The Company's information security and cybersecurity risk appetite statements define the levels of risk the Company is willing to accept and guide the risk management decisions of the Company. The risk appetite statements are approved by the Board of Directors annually.


text: The Company also recognizes the risks associated with the use of third party providers and maintains a Third Party Management Program that is responsible for the oversight of outsourced services. This enables the Company to identify risks related to third parties through an inherent risk assessment and a due diligence review process designed to ensure third parties are in compliance with the Company's risk and information security expectations.


text: For the year ended December 31, 2024, the Company has not identified any specific risk from a cybersecurity threat that has materially affected, or is reasonable likely to affect, the Company's business strategy, results of operation, or financial condition, other than those described in Item 1A. Risk Factors - Risks Related to Operations.


text: Risk Management and Strategy We manage cybersecurity threats as part of our oversight, evaluation, and mitigation of enterprise-level risks. We have implemented a cybersecurity risk management program, in accordance with our risk profile and business size, that is designed to detect, identify, assess, and respond to current and emerging cybersecurity threats. Our cybersecurity risk management program is supported by third-party information technologies and vendors, including a managed services provider that assists us with, among other things, information technology system monitoring, detection and alerting tools, and response support services. We also leverage third-party information technology service providers to monitor and evaluate our cybersecurity posture through cybersecurity risk reviews and assessments. Our cybersecurity risk assessments are informed by industry standards and frameworks and incorporate elements of the same, including elements of the National Institute of Standards and Technology ("NIST") cybersecurity framework.

companyName: MBX Biosciences, Inc.

ticker: MBX


text: We have adopted an incident response plan designed to coordinate the steps to identify, contain, eradicate, and recover from cybersecurity incidents. We also have a process for newly-hired employees to participate in security awareness training. We also have a process to review certain third-party information technology service providers and vendors, including through contractual requirements and proactive threat intelligence monitoring, as appropriate.


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, however, like other companies in our industry, we and our third-party information technology service providers and vendors have from time to time experienced threats that could affect our information or systems. For more information, please refer to Item 1A, "Risk Factors," in this Annual Report.


text: Our Senior Director of Information Technology coordinates with our Chief Financial Officer ("CFO") and relevant third parties, such as consultants and external legal advisors, to assess and manage material risks from cybersecurity threats. Our Senior Director of Information Technology has over fifteen years of experience in information technology, including over five years in cybersecurity and information security. Our Senior Director of Information Technology is also supported by a cross-functional security incident response team, which is responsible for identifying, reporting, investigating, documenting, and mitigating cybersecurity incidents pursuant to our incident response plan and policy.


text: Our board of directors has overall oversight responsibility for our risk management, and delegates its oversight of risk assessment and management guidelines to the audit committee of the board of directors. Members of the audit committee receive periodic updates from our CFO, who is briefed by our Senior Director of Information Technology, regarding matters of cybersecurity. These discussions may include updates on management's efforts to address and mitigate cybersecurity risks, cybersecurity incidents (if any), and the status of key information security initiatives. Executive management will promptly update our board of directors regarding significant threats and incidents as they arise.


text: The Company has partnered with Alasconnect LLC to evaluate the cyber risk and IT control capabilities within the enterprise. The goal is to increase cyber-resilience and cyber-threat response preparedness. Cyber policies, procedures and practices are extended to all third-party vendors and appropriately communicated to both management and the Board by way of strategic cyber incident tabletop exercises and quarterly board IT governance report ing. Any material risks identified from cyber security threats will be communicated to the management team which will evaluate and manage the risk. Although to-date the Company has not experienced any material losses relating to cyber-attacks or other information security breaches, there can be no assurance that the Company will not incur such losses in the future. The Company's risk and exposure to these matters cannot be fully mitigated because of, among other things, the evolving nature of these threats. As a result, cyber security and the continued development and enhancement of controls, processes and practices designed to protect systems, computers, software, data and networks from attack, damage or unauthorized access remain an area of attention.

companyName: Contango ORE, Inc.

ticker: CTGO


text: For a discussion of risks from cybersecurity threats that may materially affect the Company, see "Risk Factors" under the heading "We are vulnerable to cybersecurity attacks and threats." (Part I, Item 1A of this 2024 Form 10-K).

companyName: Pursuit Attractions & Hospitality, Inc.

ticker: PRSU


text: Cybersecurity Governance Cybersecurity risk management is a part of our risk management process and is subject to oversight by our Board of Directors and management. Our Board of Directors has delegated oversight and mitigation of risks from cybersecurity threats to our Audit Committee. Our Audit Committee receives quarterly reports from either our CIO or our General Counsel concerning any significant cybersecurity threats, risks, and the tools and processes we have implemented for mitigation. Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including the following: • The Information Security Executive Committee consists of our Legal Counsel, Chief Accounting Officer, Chief Compliance Officer, CIO, and Vice President of People & Culture. They are responsible for setting broad policy and communicating to the Chief Executive Officer, Chief Financial Officer, and the Board of Directors on potential material cybersecurity incidents that may require disclosure. • The Information Security Council consists of our CIO, the Senior Director of Information Security, in-house information security experts, and information technology experts and leaders from across the Company. The CIO leads this committee and communicates with the Information Security Executive Committee as required. • The Information Security Team consists of cybersecurity professionals primarily responsible for managing cybersecurity at Pursuit. This team has the primary responsibility for identifying, assessing, and managing material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware, software, and critical data. This team is led by our CIO, who has over 25 years of experience in information technology including cybersecurity oversight. This team includes the following: • The Senior Director of Information Security reports directly to the CIO and is an information security professional with over 20 years of experience in the development and implementation of information security processes, procedures, and practices. • The Senior Director of Global Infrastructure & Operations reports directly to the CIO and is responsible for implementing, maintaining, and providing oversight of the IT Infrastructure and the Information Security Team. • The Security Engineer leads the day-to-day operations of the Information Security Team and oversees individual analysts and IT experts on the team. • The Security Incident Response Team ("SIRT") is responsible for executing the IRP. The SIRT comprises individuals from multiple departments, divisions, and disciplines. Members of the SIRT are trained in incident response and reporting procedures.


text: Cybersecurity Risk Management and Strategy We have implemented a cybersecurity program in accordance with our risk profile and business size that is informed by recognized industry standards, including elements of the National Institute of Standards and Technology Cybersecurity Framework. We leverage the cybersecurity services of third-party vendors, including virtual chief information security officer services, to support our cybersecurity risk management program.

companyName: Metagenomi Therapeutics, Inc.

ticker: MGX


text: Our cybersecurity risk management program is comprised of a number of components, including but not limited to a risk assessment incorporating elements of industry-standard frameworks, penetration testing, endpoint detection and response, system log monitoring and alert platform, and security operations center, functioning 24x7. We have an employee training program that includes annual cybersecurity awareness training that is reinforced by frequent phishing campaigns. We also maintain an incident response plan and related processes to help guide our response to cybersecurity incidents.


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the vendor's programs. Our current vendor evaluation procedures include, as appropriate, a review of certain vendors' security standards.


text: We have no t identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors have experienced threats relating to our and our third-party vendors' information systems. For more information, please see "Item 1A, Risk Factors."


text: Governance Related to Cybersecurity Risks Our Head of Information Technology ("Head of IT") is responsible for the strategic leadership and direction of the Company's information technology organization. Our current Head of IT has over thirty years of experience leading information technology teams in the life sciences industry. The Head of IT reviews threat intelligence, and receives updates from the Company's third-party providers, to help identify risks from cybersecurity threats.


text: The Head of IT reports to the Chief Financial Officer (CFO), and attends regular meetings with the CFO to discuss updates relating to the Company's cybersecurity program. The Head of IT also provides cybersecurity updates on a quarterly basis to the Company's executive team.


text: The Board of Directors has delegated oversight of cybersecurity risk management to the Audit Committee. The Audit Committee reviews the Company's major cybersecurity risk exposures and the steps that the Company's management has taken to monitor and control such exposures. Specifically, the Audit Committee reviews updates on data management, security initiatives, and significant existing and emerging cybersecurity risks, including material cybersecurity incidents, the impact on the Company and its stakeholders of any significant cybersecurity incident, and any disclosure obligations arising from any such incidents.


text: As part of our risk management program, we reference security industry frameworks and other guidance to help us assess, identify, and manage cybersecurity risks. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Atai Beckley N.V.

ticker: ATAI


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Cyberattacks, data security incidents or other failures in our telecommunications or information technology systems, or those of our collaborators, CROs, third-party logistics providers, distributors or other contractors or consultants, could result in information theft, data corruption, legal liability, damage to our reputation, and significant disruption of our business operations which could materially affect our operating results, financial condition, and business."


text: Our management team, including other internal staff such as the Head of IT and Chief Operating Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's and their delegates' collective experience include over ten years of cybersecurity, incident response, and the safeguarding of organizational assets expertise. Specifically, our Head of IT has over ten years of experience leading cybersecurity teams and programs, while our Chief Operating Officer has over seven years of experience risk management and three years of cybersecurity oversight.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate personnel, including our Vice President, Information Technology, who reports to our Executive Vice President, Chief Technology Officer, and Head of Operations, to manage the risk assessment and mitigation process.

companyName: Sana Biotechnology, Inc.

ticker: SANA


text: As part of our overall risk management system, we monitor and test our safeguards and train relevant personnel on these safeguards. These efforts are led by our Information Security function. All personnel are expected to engage in security awareness training. We engage third parties to perform security assessments to test our safeguards and, when appropriate, implement modifications to or add new safeguards based on the results of such assessments.


text: In connection with our November 2024 portfolio prioritization, our Vice President, Information Technology assumed from our former Head of Information Security responsibility for assessing and managing our material risks from cybersecurity threats. He has worked in various roles pertaining to Information Technology for more than fifteen years. The processes by which he is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following: vulnerability management, third party risk management, data security management, security awareness training, systems management, operations security, security incident and event management, and incident response management. We use third parties for managed detection and active response to cybersecurity incidents.


text: Our Vice President, Information Technology provides quarterly briefings to our audit committee regarding our cybersecurity risks and activities, such as any recent cybersecurity incidents and related responses (including those of third parties), if any, and cybersecurity systems testing. Our audit committee provides periodic updates to the board of directors that include any material information included in such briefings. In addition, our Vice President, Information Technology provides annual briefings to our board of directors on cybersecurity risks and activities.


text: Risk Management and Strategy Kodak has implemented various processes designed to help assess, identify and manage risk from cybersecurity threats. Kodak's cybersecurity program follows the structure and objectives of the U.S. National Institute of Standards and Technology ("NIST") Cybersecurity Framework and is designed to satisfy multi-jurisdictional regulatory requirements. Key areas of Kodak's cybersecurity risk management processes and strategy currently include: • Cross-Functional Collaboration and Coordination. Our IT security operations and risk management team ("IT Security Team"), led by our Chief Information Security Officer ("CISO"), has first line responsibility for the implementation and operation of our cybersecurity risk management processes. However, this team works together with other internal teams to coordinate efforts, priorities and oversight. These include: o our IT Risk Council (the "Council"), which is comprised of key leaders from stakeholder groups throughout the Company and led by our CISO, and meets monthly to review metrics and discuss risks and recent events;

companyName: EASTMAN KODAK CO

ticker: KODK


text: o our Risk Management and Compliance Committee (the "Risk Committee"), which is responsible for evaluating and assessing overall enterprise risk, including cybersecurity risk;


text: o our Internal Audit Department, which monitors certain IT systems controls that are integrated into our larger Sarbanes-Oxley control environment;


text: o our Chief Privacy Officer; and o our crisis management team, a cross-functional team of senior management and subject matter experts from across the Company established to be ready to respond to crisis events, including those arising from cybersecurity incidents.