text: Our CISO works at the direction of the CDO, who has more than 20 years of executive IT leadership experience and leads the company's Digital and Information Technology functions that seek to provide innovative, secure, and reliable technology products and services to MPC and its customers. Prior to joining MPC in 2021, our CDO was employed by GE and its subsidiary companies for over 20 years, holding several executive IT leadership roles with increasing responsibility. He was then named Senior Vice President and Chief Information Officer of Services for parent company GE in 2017 and was later named the Vice President and Chief Information Officer of GE Healthcare. Our CDO holds a Bachelor's degree in Business Administration, Management and Information Systems.


text: Risk Management and Strategy We are committed to properly addressing the cybersecurity threats we face, and we have processes to assess, identify, and manage material risks from cybersecurity threats. We apply a comprehensive approach to the mitigation of cybersecurity risks. The risk of cybersecurity threats is integrated into our overall risk management program, which includes an annual risk prioritization process to identify key enterprise-level risks. The cybersecurity threat risk action plan is managed by a dedicated information technology ("IT") committee (the "IT Committee"), which oversees our cybersecurity program. The IT Committee comprises senior company leaders as well as our outsourced IT services provider. To oversee and identify cybersecurity threat risks on a day-to-day basis, we maintain a security operations center with round-the-clock monitoring. We have established policies, including those related to privacy, information security and cybersecurity, and we employ a broad and diversified set of mitigation strategies and techniques to reduce cybersecurity risks, including continuous monitoring, early detection tools, proactive vulnerability management, and remediation. Our information security policies are modeled against the National Institute of Standards and Technology's Cybersecurity Standards and incorporate concepts from the Zero Trust Framework.

companyName: RLJ Lodging Trust

ticker: RLJ

secItem: Item 1C


text: Given the ever-changing cybersecurity landscape, our IT Committee regularly meets to identify opportunities for incremental improvements, assess additional layers of security, and evaluate new technologies for implementation. In addition, we engage, as necessary, cybersecurity experts to analyze our IT policies, procedures, and infrastructure to assess their effectiveness and to identify opportunities for improvement.


text: We conduct an annual information security compliance training for all employees to enable them to detect and report malware, ransomware, and other malicious software and social engineering attempts that may compromise our IT systems. Employees also are subject to spear-phishing training campaigns, which allow us to assess the effectiveness of our training programs.


text: Our management companies are ultimately responsible for our guests' information, and we monitor these companies, as well as other third party service providers, to ensure that they are complying with our privacy, information security and cybersecurity policies. We also assess the cybersecurity proficiency of potential third party cloud suppliers before utilizing their services.


text: We work closely with our internal and external auditors to assess, identify and manage cybersecurity risks. Our IT internal controls are audited by our external auditor as part of our Sarbanes-Oxley Act compliance activities, and this process includes assessing the design and operating effectiveness of those controls.


text: Any failure to maintain proper function, security and availability of our information technology networks and systems could interrupt our operations, our financial reporting and compliance, damage our reputation, and subject us to liability claims or regulatory penalties, which could have a material and adverse effect on our business, financial condition and results of operations. Management has not identified cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" above for more information.


text: Our board of trustees is responsible for overseeing the assessment and management of enterprise-level risks that may impact us, including cybersecurity. Two board members have information security expertise from their professional experience. Nathaniel A. Davis has expertise in information technology and experience reviewing and addressing cybersecurity risks. Patricia L. Gibson also has experience assessing and addressing cybersecurity risks through her past professional experience.


text: Our Audit Committee has primary responsibility for the oversight of risks from cybersecurity threats. Management, including members of the IT Committee, reports at least annually to the Audit Committee regarding cybersecurity risks and mitigation strategies. We consider each member of our Audit Committee to possess information security experience by way of their oversight responsibilities over this area. In addition to ensuring adequate safeguards are in place to minimize the chance of a successful cyber attack, we have established a cybersecurity incident response plan to effectively address any cybersecurity threat that may occur despite these safeguards. We believe our cybersecurity incident response plan will help ensure timely, consistent and compliant responses to actual or attempted data incidents impacting our company. The cybersecurity incident response plan includes an escalation framework, including processes for informing the board of trustees of material cybersecurity incidents.


text: Our management companies are ultimately responsible for our guests' information, and we monitor these companies, as well as other third-party service providers, to ensure that they are complying with our privacy, information security and cybersecurity policies. We also assess the cybersecurity proficiency of potential third-party cloud suppliers before utilizing their services.


text: Risk Management and Strategy As part of our overall enterprise risk management function, we have implemented and currently maintain various information security processes designed to assess, identify, and manage material risks from cybersecurity threats to our critical computer network, third-party hosted services, and our critical data (collectively, our "Information Systems").

companyName: Ubiquiti Inc.

ticker: UI


text: We have engaged an outside consultant that assists our efforts to prevent threats toward our Information Systems. This consultant monitors data feeds from certain of our key Information Systems. The consultant notifies and works with the Company to investigate and resolve any potential cybersecurity threats identified.


text: Internally, to help manage risk from potential cybersecurity threats, we require our employees to participate in mandatory cybersecurity trainings provided by a third-party specialist which focuses on building awareness of common tactics by threat actors, such as phishing. This training is provided on an annual basis.


text: All of our offices use our own gateway consoles, which have intrusion detection features built in. Additionally, access to our key Information Systems requires an in-office network or VPN with multi-factor authentication, and we employ additional protective measures including the use of our proprietary identity management tool. We also use third-party tools to protect our employee laptops and self-hosted servers and have implemented a public bug bounty program that helps to identify vulnerabilities in our products.


text: We and certain of our vendors have experienced cyber-attacks in the past and may experience cyber-attacks in the future. For example, as previously disclosed, we became aware in January 2021 that certain of our information technology systems hosted by a third-party cloud provider were improperly accessed and certain of our source code and the credentials used to access the information technology systems themselves had been compromised. We received a threat to publicly release these materials unless we made a payment, which we have not done. As a result, it is possible that the source code and other information could be publicly disclosed or made available to our competitors. Due to the nature of the source code and the other information that we believe was improperly accessed, we at this time do not believe that any public disclosure will have a material adverse effect on our business or operations, but it is impossible to gauge the precise impact of any such disclosure.


text: Except as described above, to date, risks from cybersecurity threats have not previously materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition. For additional information about cybersecurity risks, see Item 1A. "Risk Factors."


text: Role of the Board Our Board of Directors (the "Board") has the responsibility for the oversight of risk management, including those risks related to cybersecurity. Our Board holds strategic planning sessions with senior management to discuss strategies, key challenges, risks and opportunities for us. This involvement of our Board in setting our business strategy is a key part of its oversight of risk management, its assessment of management's appetite for risk, and its determination of what constitutes an appropriate level of risk for us. Our senior management attends meetings of our Board and its committees on a quarterly basis, and as otherwise needed, and are available to address any questions or concerns raised by our Board on risk management and any other matters.


text: Role of Management Our senior management, with the oversight of the Board, is responsible for the day-to-day management of the material risks we face, including those related to cybersecurity. We believe it is important to work cross functionally within the Company to manage cybersecurity risks and threats. Therefore, our cybersecurity team is made up of individuals from multiple different departments throughout the Company, including but not limited to our security, IT, R&D and legal teams. The cybersecurity team as a whole has academic degrees related to cybersecurity, technical know-how, and real-world experience managing cybersecurity incidents and risks. Material issues identified by our cybersecurity team are brought to the attention of our Chief Executive Officer and/or our Executive Vice President of Operations and Legal Affairs who in turn will update the Board, as necessary.


text: We rely on the cybersecurity strategy and policies implemented by Monroe Capital, the parent of both MC Advisors and MC Management that also apply to the Company. Monroe Capital's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Monroe Capital's enterprise-wide cybersecurity program is aligned to the National Institute of Standards and Technology Cybersecurity Framework. Monroe Capital's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Monroe Capital has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors and other third parties who entrust us with their sensitive information.

companyName: MONROE CAPITAL Corp

ticker: MRCC


text: Monroe Capital's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help Monroe Capital prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us, MC Advisors or MC Management. Monroe Capital's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us, our investment adviser or our administrator, is integrated into Monroe Capital's enterprise risk management program, which is overseen by the Monroe Capital Operations and Risk Committee ("ORC"), as discussed below. In addition, Monroe Capital periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing and monitoring its cybersecurity risk management programs and responding to incidents.


text: The Monroe Capital cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness and data protection training including for employees of MC Advisors and MC Management. Monroe Capital also has annual certification requirements for employees, including employees who provide services to us pursuant to our Investment Advisory and Management Agreement and our Administration Agreement with respect to certain policies supporting the cybersecurity program. Monroe Capital undertakes periodic internal security reviews of our information systems and related controls, including systems affecting personal data and the cybersecurity risks of Monroe Capital's and our critical third-party vendors and other partners. Monroe Capital also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.


text: In the event of a cybersecurity incident impacting us, MC Advisors or MC Management, Monroe Capital has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational functions of Monroe Capital, including coordinating with the relevant employees of MC Advisors and MC Management. The incident response plan includes notification to the applicable members of cybersecurity leadership, including Monroe Capital's Head of Information Technology, and the Computer Security Incident Response Team ("CSIRT"), as appropriate, escalation to the full ORC and/or an internal ad hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on their nature, incidents may also be reported to the audit committee or full board of directors of Monroe Capital, as well as to the Audit Committee (the "Audit Committee") of our Board of Directors (the "Board") and to our full Board, if appropriate.


text: Risk Management and Strategy In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and store sensitive data. "Information systems" means electronic information resources that we own or use, including physical or virtual infrastructure controlled by these information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the information necessary to maintain or support our operations. Because cybersecurity threats continue to evolve, we have been required and may continue to be required to expend significant resources to continue to implement, modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. Financial expenditures may also be required to meet regulatory changes in the information security and cybersecurity domains. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors—General Risk Factors—The failure in cyber security systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively."


text: To address cybersecurity threats (defined as potential unauthorized occurrences on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems or any information residing in those systems therein), we have a implemented an incident and event response program. That program is a component of our overall enterprise risk management and business continuity frameworks. We employ an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity relative to our information systems, as well as to report on any suspected advanced persistent threats. The program is designed to allow for the detection and timely and efficient recovery from cybersecurity incidents (defined as a violation or imminent threat of violation of information security policies, acceptable use policies, or standard computer security practices) and events by providing a well-defined, organized approach for handling any potential threats to the confidentiality, integrity, and/or availability of our information systems.


text: The CSIRT maintains overall responsibility for addressing and resolving incidents that occur at Monroe Capital. The CSIRT: (i) coordinates efforts in response to incidents; (ii) manages the assessment, recovery, and remediation efforts related to incidents; (iii) manages communication, both internal and external, regarding incidents; and (iv) manages notification of regulatory bodies as required by law in response to incidents.


text: We contract with a third-party vendor (oversight for which is outlined in our Vendor Risk Management Policy) who monitors our information systems for suspicious activity, such as unauthorized intrusions. Suspected or confirmed threats, incidents, or events, however, also may be reported by employees, intrusion detection systems, third-party servicers, or government entities. Once reported, cybersecurity incidents are to be brought to the attention of the Head of Information Technology, the ORC and the CSIRT, which provides status updates to the Information Security Committee ("ISC"), with the frequency of such updates depending upon the perceived threat level of the reported incident.


text: After receiving notice of a cybersecurity threat, such threats are investigated to determine whether an actual incident has occurred and, if so, whether a more thorough assessment by the entire ISC is appropriate. During these assessments, steps may be taken to isolate affected systems. Outside advisors may be employed regarding the cybersecurity threat, including to conduct legal and forensic investigations and work with other third parties who might be engaged to assist in any response and associated publicity.


text: During or at the conclusion of an assessment of a cybersecurity incident, we will respond to the incident. The response will vary based upon the severity of the incident or event. The Head of Information Technology will note the classification of the information potentially impacted, paying close attention to information classified as personally identifiable information and sensitive. The Head of Information Technology and appropriate personnel will determine whether the incident is likely to affect ongoing business operations. If such is the case (e.g., contamination is widespread across production systems), Monroe Capital's Incident Response Plan and Business Continuity Plan shall be invoked, as necessary. In determining the level of response, we have identified three criticality levels of incidents and events based upon the following criteria: • Risk to confidential data • Risk to business continuity • Risk to critical systems • Revenue impact • Client impact


text: Incident and risk event levels each vary from level 3 (or low) risk to level 1 (high) risk. The determination of the incident and risk level will dictate the level of personnel that will be responsible for addressing the incident, controlling the effects of the incident and formulating the response to the incident. Responses may include, when appropriate and/or required, notification to regulatory agencies (e.g., SEC), authorities (e.g., F.B.I., Department of Justice), clients, third parties or internal personnel.


text: The CSIRT is responsible for incident reporting and response. The action steps taken, beyond notification, are typically accomplished with the assistance of the IT department. The Head of Information Technology or CSIRT team member will work with the appropriate personnel to respond to the incident (following written guidelines) and to ensure concurrent documentation of the same. Should a breach occur at a third party that has a material impact on Monroe Capital, the CSIRT must be notified.


text: Following a cybersecurity incident, and during its investigation and the formulation of a response, our processes also envision measures designed to contain and/or eradicate the incident and prevent further effects. Once it is determined that the incident has been resolved, we then work to establish appropriate controls (if applicable) to address similar future events and/or prevent another similar event from occurring in the future. To date, we have not experienced any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Our cybersecurity program is managed by Monroe Capital's dedicated internal cybersecurity team, which is responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by Monroe Capital's Head of Information Technology, who has a bachelor's degree in systems engineering and over 12 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The CSIRT includes members of Monroe Capital's senior executive management, including its Chief Operating Officer, Chief Compliance Officer and the Head of Information Technology, who acts as chairperson of the ISC. The ISC is comprised of Monroe Capital's Head of Information Technology, Chief Operating Officer and Chief Compliance Officer. The purpose of the ISC is to protect Monroe Capital's technology, data and information, and the ISC is tasked with responding to technology and data security incidents. The ORC is a cross-functional committee that governs and oversees the Monroe Capital enterprise risk management program, including cybersecurity. The ORC includes members of Monroe Capital's senior executive management, including its Chief Compliance Officer, Chief Operating Officer, Chief Credit Officer, President & Co-Portfolio Manager, Chief Financial Officer of Management Company and Chief Financial Officer of Investment Funds, who acts as chairperson of the ORC. The ORC, through regular consultation with the Monroe Capital internal cybersecurity team and employees of MC Advisors and MC Management, assesses, discusses, and prioritizes Monroe Capital's approach to high-level risks, mitigative controls and ongoing cybersecurity efforts.


text: As part of its oversight responsibilities over risks and controls, the Board is ultimately responsible for overseeing our cyber and information security risks. The Audit Committee has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Members of the ORC and other Monroe Capital personnel periodically report to our Audit Committee as well as our full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Monroe Capital's cybersecurity program as it impacts us, the external threat environment, and Monroe Capital's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Monroe Capital's preparedness, prevention, detection, responsiveness and recovery with respect to cybersecurity incidents.


text: Material Impact of Cybersecurity Risks As of the date of this annual report on Form 10-K, we are not aware of any material risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about the cybersecurity risks that we face is discussed in Item 1A of Part I, "Risk Factors" in this annual report on Form 10-K under the heading "The failure in cybersecurity systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively."


text: Our cybersecurity program is managed by Monroe Capital's dedicated internal cybersecurity team, which is responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by Monroe Capital's Head of Information Technology, who has a bachelor's degree in systems engineering and over 13 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The CSIRT includes members of Monroe Capital's senior executive management, including its Chief Operating Officer, Chief Compliance Officer and the Head of Information Technology, who acts as chairperson of the ISC. The ISC is comprised of Monroe Capital's Head of Information Technology, Chief Operating Officer and Chief Compliance Officer. The purpose of the ISC is to protect Monroe Capital's technology, data and information, and the ISC is tasked with responding to technology and data security incidents. The ORC is a cross-functional committee that governs and oversees the Monroe Capital enterprise risk management program, including cybersecurity. The ORC includes members of Monroe Capital's senior executive management, including its Chief Compliance Officer, Chief Operating Officer, Chief Credit Officer, President & Co-Portfolio Manager, Chief Financial Officer of Management Company and Chief Financial Officer of Investment Funds, who acts as chairperson of the ORC. The ORC, through regular consultation with the Monroe Capital internal cybersecurity team and employees of MC Advisors and MC Management, assesses, discusses, and prioritizes Monroe Capital's approach to high-level risks, mitigative controls and ongoing cybersecurity efforts.


text: Disclosure of cybersecurity risk, management, & strategy CompuData Supports Pismo Coast Village through their Managed IT Services. This is done through patch management, a managed Network, Managed Security, and Managed 24/7 support. Pismo Coast Village has a comprehensive risk management process that all nodes on the network are set to follow. All external Vendors are SOC II compliant. Our users access all applications utilizing a two-factor authentication method at the Domain level and SSO for third Party applications.

companyName: PISMO COAST VILLAGE INC


text: Pismo Coast Village has not had a material or data breach. Our strategy is to mitigate risks preventatively. The is implemented through best-in-class cybersecurity strategies preventative measures carried out by our vendor CompuData. Our identifiable risk areas are twofold: First within accounting and second, within taking payments. Our accounting department is hosted on a cloud system utilizing SSL for access and encryption. Our Managed Services company, CompuData, manages risk and preventative cyber security to that server. Within our taking of payments, we are fully PCI compliant within our payment processing service, Clover. No Credit card information is stored or transferred outside of that system.


text: We engage a third-party Vendor as mentioned above, CompuData. Our vendors are whitelisted and are SOC II certified. Our Whitelisted Vendor applications are Newbook, Sage, Clover, and Office 365.


text: Material Effects from Cybersecurity Incidents Our business is subject to risk from cybersecurity threats and incidents, including attempts to gain unauthorized access to our systems or networks, or those of our managers, employees, and third-party vendors and service providers, to disrupt operations, corrupt data or steal confidential or personal information and other cybersecurity breaches. Nuvera considers cybersecurity risk a serious threat to our assets and our people and has put processes in place designed to mitigate the risk and impact of any such cybersecurity threat or incident.

companyName: Nuvera Communications, Inc.

ticker: NUVR


text: As of the date of this report we have not experienced or aware of any cybersecurity incidents resulting, or reasonably likely to result in, a material impact to our company, including to our business, financial condition, and results of operations. There is no assurance that our cybersecurity risk management program will prevent cybersecurity incidents from having such impacts in the future.


text: Cybersecurity Risk Management and Strategy Our cybersecurity program is built upon the National Institute for Standards and Technology and other best practice frameworks. We employ processes for assessing, identifying, and managing material risks from cybersecurity threats, including engaging an independent cybersecurity consultant to audit our systems and procedures, make recommendations for improvement and monitor remediation of any identified risks. We also conduct random vulnerability testing including network penetration testing, phishing and social engineering tests. In addition, we also require Systems and Organization Control ("SOC") type reports from our service providers for our payroll and human resources system and stock administrator.


text: Cybersecurity Governance All employees of the Company have ownership in managing cybersecurity and data privacy risks, however, oversight responsibility is shared by our BOD, Audit Committee and cybersecurity management team. The Audit Committee is responsible for our cybersecurity policies and provides regularly updates to the BOD Our cybersecurity management team, in conjunction with our third-party chief information security officer ("CISO"), conduct regular assessment and management of material risks from cybersecurity threats, including review with our internal cybersecurity management team. All employees and consultants are directed to report to our cybersecurity management team any irregular or suspicious activity that could indicate a cybersecurity threat or incident.


text: Our cybersecurity management team has primary responsibility for identifying, assessing and managing our exposure to cybersecurity threats and incidents, subject to oversight by the Audit Committee of the BOD of the processes we establish to assess, monitor and mitigate that exposure.


text: Risk Management and Strategy Disclosure We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: TRANS LUX Corp


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: Governance Disclosure Our Board is periodically informed of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Executive Officer and Chief Accounting Officer are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.


text: Our Chief Executive Officer and Chief Accounting Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: Risk Management and Strategy The Company's business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. Our Manager is an affiliate of TPG Inc. ("TPG"), a leading global alternative asset management firm. We, in conjunction with our Manager and its affiliates, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. These processes include responses to and assessments of internal and external threats to the security, confidentiality, integrity and availability of the Company's data and systems along with other material risks to its operations, at least annually or whenever there are material changes to our systems or operations. As part of the risk management process, TPG engages outside providers to conduct periodic internal and external penetration testing. TPG has informed us that it uses NIST Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that TPG, its affiliates or we meet any particular technical standards, specifications, or requirements. TPG stores data, including the Company's data, in cloud environments with security that we believe is appropriate for the data involved and has adopted controls around, among other things, vendor risk assessment, access and acceptable use and backup and recovery.

companyName: TPG Mortgage Investment Trust, Inc.

ticker: MITT


text: The Company utilizes certain third-party service providers to perform a variety of functions in the operation of its business. TPG has processes to oversee and identify material risks associated with the use of third-party service providers, taking into account the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "Risks Related to our Company, Business, and Operations—Cybersecurity risks may cause a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our business.", for additional discussion about cybersecurity-related risks.


text: Our Board of Directors holds oversight responsibility over the Company's strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. The Board regularly engages in discussions with management regarding the Company's risk assessment and risk management policies. In addition, the Audit Committee of our Board of Directors (the "Audit Committee") oversees the management of systemic risks, including cybersecurity, in accordance with its charter. The Audit Committee engages in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks.


text: Our Board of Directors, including the Audit Committee, is briefed on our Manager's information security program and cybersecurity risks at least once each year and as needed in connection with any potentially material cybersecurity incidents. The Chief Information Security Officer reports at least annually to our Board of Directors, including the Audit Committee, and such report may address overall assessment of the Company's compliance with this and other cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.


text: As an externally managed company, we rely on our Manager and its affiliates' information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by TPG. TPG has established an Enterprise Risk Committee ("ERC") to manage overall risk across the organization including cybersecurity risks identified by TPG's cybersecurity team; the ERC includes representatives from relevant functions and is led by TPG's Chief Executive Officer. TPG has also established an Operational Risk Committee ("ORC") responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of our Manager's risk management, control and governance processes is assigned to TPG's Chief Information Security Officer, who periodically reports, among others, potentially material cybersecurity incidents to the ORC and, in coordination with the Chief Information Officer and Head of Operations, reports to the ERC at least annually. The Chief Information Security Officer leads TPG's cybersecurity team, which includes individuals dedicated to incident detection and response. This team is responsible for identifying threats that can impact the organization, including the Company, and designing controls to mitigate vulnerabilities before they are exploited and to detect and neutralize any threats that do materialize. The Chief Information Security Officer and Chief Information Officer each have more than 20 years of experience in their fields. The Chief Information Security Officer and senior members of the cybersecurity team hold industry standard certifications.


text: Risk Management and Strategy The Company's business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. Our Manager is an affiliate of TPG, a leading global alternative asset management firm. We, in conjunction with our Manager and its affiliates, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. These processes include assessments of internal and external threats to the confidentiality, integrity and availability of the Company's data and systems along with other material risks to its operations.


text: These risk assessments inform our cybersecurity program and the continued development of a layered set of controls aimed at preventing, detecting, and responding to threats. TPG's administrative, organizational, technical and physical security controls include, but are not limited to, policies and procedures, system hardening vulnerability scanning, and patching, employee training and awareness, third-party risk management processes, backup and recovery processes, access controls, data encryption in transit and at rest, network perimeter controls, and identity verification. TPG also has policies and controls in place designed to detect and respond to cybersecurity events, including an incident response plan, an incident response team with dedicated roles and responsibilities for assessing and responding to a cybersecurity event, system logging and ongoing monitoring, and periodic training exercises simulating cybersecurity events that are designed to raise awareness and test the team's response readiness capabilities.


text: The nature, scope and effectiveness of these controls are regularly reviewed through a series of internal and external processes. TPG's cybersecurity team itself performs both automated monitoring on a continuous basis and manual reviews of key controls. TPG has informed us that it also conducts annual assessments of our cybersecurity program using industry standard cybersecurity frameworks, such as the NIST Cybersecurity Framework, as benchmarks to perform its evaluation. This does not imply that TPG, its affiliates or we fully meet any particular industry standards, specifications, or requirements. In addition, independent reviews of our cybersecurity control effectiveness are conducted by TPG's internal audit team on a periodic basis. We also engage external providers to conduct periodic external assessments, including penetration testing.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "Risks Related to our Company, Business, and Operations—Cybersecurity risks may cause a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our business. ", for additional discussion about cybersecurity-related risks.


text: As an externally managed company, we rely on our Manager and its affiliates' information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by TPG. TPG has established an Enterprise Risk Committee ("ERC") to manage overall risk across the organization including cybersecurity risks identified by TPG's cybersecurity team; the ERC includes representatives from relevant functions and is led by TPG's Chief Executive Officer. TPG has also established an Operational Risk Committee ("ORC") which is responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of our Manager's risk management, control and governance processes is assigned to TPG's Chief Information Security Officer ("CISO"), who periodically reports, among other things, potentially material cybersecurity incidents to the ORC and reports to the ERC at least annually. TPG's cybersecurity team also regularly coordinates with other key stakeholders within the organization, including compliance, human resources, internal audit and legal. The CISO leads TPG's cybersecurity team, which is responsible for implementing, maintaining and enforcing our cybersecurity program. TPG's CISO previously held various leadership roles within the Technology Risk department of one of the world's largest banking institutions over a 17-year period. TPG has informed us that the CISO holds a Bachelor of Science in Electrical Engineering and Mathematics from the University of Texas at Arlington and is a Certified Information Systems Security Professional (CISSP). TPG's cybersecurity team possesses a variety of cybersecurity skill sets and extensive expertise obtained through decades of experience, numerous industry certifications, and advanced degrees. TPG's cybersecurity team continues to take steps to maintain up-to-date knowledge of evolving cybersecurity threats and countermeasures.


text: Cybersecurity Risk Management and Strategy We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity threats and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, threat modeling, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning.

companyName: Bandwidth Inc.

ticker: BAND


text: Our enterprise-wide information security program is designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. Cybersecurity risks related to our business, network, and operations are identified and addressed through a multi-faceted approach including third party assessments, as well as internal information system and network security, governance, risk and compliance reviews.


text: To defend, detect and respond to cybersecurity incidents, we (i) conduct proactive privacy and cybersecurity reviews of systems and applications, (ii) audit applicable data policies, (iii) perform penetration testing internally and with external independent third-parties to test our security controls, (iv) conduct employee training, (v) monitor emerging laws and best practices related to data protection and information security and (vi)


text: implement appropriate changes. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have implemented incident response and breach management processes, which have four overarching and interconnected workflows: (1) detection and analysis of a security or privacy incident, (2) investigation, mitigation and remediation, (3) reporting and notification, and (4) post-incident analysis. Such incident responses may involve participants from our information security, network, information Technology, development, executive and legal teams.


text: We also conduct exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals collaborates with technical and business stakeholders across our business units to further analyze the risks to the company and form detection, mitigation and remediation strategies.


text: As part of the processes described above, we regularly engage external auditors and consultants to assess our cybersecurity programs and compliance with applicable practices and standards. Our Information Security Management System has been certified to conform to the requirements of ISO/IEC 27001:2013 and AICPA SOC 2 Type II, which includes all five of the Trust Services Criteria.


text: Our Vendor Risk Management ("VRM") program assesses risks from cybersecurity threats associated with our use of third-party service providers. Under this program, we perform initial risk assessments prior to selecting and engaging third-party service providers as well as ongoing risk assessments in an effort to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners. The VRM program is designed to evaluate the cybersecurity and data privacy risks associated with the use of third-party vendors that will be processing, storing, or handling Bandwidth employee, business or customer data. Based on this evaluation, the VRM program records a risk rating, advises on selection or implementation recommendations, and informs contractual terms with the applicable third-party, such as privacy, security, and data protection commitments. In addition to new vendor onboarding, the VRM program includes annual review of critical service providers, ongoing assessment of expanded use cases, and evaluation of potential third-party incidents. We monitor and evaluate reports of third-party cybersecurity threats to identify and mitigate potential risks to us from third-party incidents in our supply chain.


text: Our Application Security program proactively performs static and dynamic scanning of systems and software code. In addition, we perform vulnerability scans daily on our systems and assets.


text: To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner with continuous monitoring from our Security Operations Center. These tools include, but are not limited to, Endpoint Detection and Response, Security Information and Event Management, Attack Surface Management, Static Application Security Testing, Dynamic Application Security Testing, DDoS Mitigation Services, threat detections including intelligence and brand monitoring, intrusion detection sensors, network firewalls and web application firewalls.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property. The DDoS attack we experienced in late 2021 did have a material impact on our results of operations. We do face risks from similar attacks and other cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. Further, an attack on, or penetration of, our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risks. See "Risk Factors - Attacks on or breaches of our networks or systems, or those of third parties upon which we rely, could degrade our ability to conduct our business, compromise the integrity of our services and our communications platform, result in service degradation or outages, significant data losses, the theft of our intellectual property, investigations by government agencies and damage to our reputation, and could expose us to liability to third parties and require us to incur significant additional costs to maintain the security of our networks and data."


text: Cybersecurity Governance Our board of directors oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. Our board of directors receives an update on Bandwidth's risk management process at least annually, and receives quarterly cybersecurity updates from our Chief Information Officer ("CIO").


text: Our CIO and our Vice President, Information Security lead our global information security organization and are responsible for overseeing our information security program. Our Vice President, Information Security has over 25 years of industry experience, including serving in similar roles, building, leading and overseeing cybersecurity programs at other private and public companies. Team members who support our information security program have relevant educational and industry experience, including application security, security operations, forensic and incident response, governance, risk and compliance.


text: At the management level, our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, operations, legal and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of our and our customers' information by identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. Our Executive Security Committee, which includes our Chief Operating Officer, our CIO, our Chief Technology Officer, our Chief Development Officer, our General Counsel and other cross-functional participants, meets monthly to evaluate our cybersecurity risks and related response efforts.


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training designed to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: Cybersecurity Risk Management and Strategy We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. Our enterprise-wide information security program is designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity threats and develop related security controls and safeguards. We conduct regular periodic reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing internally and with external independent third-parties, threat modeling, simulations, and other exercises in an effort to evaluate the effectiveness of our information security program and improve our security measures and planning.


text: We have implemented incident response and breach management processes, which have four overarching and interconnected workflows: (1) detection and analysis of a security or privacy incident, (2) investigation, mitigation and remediation, (3) reporting and notification, and (4) post-incident analysis. These processes may involve participants from our information security, network, information technology, software development, executive and legal teams.


text: From time to time, we also conduct exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals collaborates with legal, technical and business stakeholders to further analyze the risks to the company and form detection, mitigation and remediation strategies.


text: Our Vendor Risk Management ("VRM") program aids in evaluating the cybersecurity and data privacy risks associated with the use of vendors and other third parties that will be processing, storing, or handling Bandwidth employee, business or customer data. The VRM program is designed to evaluate third-party risk, advise on selection or implementation recommendations, and inform privacy, security and data protection contractual terms. We rely, however, on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: Our Application Security program performs static and dynamic scanning of systems and software code. In addition, we perform vulnerability scans daily on our systems and assets.


text: With respect to cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner with continuous monitoring from our Security Operations Center. These tools include, but are not limited to, Endpoint Detection and Response, Security Information and Event Management, Attack Surface Management, Static Application Security Testing, Dynamic Application Security Testing, DDoS Mitigation Services, threat detections including intelligence and brand monitoring, intrusion detection sensors, network firewalls and web application firewalls.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property. We have not experienced any material cybersecurity events in the last three fiscal years, and expenses incurred in connection with cybersecurity incidents were not material. However, we do face risks from similar attacks and other cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. Further, an attack on, or penetration of, our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risks. See "Risk Factors - Attacks on or breaches of our networks or systems, or those of third parties upon which we rely, could degrade our ability to conduct our business, compromise the integrity of our services and our communications platform, result in service degradation or outages, significant data losses, the theft of our intellectual property, investigations by government agencies and damage to our reputation, and could expose us to liability to third parties and require us to incur significant additional costs to maintain the security of our networks and data," included elsewhere in this Annual Report on Form 10-K.


text: At the management level, our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, operations, legal and compliance stakeholders meet regularly to discuss strategies designed to preserve the confidentiality, integrity and availability of our and our customers' information by identifying and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. Our Executive Security Committee, which includes our Chief Operating Officer, our CIO, our Chief Technology Officer, our Chief Development Officer, our General Counsel and other cross-functional participants, meets monthly to evaluate our cybersecurity risks and related response efforts.


text: Cybersecurity Education and Awareness We monitor emerging laws and best practices related to data protection, privacy and information security. We regularly remind employees of the importance of handling and protecting customer and employee data, and our policies require each of our employees to undergo annual privacy and information security training designed to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: Cybersecurity Risk Management, Strategy, and Governance We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K, to protect the confidentiality, integrity and availability of our critical systems and information. Our enterprise risk management program considers cybersecurity threats as part of our overall risk assessment process. We perform these risk assessments to inform our risk mitigation strategies and prioritize cybersecurity initiatives. Our cybersecurity risk assessment process includes network and endpoint monitoring, vulnerability assessments, and penetration testing, and we believe helps identify our cybersecurity threat risks by aligning our processes to standards set by the National Institute of Standards and Technology ("NIST"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. The results of our cybersecurity assessments are regularly shared with senior management and the Board of Directors. Additionally, we have implemented technologies, controls and processes to aid in our efforts to assess, identify, manage, and monitor material cybersecurity risks, their severity, and potential mitigation. We regularly review and update our cybersecurity processes to help address the evolving cybersecurity landscape and legal requirements, providing clear guidelines for our employees and third-party service providers.

companyName: SunCoke Energy, Inc.

ticker: SXC


text: Governance Structure and Risk Management Functions Cybersecurity is an integral part of our risk management processes. Our cross-functional risk management team evaluates cybersecurity risks alongside other operational, financial, and reputational risks, facilitating effective resource allocation and coordinated mitigation strategies. In 2021, we updated our Audit Committee charter to memorialize the Committee's role in reviewing cybersecurity matters. The Audit Committee oversees the initial assessment of cybersecurity threats as well as the Company's approach to management and mitigation of such risks, compliance with industry standards related to cybersecurity, and the Company's public disclosures related to cybersecurity matters. In addition, our Board of Directors devotes regular attention to oversight of cybersecurity risks. At least annually, the entire Board of Directors receives an update from our Chief Information Officer ("CIO") detailing our cybersecurity threat risk management and strategy processes. This update covers topics such as data security posture, results from assessments conducted by third parties, progress towards security goals, and any material cybersecurity developments, as well as steps taken in response to such developments. Our governance structure allows senior management and the Board of Directors to also remain involved in our cybersecurity strategy and risk management oversight, creating a comprehensive approach to our risk management.


text: Cybersecurity Leadership and Communication Our CIO has experience in various roles implementing effective information and cybersecurity programs. The CIO reports to the Company's Senior Vice President and Chief Financial Officer and maintains open channels of communication with the broader senior management team and the Board of Directors. The CIO leads our cybersecurity initiatives and is responsible for implementing our cybersecurity strategy, managing daily operations, coordinating incident responses, and providing regular updates to management, the Audit Committee and the Board of Directors regarding the Company's cybersecurity status and risk assessments.


text: External Support and Third-Party Risk Management Management continues to take steps to enhance our data security infrastructure and defenses. Our processes also address cybersecurity threat risks associated with using third-party service providers, including those in our supply chain or who have access to our customer and employee data, our information systems, or the facilities that house such systems or data. We engage outside third-party experts, cybersecurity advisors, and auditors to conduct regular risk assessments, penetration testing, and vulnerability analyses. Our enterprise risk management and cybersecurity-specific risk identification programs include consideration of third-party risks and informs our selection and oversight of third-party service providers. We conduct appropriate due diligence on third-party service providers, vendors, and partners before establishing relationships with them, and we monitor such relationships on an ongoing basis. We also periodically review the Company's cyber insurance policies to ensure appropriate coverage.


text: Incident Response and Vulnerability Management In the event of a cybersecurity incident, our incident response plans are designed to respond with an incident response team to address any breaches. Our ongoing vulnerability management program complements our incident response capabilities. It includes periodic scanning, risk assessment, and patch management to address system and network vulnerabilities and help ensure that our infrastructure remains resilient against evolving threats.


text: As part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, and in our MD&A at Item 7 of this Annual Report on Form 10-K, we describe whether and how risks from identified cybersecurity threats, including any previous incidents, have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. These disclosures are incorporated by reference herein. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. This includes penalties and settlements, of which there were none.


text: All companies utilizing technology are subject to the risk of breaches of or unauthorized access to their computer systems. The Company maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The Audit Committee of our Board of Directors and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats and incidents. Our policies, processes and procedures include, among other things, annual external penetration testing using an experienced third-party company; a cybersecurity incident response and recovery plan; periodic and ongoing security awareness training for employees; the use of several comprehensive vulnerability analysis systems to evaluate software vulnerabilities both internally and externally; and mechanisms to detect and monitor unusual network activity. The Company also requires that all third-party vendors that have access to or handle sensitive information undergo a risk-based vendor security assessment. We also maintain controls and procedures that are designed to promptly escalate certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our Board of Directors in a timely manner. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective.

companyName: AMC Networks Inc.

ticker: AMCX


text: Our cyber risk management program is based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Our cybersecurity risks are identified and addressed through a comprehensive, cross- functional approach. The Company has established a cybersecurity committee consisting of members of senior management, including the Company's Chief Information Security Officer ("CISO"). The Company's CISO is primarily responsible for the implementation of defense capabilities and risk mitigation strategies. The Company's CISO has over 25 years of information technology and cybersecurity experience. He holds the title of Senior Vice President of Technology Services and Chief Information Security Officer, has been in his role since 2021 and is supported by his direct reports and their teams. The cybersecurity committee also includes senior members from the Company's legal, human resources, technology, communications and risk management departments. This committee meets on a periodic basis to review various cybersecurity and data privacy matters and is responsible for maintaining processes to assess, identify and manage material risks from cybersecurity threats. The cybersecurity committee provides quarterly updates to the Company's General Counsel, Chief Financial Officer and Executive Vice President of Global Media Operations and Technology. In addition, the cybersecurity committee has established regional triage teams that are responsible for responding to any cybersecurity incident and deciding if other members of the cybersecurity committee, Company employees or Company vendors should be involved in the Company's response.


text: Our Audit Committee takes the lead on behalf of our Board of Directors in monitoring risk management, which includes overseeing the Company's management of its cybersecurity and data privacy. The Audit Committee meets on a quarterly basis with our General Counsel and Chief Financial Officer, who provide quarterly reports concerning the Company's information security and cybersecurity risks.


text: Although we have not been materially impacted by any cybersecurity incident to date, we are subject to cybersecurity threats, as discussed in Item 1A. Risk Factors, including in the risk factor entitled "We face continually evolving cybersecurity risks, which could result in the disclosure, theft or destruction of confidential information, disruption of our programming, damage to our brands and reputation, legal exposure and financial losses."


text: All companies utilizing technology are subject to the risk of breaches of or unauthorized access to their computer systems. The Company maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The Audit Committee of our Board of Directors and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. We have established policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats and incidents. Our policies, processes and procedures include, among other things, annual external penetration testing using an experienced third-party company; a cybersecurity incident response and recovery plan; periodic and ongoing security awareness training for employees; the use of several comprehensive vulnerability analysis systems to evaluate software vulnerabilities both internally and externally; cryptography and encryption; data erasure and media disposal, regular data backups and restoration processes; and mechanisms to detect and monitor unusual network activity. The Company also requires that all third-party vendors that have access to or handle sensitive information undergo a risk-based vendor security assessment and provide contractual assurances relating to their security responsibilities, controls, reporting, and roles and responsibilities with regard to cybersecurity. We also maintain controls and procedures that are designed to promptly escalate certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our Board of Directors in a timely manner. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective.


text: Although we have not been materially impacted by any cybersecurity incident to date, we have been and continue to be subject to cybersecurity threats in the normal course of our business, as discussed in Item 1A. Risk Factors, including in the risk factor entitled "We face continually evolving cybersecurity and other technology-related risks, which could result in the disclosure, theft, destruction, or misappropriation of, or access to, confidential information, disruption of our programming, damage to our brands and reputation, legal exposure and financial losses."


text: • Cybersecurity incident means an unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through a registrant's information systems that jeopardizes the confidentiality, integrity, or availability of a registrant's information systems or any information residing therein. • Cybersecurity threat means any potential unauthorized occurrence on or conducted through a registrant's information systems that may result in adverse effects on the confidentiality, integrity, or availability of a registrant's information systems or any information residing therein. • Information systems means electronic information resources, owned, or used by the registrant, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the registrant's information to maintain or support the registrant's operations.

companyName: Arq, Inc.

ticker: ARQ


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We engage third parties in connection with our risk assessment processes. We require each third-party service provider to adhere to our internal security policies and certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. These service providers are primarily overseen by our Vice President of Information Technology ("VP of IT") and assist us in monitoring and testing our safeguards, including execution of external penetration testing and ongoing real time vulnerability assessments through our extended detection and response processes to identify cybersecurity threats. We conduct risk assessments in the event of a material change in our business processes that may affect information systems that are vulnerable to such cybersecurity threats through our normal change control processes. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote resources and personnel, including our VP of IT, who reports to our VP of Finance, to manage the risk assessment and mitigation process.


text: As part of our overall risk management, we monitor and test our safeguards and train our employees on the importance of these safeguards. We maintain a formal information security awareness training program for all employees that includes training on matters such as phishing, email security best practices and data protection. Employees also receive random phishing tests at regular intervals to further assess and mitigate overall risk.


text: We maintain a cybersecurity incident response plan to help ensure a timely, consistent and compliant response to actual or attempted cybersecurity incidents impacting the Company. The Response Plan includes (1) detection, (2) analysis, which may include timely notice to our management and audit committee chair, (3) containment, (4) eradication, (5) recovery and (6) post-incident review. We also maintain cybersecurity insurance to manage potential liabilities resulting from specific cybersecurity incidents. It is important to note that although we maintain cybersecurity insurance, there can be no guarantee that our insurance coverage limits will protect us against any future claims or that such insurance proceeds will be paid to us in a timely manner.


text: To date there have been no cybersecurity incidents that have materially affected the Company or its operations. Despite security measures we have implemented, there is always the risk that certain cybersecurity incidents could materially disrupt operational systems limiting our ability to manufacture and deliver products to customers.


text: Our VP of IT has approximately five years of experience in cybersecurity and oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our VP of IT is primarily responsible for assessing and managing our material risks from cybersecurity threats, including monitoring and assessing strategic risk exposure.


text: While management is responsible for the day-to-day management of cybersecurity policies and procedures, our audit committee is tasked with oversight of our risk management process, which includes risks from cybersecurity threats. The processes by which our audit committee is informed about and monitors the Company's strategy regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following:


text: Our VP of IT provides quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, emerging threats and updates, cybersecurity systems testing, activities of third parties, and the like. Our audit committee and VP of IT provide regular updates to the board of directors on such reports. In the event of an actual cybersecurity threat or incident, management is notified in accordance with the cybersecurity response plan above.


text: • Cybersecurity incident means an unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through the Company's information systems that jeopardizes the confidentiality, integrity, or availability of the Company's information systems or any information residing therein. • Cybersecurity threat means any potential unauthorized occurrence on or conducted through the Company's information systems that may result in adverse effects on the confidentiality, integrity, or availability of the Company's information systems or any information residing therein. • Information systems means electronic information resources, owned, or used by the Company, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the Company's information to maintain or support the registrant's operations.


text: We engage third parties in connection with our risk assessment processes. We require each third-party service provider to adhere to our internal security policies and certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our systems. These service providers are primarily overseen by our Vice President of Information Technology ("VP of IT") and assist us in monitoring and testing our safeguards, including execution of external penetration testing and ongoing real time vulnerability assessments through our extended detection and response processes to identify cybersecurity threats. We conduct risk assessments in the event of a material change in our business processes that may affect information systems that are vulnerable to such cybersecurity threats through our normal change control processes. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote resources and personnel, including our VP of IT, who reports to our Chief Accounting Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management program, we monitor and test our safeguards and train our employees on the importance of these safeguards. We maintain a formal information security awareness training program for all employees that includes training on matters such as phishing, email security best practices and data protection. Employees also receive random phishing tests at regular intervals to further assess and mitigate overall risk.


text: We maintain a cybersecurity incident response plan to help ensure a timely, consistent and compliant response to actual or attempted cybersecurity incidents impacting the Company. The response plan includes (1) detection, (2) analysis, which may include timely notice to our management and audit committee chair, (3) containment, (4) eradication, (5) recovery and (6) post-incident review. Annually, we execute a tabletop exercise to test our incident response plan documentation and process execution. We also maintain cybersecurity insurance to manage potential liabilities resulting from specific cybersecurity incidents. It is important to note that although we maintain cybersecurity insurance, there can be no guarantee that our insurance coverage limits will protect us against any future claims or that such insurance proceeds will be paid to us in a timely manner.


text: Our VP of IT has more than six years of experience in cybersecurity and oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our VP of IT is primarily responsible for assessing and managing our material risks from cybersecurity threats, including monitoring and assessing strategic risk exposure.


text: While management is responsible for the day-to-day management of cybersecurity policies and procedures, the audit committee of our Board is tasked with oversight of our risk management process, which includes risks from cybersecurity threats.


text: Our VP of IT provides quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, emerging threats and updates, cybersecurity systems testing, activities of third parties, and the like. Our audit committee and VP of IT provide regular updates to the Board on such reports. In the event of an actual cybersecurity threat or incident, management and the audit committee are notified in accordance with the Company's cybersecurity response plan detailed above.


text: We face significant and persistent cybersecurity risks due primarily to: the substantial level of harm that could occur to us and our customers were we to suffer impacts of a material cybersecurity incident; and our use of third-party products, services and components. We are committed to maintaining strong governance and oversight of these risks and to implementing mechanisms, controls, technologies and processes designed to help us assess, identify and manage these risks. While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate unauthorized attempts and attacks against our network, products and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our products and services; however, we remain potentially vulnerable to known or unknown threats.

companyName: KonaTel, Inc.

ticker: KTEL


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies and other processes to assess, identify and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is assessed periodically by independent third parties. We have processes in place to assess, identify, manage and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business, and have processes to assess those issues for potential cybersecurity impact or risk. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including maintaining an effective security management program and abiding by information handling and asset management requirements. We have an escalation process in place to inform senior management and the Board of Directors of these material issues.


text: is a shell company with no business operations. Our sole business activity has been to seek a merger with a suitable operating company.

companyName: Signature Holdings Corp


text: Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our Board of Directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We consistently evaluate risks from potential cybersecurity threats, monitor our information systems for potential vulnerabilities and test these systems according to industry best practices. We have not encountered any cybersecurity incidents.


text: We face significant and persistent cybersecurity risks due primarily to (i) the substantial level of harm that could occur to us and our customers were we to suffer impacts of a material cybersecurity incident; and (ii) our use of third-party products, services and components. We are committed to maintaining strong governance and oversight of these risks and to implementing mechanisms, controls, technologies and processes designed to help us assess, identify and manage these risks. While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate unauthorized attempts and attacks against our network, products and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our products and services; however, we remain potentially vulnerable to known or unknown threats.


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies and other processes to assess, identify and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is assessed periodically by independent third parties. We have processes in place to assess, identify, manage and address material cybersecurity threats and incidents. These include, among other things: (i) annual and ongoing security awareness training for employees; (ii) mechanisms to detect and monitor unusual network activity; and (iii) containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business, and have processes to assess those issues for potential cybersecurity impact or risk. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including maintaining an effective security management program and abiding by information handling and asset management requirements. We have an escalation process in place to inform our senior management and our Board of Directors of these material issues.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management program informed by and incorporating elements of recognized industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework. This program, which is integrated into our overall enterprise risk management strategy, is designed to identify, assess, and mitigate critical risks from cybersecurity threats. Our cybersecurity risk management program is overseen by our Chief Technology Officer and is supported by a third-party information technology vendor who, as appropriate, helps to assess our cybersecurity program against industry standards. Our cybersecurity program includes safeguards such as firewalls, DDoS mitigation tools, data encryption technologies, and authentication controls such as multi-factor authentication. We monitor our cybersecurity posture through periodic risk assessments and external audits, which are reviewed primarily by our Chief Technology Officers and others as needed and incorporated into our overall enterprise cyber strategy and risk management program. Additionally, we have adopted an incident response plan which has been designed to identify and manage significant events that may impact our information technology infrastructure, including those arising from or related to cybersecurity threats.

companyName: Doximity, Inc.

ticker: DOCS


text: We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, such as those that may have access to restricted systems and data, including through review of System and Organization Controls (SOC) reports prior to onboarding. As appropriate, we also include contractual requirements regarding cybersecurity practices in third-party contracts.


text: We have a security awareness training program, required for all employees and contractors upon onboarding and on an annual basis thereafter, that is designed to raise awareness of cybersecurity threats across functions as well as to encourage consideration of cybersecurity risks across our Company. As part of this employee training program, we periodically conduct phishing simulations designed to raise employee awareness of such risks.


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could affect our information or systems. For more information, see "Risk Factors—Risks Related to Our Business—If our security measures are compromised now or in the future, or the security, confidentiality, integrity, or availability of our information technology, software, services, communications, or data is compromised, limited, or fails, this could have a material adverse effect on our business, financial condition, and results of operations."


text: Governance Related to Cybersecurity Risks Our Chief Technology Officer is responsible for the establishment and maintenance of our cybersecurity risk management processes, including the day-to-day oversight of the assessment and management of cybersecurity risks. Our Chief Technology Officer has over 15 years of experience in software development and security architecture. Our Chief Technology Officer provides reports to and meets periodically with our General Counsel to discuss and review our information security and cybersecurity risk management processes.


text: Our Board of Directors has delegated oversight of the Company's enterprise risk management processes, including those related to cybersecurity risks, to the audit committee of the Board of Directors (the "Audit Committee"). Our General Counsel, following consultation with our Chief Technology Officer, provides updates to the Audit Committee concerning our cybersecurity program at its regular meetings, and the General Counsel and Chief Technology Officer provide a deeper review of the cybersecurity program, including information concerning areas of potential critical risk, to the Audit Committee approximately annually. The chair of the Audit Committee provides an overview of these updates to the Board following these sessions. In addition, the management team would escalate awareness of any material incidents to the Audit Committee promptly, should such an event occur.


text: Governance Related to Cybersecurity Risks Our Chief Technology Officer, with over 15 years of experience in software development and security architecture, is responsible for the establishment and maintenance of our cybersecurity risk management processes, including the day-to-day oversight of the assessment and management of cybersecurity risks. Our Chief Technology Officer provides reports to and meets periodically with our General Counsel to discuss and review our information security and cybersecurity risk management processes.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program, in conjunction with the Company's enterprise risk management assessment processes, addresses cybersecurity risks to the corporate information technology ("IT") environment including systems, hardware, software, data, people, and processes.

companyName: Skye Bioscience, Inc.

ticker: SKYE


text: The underlying processes and controls of our cyber risk management program are designed based on standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). Skye has an annual assessment performed by a third-party specialist of its cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes significant cyber risks. In addition, the Company, in conjunction with the third-party cyber risk management specialists develop a risk mitigation plan to address identified risks and, where necessary, remediate potential issues identified through the annual assessment process.


text: In addition, we maintain an information security policy that covers safeguarding and managing confidential information, handling personal and company-sensitive data, managing access on/off-boarding and user accounts, acceptable use and IT change management to help govern the processes put in place by management designed to protect Skye's IT assets, data, and services from threats and vulnerabilities. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise. We and our cybersecurity partners maintain an IT assets inventory, identity access management controls including restricted access of privileged accounts, physical security measures at Company facilities, information protection/detection systems including maintenance of firewalls and anti-malware tools, network and data traffic monitoring and automated alerting, capacity management, industry-standard encryption protocols, formalized change management processes, critical data backups infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.


text: Our management team is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our management team has experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by Skye for strategic cyber risk management, advisory and decision making.