text: Our Chief Legal Officer and our security governance steering committee oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Chief Legal Officer and our management committee on cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through their work overseeing, working with, and delegating daily operations to the IT/IS team, as well as their work developing and implementing information security policies, consistent with the IT/IS processes. These policies are reviewed at least annually with updates authorized and approved by the security governance steering committee.


text: Our Chief Legal Officer and representatives from our security governance steering committee provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our Chief Legal Officer and representatives from our security governance steering committee provide annual briefings to the board of directors on cybersecurity risks and activities.

companyName: Lexeo Therapeutics, Inc.

ticker: LXEO

secItem: Item 1C


text: Risk Management and Strategy Our cybersecurity risk management and strategy program consist of cybersecurity-related policies and procedures, industry standard technology solutions including antivirus, firewalls and monitoring tools, awareness training for all employees, periodic testing, insurance coverage and a cybersecurity incident response plan. We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature (Information Systems and Data).

companyName: Artiva Biotherapeutics, Inc.

ticker: ARTV


text: Our information security function helps identify, assess and manage the Company's cybersecurity threats and risks, as well as identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example using manual tools, conducting scans of the threat environment, evaluating our industry's risk profile, evaluating threats reported to us, conducting internal and external audits, and conducting threat assessments for both internal and external threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example maintaining an incident response plan and policies, maintaining disaster recovery and business continuity plans, conducting risk assessments, encrypting certain data, maintaining network security controls, segregating data, maintaining access controls, monitoring systems, conducting periodic employee training, penetration testing, asset management tracking and disposal, physical security measures, and physical security controls.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) Cybersecurity risk is addressed as a component of the Company's enterprise risk management program;(2) The security administrator works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact on our business; (3) Our management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk; and (4) We have a cybersecurity incident response plan to identify, assess, respond to, and inform escalating levels of management based on the nature and severity of such incidents.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers. We also use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations. We assess and manage cybersecurity risks associated with our use of these providers by obtaining third party reporting relating to reputation and litigation screening for these vendors.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see the section titled "Risk Factors" in Part I. Item 1A of this Annual Report on Form 10-K, including the risk factor titled "—Our internal computer systems, or those used by our CROs or other contractors or consultants, may fail or experience security breaches or other unauthorized or improper access."


text: The audit committee of our board of directors is responsible for oversight the Company's cybersecurity risk, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our information security and legal functions. Our head of information technology is responsible for integrating cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, reviewing security assessments and other security-related reports, and retaining assessors, consultants, auditors, or third parties in connection with the company's cybersecurity program. Although we design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This means that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. It does not, however, mean that we meet any technical standards, specifications, or requirements.


text: Our cybersecurity incident response policy and plans are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. The Director of Information Technology (IT) works with the Company's incident response team, which consists of members of IT, legal, compliance, human resources, and others as applicable) to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy and plans include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation. As we become more dependent on information technologies to conduct our operations, cyber incidents, including deliberate attacks and attempts to gain unauthorized access to computer systems and networks, may increase in frequency and sophistication. These threats pose a risk to the security of our systems and networks, the confidentiality and the availability and integrity of our data and these risks apply both to us, and to third parties on whose systems we rely for the conduct of our business. Because the techniques used to obtain unauthorized access, disable, or degrade service or sabotage systems change frequently and often are not recognized until launched against a target, we and our partners may be unable to anticipate these techniques or to implement adequate preventative measures. Further, we do not have any control over the operations of the facilities or technology of our cloud and service providers, including any third-party vendors that collect, process and store personal data on our behalf. Our systems, servers, and platforms and those of our service providers may be vulnerable to computer viruses or physical or electronic break-ins that our or their security measures may not detect. Individuals able to circumvent such security measures may misappropriate our confidential or proprietary information, disrupt our operations, damage our computers, or otherwise impair our reputation and business. We may need to expend significant resources and make significant investment to protect against security breaches or to mitigate the impact of any such breaches. There can be no assurance that we or our third-party providers will be successful in preventing cyber attacks or successfully mitigating their effects. To the extent that any disruption or security breach were to result in a loss of, or damage to, our data or applications, or inappropriate disclosure of confidential or proprietary information, we could incur liability, and the further development and commercialization of our future product candidates could be delayed.


text: We develop and maintain a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. The program is one component of our enterprise risk management system. The technical, administrative and physical controls underlying our program are based on nationally recognized practices and standards for cybersecurity.

companyName: Insight Molecular Diagnostics Inc.

ticker: IMDX


text: Trusted partners are an important part of our cyber risk management program. We partner with leading cybersecurity advisors and service providers to conduct periodic risk assessments and to monitor and maintain the performance and effectiveness of security controls used in our environment.


text: In addition, we maintain processes to assess and manage risks relating to third-party service providers, including based on the nature of the engagement with the third party and based on the information and information systems to which the third party will have access. We conduct due diligence before onboarding new service providers and maintain ongoing evaluations to ensure compliance with our security standards.


text: The Audit Committee of the Board of Directors (the "Audit Committee") oversees our management of enterprise risks, including cybersecurity risks. Members of the management team, including our IT director and General Counsel, brief the Audit Committee on the effectiveness of risk management efforts on at least a semi-annual basis. In addition, these risks are reviewed by the Board of Directors at least annually.


text: Our cyber risk management program helps mitigate risks that could have a material adverse effect on our business, financial condition, results or operations, cash flows or reputation. See "Risk Factors – Risks Related to Our Business Operations – Security breaches and other disruptions could compromise our information and expose us to liability, and could cause our business and reputation to suffer."


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: Audax Credit BDC Inc.


text: Board Oversight of Cybersecurity Risks The Board of Directors of the Company provides oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO") regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. Members of Company management possess relevant expertise in various disciplines that are key to effectively managing such risks, such as advanced degrees in business administration and legal studies, industry certifications focused on financial services and information technology, including information security, as well as extensive industry experience. Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: Risk Management and Strategy We are planning to establish an appropriate confidentiality framework and document management system in order to safeguard sensitive information in addition to the safeguards provided by our third-party service providers. Such confidentiality framework may include the use of third-party information technology experts to manage and oversee our sensitive information and to work directly with our management in overseeing cybersecurity risks and appropriate responses thereto. In addition, we plan to consult with outside advisors and experts, when appropriate, to assist with assessing and identifying cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.

companyName: PALISADE BIO, INC.

ticker: PALI


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of IT Operations and Security and Principal Accounting Officer.

companyName: Bolt Biotherapeutics, Inc.

ticker: BOLT


text: Our Director of IT Operations and Security is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, reviewing security assessments and other security-related reports, and communicating key priorities to relevant personnel. For example, our Director of IT Operations and Security holds a Master of Science in information security and assurance, holds relevant certifications such as Certified Ethical Hacker, Computer Hacking Forensics Investigator, Security+ and Network+, and has worked for approximately nine years in the field of cybersecurity. Our Principal Accounting Officer is responsible for helping prepare budgets, helping prepare for cybersecurity incidents, and approving certain cybersecurity processes.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Principal Accounting Officer. Our Principal Accounting Officer receives regular reports on the status of our cybersecurity measures, and works with the Company's incident response team in an effort to help the Company mitigate and remediate cybersecurity incidents of which they are notified, and to assess and determine materiality for reporting purposes.


text: The audit committee receives periodic written and verbal reports from our Principal Accounting Officer and directly from the information technology department concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented that are intended to address them. The audit committee also receives from the Director of IT Operations and Security various written reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: The members of senior management involved in managing our material risks from cybersecurity threats, including our Chief Technology Officer, Chief Information Security Officer, Cybersecurity Operations Director, Chief Financial Officer and General Counsel and Corporate Secretary are experienced in data security matters and financial reporting matters. Our Chief Information Security Officer has more than 20 years of experience in information technology and has served in multiple technology executive roles, including security-compliance-related roles and holds a degree in Computer Information Systems from Harding University. Our Chief Technology Officer holds a computer science degree and Master of Engineering in Computer Science from Massachusetts Institute of Technology and has held engineering roles in multiple financial technology companies. Our Cybersecurity Operations Director holds a Master of Science degree in computer engineering as well as a Master of Science degree in information assurance, both from Iowa State University. He has led the security operations centers for large, global data management software company, as well as a large payment processing company. Additionally, he has led audits and penetration tests as the senior manager of a consulting company. Prior to entering into the private sector, he served as a police officer where he was a detective, specializing in computer crimes and forensics. Our Chief Financial Officer has over 10 years of experience in financial statement reporting and auditing. Our General Counsel has significant experience advising on cybersecurity matters and data protection matters and building out cybersecurity and data privacy compliance program across retail-facing business lines in the financial services industry.

companyName: Bitcoin Depot Inc.

ticker: BTM


text: Our Director of Information Technology, assisted by our managed information technology service provider and other third party service providers, leads the Company's cybersecurity risk management processes. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods in certain contexts, including, manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing threat intelligence reports and feeds, conducting scans of certain environments, and other tests.

companyName: Larimar Therapeutics, Inc.

ticker: LRMR


text: We have processes designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Vice President Legal and Compliance, Vice President Finance and Administration, Vice President - Controller, Chief Financial Officer and Director of Information Technology. In addition, the Company's incident response policy includes a process for reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: Our cybersecurity procedures are comprised of a variety of tools designed to protect our data and information technology systems, including but not limited to endpoint protection and network security measures, that are supported by our third-party service providers. We also have a process to require our employees to undergo cybersecurity awareness training. Further, we have a process to review risks to our company in connection with certain third-party providers and vendors, as appropriate.

companyName: Aura Biosciences, Inc.

ticker: AURA


text: Cybersecurity Governance Our cybersecurity program is managed and directed by our Head of Information Technology, or IT, who has nearly thirty years of experience in information technology and information systems management. Our Head of IT reports to our Chief Legal Officer and Secretary. Our Cybersecurity Governance Team, which is made up of representatives from across the organization, is responsible for oversight of cybersecurity risks and addressing potential cybersecurity risks to business programs, employees, clients, vendors and partners.


text: In the ordinary course of our business, we use, store, and transmit confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to help assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a third-party information technology vendor, which is overseen by our Senior Vice President of Business Operations, and include mechanisms, controls, technologies, systems, and other processes designed to help prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and help maintain a stable information technology environment. For example, we conduct vulnerability and data penetration testing, regularly review third party audits of our cloud-based technology vendors and perform ongoing regular risk assessments. We also conduct periodic employee training on cyber and information security, among other topics. In addition, to our third-party information technology vendor, we also consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to help anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: ATOSSA THERAPEUTICS, INC.

ticker: ATOS


text: Our Senior Vice President of Business Operations who reports directly to the Chief Executive Officer and has over eight years of experience managing information technology and cybersecurity matters, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in "PART I, ITEM 1A, RISK FACTORS," under the heading "If we experience a significant disruption in our information technology systems or breaches of data security, our business could be adversely affected."


text: The Board of Directors, as a whole, has oversight for the most significant risks facing us and for our processes to help identify, prioritize, assess, manage, and mitigate those risks. The Board receives at least quarterly updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President of Business Operations as well as other members of the senior leadership team.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to participants in preclinical studies and clinical trials involving certain of our product candidates (Information Systems and Data).

companyName: Climb Bio, Inc.

ticker: CLYM


text: We manage, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: through the use of automated tools, including but not limited to tools for monitoring, remote wiping, threat detection, intrusion detection and prevention; conducting ( through third parties) regular audits and threat assessments for internal and external threats; subscribing to reports and services that identify cybersecurity threats; analyzing reports of threats and actors; conducting vulnerability assessments to identify vulnerabilities; evaluating our and our industry's risk profile; and evaluating threats reported to us.


text: We, like other companies in our industry, face cybersecurity risks in connection with our business. However, to date, risks from cybersecurity threats have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations, and financial condition. For more information on our cybersecurity related risks, see "Risk Factors" under Part I, Item 1A of this Annual Report on Form 10-K.


text: Our management team provides periodic updates to the audit committee regarding our cybersecurity program, including information about cyber risk management governance and status updates on various projects intended to enhance the overall cybersecurity posture of the Company. Our chief operating officer, with the assistance of third-party technical advisors, leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help the Company and our employees to address cybersecurity risks. Our third-party technical advisors include consultants with over 20 years of experience in IT leadership as well as subject matter experts in cybersecurity that have extensive experience managing cybersecurity programs.


text: Our internal cybersecurity professional reports to our CEO and is responsible for assessing and managing our material risks from cybersecurity threats. The CEO is supported by our Chief Legal Officer in exercising primary oversight for our overall cybersecurity risk management program.

companyName: AN2 Therapeutics, Inc.

ticker: ANTX


text: The Company has a cybersecurity strategy designed to protect our information systems and data from an evolving cyber-threat landscape. Our cybersecurity program, administered by the Company's Senior Network Administrator and overseen by the Audit and Compliance Committee, has the support of executive leadership and the Board of Directors, and the Company continues to invest in cybersecurity to protect the Company's systems.

companyName: TENAX THERAPEUTICS, INC.

ticker: TENX


text: Our cybersecurity program focuses on all areas of our business, including cloud-based environments, devices used by employees and contractors, facilities, networks, applications, vendors, disaster recovery, business continuity and controls and safeguards enabled through business processes and tools. We continuously monitor for threats and unauthorized access. We learn of security threats through automated detection solutions as well as reports from users and business partners. We draw on the knowledge and insight of external cybersecurity experts and vendors and employ an array of third-party tools to secure our information infrastructure and protect systems and information from unauthorized access.


text: As of the date of this Annual Report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For more information on our cybersecurity related risks, see "Risk Factors - Risks Related to Our Industry" included elsewhere in this Annual Report on Form 10-K.


text: Our cybersecurity risk management process is an integral part of our overall enterprise risk management framework. This process, overseen by our Information Technology ("IT") Director, aims to assess, identify, and manage material risks from cybersecurity threats. Our approach is designed to protect the confidentiality, integrity, and availability of our critical information systems and data, including intellectual property and confidential information.

companyName: GCT Semiconductor Holding, Inc.

ticker: GCTS


text: We conduct periodic risk assessments to identify potential internal and external cybersecurity threats. These assessments evaluate the likelihood of the occurrence and potential impact of such threats, as well as the adequacy of our existing policies, procedures, systems, and controls.


text: The Board oversees our cybersecurity risk management process, and the Audit Committee has the authority and power to provide specific oversight of cybersecurity matters. Our IT Director who has extensive experience in information systems and cybersecurity, leads our cybersecurity strategy, policy, standards, architecture, and processes. The IT Director reports to the Chief Financial Officer ("CFO"). The CFO provides regular updates to the Board, Audit Committee, and executive management on the status of our cybersecurity posture and any material threats.


text: Our cybersecurity program employs industry-standard methodologies to manage cybersecurity risks, including secure network infrastructure design, continuous security updates, and automated alerts for suspicious activities. We also conduct regular training for employees at all levels on cybersecurity awareness and the protection of confidential information.


text: In the event of a cybersecurity incident, our incident response process is designed to detect, respond to, and mitigate the impact. Significant incidents are escalated to a team of business leaders, including our Chief Executive Officer, and Chief Financial Officer, who work with our incident response team to assess and address the situation. The Audit Committee oversees management's response to significant incidents and ensures compliance with disclosure requirements.


text: To maintain high security standards, we leverage third-party tools and services that adhere to industry best practices, including multi-layer authentication. Despite our efforts, we acknowledge that cybersecurity threats are constantly evolving, and we remain vigilant in our efforts to protect our information systems and data.


text: As of December 31, 2024, we have not identified any cybersecurity threats that have materially affected our business strategy, results of operations, or financial condition. However, we recognize that future incidents could have a material adverse effect on our business, financial condition, results of operations, cash flows, or reputation.


text: For further discussion of cybersecurity risks, please refer to the "Risk Factors" section under the heading "General Risks Related to the Company."


text: JFG's Chief Information Security Officer ("CISO") and his Global Information Security team ("GIS") oversee JFG's cybersecurity program and exercise overall responsibility for the strategic vision, design, development and implementation of, and adherence to, the program's protocols. The comprehensive program includes policies and procedures designed to protect JFG systems, operations, and the data entrusted to it, from anticipated threats or hazards. The program applies seven layers of controls: governance, identification, protection, detection, response, recovery, and third-party vendor management. The CISO reviews the cybersecurity framework annually as well as on an event-driven basis, as necessary, and reviews the scope of cybersecurity measures periodically, including to accommodate changes in business practices that may implicate security-related issues. Protective measures, where appropriate, include, but are not limited to, physical and digital access controls, software security and patch management, identity verification, mobile device management, data loss prevention solutions, employee cybersecurity awareness communications and best practices training programs, security baselines and tools to detect and report anomalous activity, service provider risk assessments, network monitoring, hardware and software, and data erasure and media disposal. Measures, policies and standards are aligned with industry-leading frameworks, such as those promulgated by the International Organization for Standardization and the National Institute of Standards and Technology ("NIST").

companyName: Senior Credit Investments, LLC


text: JFG tests its cybersecurity defenses regularly through automated vulnerability scanning to identify and remediate critical vulnerabilities. In addition, an independent vendor conducts annual penetration tests to validate its external security posture. For certain JFG businesses, JFG also conducts cyber incident tabletop exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Tabletop exercises are conducted by JFG's IT Risk team in collaboration with outside service providers as appropriate and members of JFG's senior management and Legal and Compliance teams. Learnings from these tabletop exercises and any events that JFG experiences are reviewed, discussed, and incorporated into its cybersecurity risk management processes as appropriate. In addition to JFG's internal exercises to test aspects of its cybersecurity program, JFG annually engages an independent third party to assess information system risks and the maturity of our cyber security program. The independent third party assesses the cybersecurity program against the Cyber Risk Institute Cyber Profile, a financial sector-focused framework based on the NIST Cybersecurity Framework, the results of which are reported to the JFG Board of Directors (the "JFG Board") and inform JFG's program.


text: JFG employs a process designed to periodically assess the cybersecurity risks associated with the engagement of third-party vendors and service providers. This assessment is conducted on the basis of, among other factors, the types of products or services provided and the extent and type of data accessed or processed by the third party.


text: The JFG Board's Risk and Liquidity Oversight Committee oversees JFG's enterprise risk management. Oversight includes reviewing and approving annually JFG's risk management framework and overarching risk appetite statements; reviewing JFG's technology, cybersecurity and privacy risk, legal and regulatory risk, and reputational risk, among other JFG major risk exposures; reviewing the steps management has taken to monitor and control such exposures; and reviewing JFG's capital, liquidity and funding against established risk methodologies. The CISO keeps the JFG Board informed about JFG's security posture and cybersecurity maturity program on a regular basis, providing updates about cybersecurity events, significant incidents, and new initiatives.


text: J FG's Chief Information Security Officer ("CISO") and his Global Information Security team ("GIS") oversee JFG's cybersecurity program and exercise overall responsibility for the strategic vision, design, development and implementation of, and adherence to, the program's protocols. The comprehensive program includes policies and procedures designed to protect JFG systems, operations, and the data entrusted to it, from anticipated threats or hazards. The program applies seven layers of controls: governance, identification, protection, detection, response, recovery, and third-party vendor management. The CISO reviews the cybersecurity framework annually as well as on an event-driven basis, as necessary, and reviews the scope of cybersecurity measures periodically, including to accommodate changes in business practices that may implicate security-related issues. Protective measures, where appropriate, include, but are not limited to, physical and digital access controls, software security and patch management, identity verification, mobile device management, data loss prevention solutions, employee cybersecurity awareness communications and best practices training programs, security baselines and tools to detect and report anomalous activity, service provider risk assessments, network monitoring, hardware and software, and data erasure and media disposal. Measures, policies and standards are aligned with industry-leading frameworks, such as those promulgated by the International Organization for Standardization and the National Institute of Standards and Technology ("NIST").

companyName: Jefferies Credit Partners BDC Inc.


text: We recognize the importance of identifying, assessing and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Arcadia Biosciences, Inc.

ticker: RKDA


text: We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our results of operations and financial condition, under the heading "Arcadia's business is subject to the risks of security breaches, including cybersecurity incidents." in Item 1A, "Risk Factors" of Part I of this Report.


text: As of the date of this Report, we are no t aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. In addition, we have secured cyber insurance coverage, and we plan to regularly review our coverage to align with the evolving nature of cyber threats and industry standards. For more information, see the section titled "Risk Factors— Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our security, which could materially affect our results." in Part I. Item 1A. of this Annual Report on Form 10-K.

companyName: PRECISION BIOSCIENCES INC

ticker: DTIL


text: Cybersecurity Governance Our board of directors considers cybersecurity risk part of its risk oversight function and has delegated to the audit committee of our board of directors (the "Audit Committee") oversight of cybersecurity and other information technology risks. The Audit Committee oversees our cybersecurity risk management program. The Audit Committee receives quarterly and, if necessary, ad-hoc reports from the Vice President of Operation & Information Technology and the Head of Information Technology on our cybersecurity and information technology risks, including data security incidents (material and those with lesser impact potential), annual risk assessments, risk identification and evaluation, and targeted remediation plans and related execution/delivery.


text: Our management team, including our Vice President of Operations and Information Technology and Head of Information Technology, has 19+ years of experience in cybersecurity and data risk administration, governance and technical operations, information technology enterprise architecture, and information technology management. The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity.


text: We design and assess our program based on the NIST 800-53 security, a framework recognized framework that demonstrates an organization's commitment to information security. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use NIST 800-53 1 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Metsera, Inc.


text: Our cybersecurity program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, programs, and our broader enterprise information technology environment; • a security program is in place for managing (i) our cybersecurity risk assessment processes, (ii) implementation and oversight of our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, implement and manage, or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for assessing and responding to cybersecurity incidents; • ad hoc internal review of the cybersecurity practices of key service providers based on our assessment of their criticality to our operations and respective risk profile; and • an Information Security risk management program that includes the risks within legal, quality, human resources, communications, clinical operations and financial teams pertaining to information security.


text: We have no t identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see Part I, Item 1A "Risk Factors— Our information technology systems, or those of any of our third-party service providers, may fail or suffer security incidents, breaches, or compromises and other disruptions, which could result in a material disruption of our development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function. The Board oversees management's implementation of our cybersecurity program.


text: The Board receives annual reports from management on our cybersecurity risks. In addition, management updates the Board, as appropriate, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: T he Board also receives briefings from management on our cybersecurity program. Board members receive presentations on cybersecurity topics from our Senior Director of Information and Cyber Security ("SDICS"), or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our SDICS, is responsible for assessing and managing our material risks from cybersecurity threats. The SDICS has primary responsibility for our overall cybersecurity risk management program and has over 25 years of experience leading cybersecurity programs across a variety of industries, including life sciences.


text: Our management team takes steps to be informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on its Chief Compliance Officer ("CCO") and the experience of risk management, legal, information technology, and compliance personnel of the Advisor when identifying and overseeing risks from cybersecurity threats associated with its use of such entities.

companyName: Kennedy Lewis Capital Co


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, and the CCO of the Advisor, manage the Company's cybersecurity program. The CCO is responsible for monitoring and reporting to the board about the Advisor's compliance with its responsibilities for the Advisor's and the Company's cybersecurity program. The CCO has been responsible for this oversight function as CCO to the Company since inception and has worked in the financial services industry for more than 30 years, during which time the CCO has gained experience in assessing and managing risk applicable to the Company.


text: Oversight of Board of Directors The board of directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats and oversees the Company's cybersecurity risk management activities. The board of directors receives updates on the Company's cybersecurity risks and protective measures periodically. Cybersecurity matters are reported to the board of directors so that the board of directors can effectively carry out their oversight role.

companyName: Global Self Storage, Inc.

ticker: SELF


text: Cybersecurity Program Overview The Advisor has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks applicable to the Company. The Advisor actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: Overland Advantage


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of information technology risk management, legal and compliance personnel of the Advisor, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters. The Board receives periodic updates from the Company's Chief Compliance Officer regarding the overall state of the Advisor's cybersecurity program, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's Chief Compliance Officer, is responsible for assessing and managing material risks from cybersecurity threats. The Chief Compliance Officer oversees the Company's risk management function generally and relies on the Chief Technology Officer of the Advisor to assist with assessing and managing material risks from cybersecurity threats. The Chief Technology Officer of the Advisor has over 26 years of experience in actively managing information technology programs, including cybersecurity, and is supported by an experienced team who assist with the cyber programs applicable to the Company. The Chief Compliance Officer has been responsible for this oversight function as Chief Compliance Officer to the Company for over one year and has worked in the financial services industry for over 32 years, during which the Chief Compliance Officer has gained expertise in assessing and managing risk applicable to the Company.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that is based on their respective risk profile and criticality to our business.

companyName: BEASLEY BROADCAST GROUP INC

ticker: BBGI


text: We have no t identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Risk Factor - "We are vulnerable to disruptions and security breaches of our information technology infrastructure and confidential information, which could cause material adverse effects on our business and reputation."


text: Our management team, including the Senior Vice President of Information Technology & Security and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes a Senior Vice President of Information Technology & Security with 20 years of experience in information technology and a General Counsel with 11 years of cybersecurity oversight responsibilities.


text: Cybersecurity Risk Management and Strategy We continuously monitor our information systems to assess, identify, and manage risks from vulnerabilities and assess cybersecurity threats. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process. We monitor risks through routine security assessments and implementation of enhancements to security measures used to protect our systems and data. We address system alerts on an ongoing basis. We maintain an Incident Response Plan Policy ("IRP") that sets forth processes we will follow to address incidents defined therein to include actual or reasonably suspected cyber incidents. Our information technology team promptly responds to system alerts and reported incidents that indicate the suspected presence of an incident and escalates in accordance with the IRP. The IRP, among other things, provides for a cross-functional team consisting of representatives from informational technology, risk management, legal, and communications, an Incident Response Team ("IRT"), that collaborates to quickly assess the impact, mitigate risks to information systems, and resolve incidents while improving information systems. Depending on the incident, we may utilize third-parties for assistance in investigating and addressing cybersecurity incidents.

companyName: Nkarta, Inc.

ticker: NKTX


text: We also utilize certain third-party service providers to perform a variety of critical business functions and recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. We have certain vendor management processes designed to help manage cybersecurity risks associated with our use of certain of these providers. Additionally, we strive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process.


text: We have not had cyber incidents that have materially affected our business or financial condition. For details about our risks associated with cybersecurity threats, see "—Computer system interruptions or security breaches of our information systems could significantly disrupt our product development programs and our ability to operate our business." in the section titled "Risk Factors" in Part I, Item 1A in this Annual Report on Form 10-K.


text: Governance Related to Cybersecurity Risks Management is responsible for identifying and assessing material risks for the business on an ongoing basis, including in relation to cybersecurity. As part of this process, our IRT is tasked with implementing and maintaining our cybersecurity programs, including establishing processes to ensure that potential cybersecurity risk exposures are monitored and putting in place appropriate mitigation measures. Our Chief Financial and Business Officer oversees our information technology department which monitors the prevention, detection, mitigation, and remediation of cyber incidents, if any, and reports all potential incidents and an initial assessment of such incident to the IRT. Our Chief Financial and Business Officer has over 7 years of experience with overseeing risk, compliance, and information technology functions.


text: The Information Technology ("IT") Department of the Company is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats. The Information Technology Department is managed by the Chief Information Officer (the "CIO") who reports directly to the Company's Chief Operating Officer and Chief Financial Officer. The CIO has more than 38 years of relevant experience both with the Company and with other organizations in the IT field. The CIO also oversees the Company's Information Security Program and manages a third-party consultant that is an expert in the Information Security field and acts as our Information Security Officer ("ISO"). The Information Security Program is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The IT Department conducts on-going technology and IT threat meetings to ensure the latest threats are addressed in addition to penetration, business continuity/ disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Company's management-level Information Technology and Information Security Committee ("IT/IS Committee"), and presents information security and cybersecurity updates on a monthly basis to the IT/IS Committee and periodically to the Board of Directors.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK


text: Cyber Risk Management and Strategy We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of the Investment Manager and other third-party service providers. The Investment Manager manages our day-to-day operations and has implemented the Investment Manager's Information Security Program ("ISP") that applies to the Company and its operations.

companyName: AB Commercial Real Estate Private Debt Fund, LLC


text: We rely on the digital technology of the Investment Manager to conduct our business operations and engage with our clients and business partners. The technology that our Investment Manager, clients, and business partners rely upon becomes more complex over time as do threats to our business operations from cyber intrusions, denial of service attacks, manipulation and other cyber misconduct. Information Security is an ongoing process of exercising due care that is designed to protect corporate, client and employee information and systems from unauthorized access, destruction, disclosure, disruption and modification of use.


text: Through a combination of security, risk and compliance resources, the Investment Manager implements information security through a dedicated ISP that is intended to identify, assess and manage material risks from cybersecurity threats applicable to the Company, and which includes a focus on safeguarding information and assets from cyber threats, engaging in cyber threat monitoring and responding to actual or potential cyber incidents. Our ISP is led by the Investment Manager's Chief Information Security Officer ("CISO") who actively partners with the Investment Manager's Chief Compliance Officer and Chief Risk Officer and, in turn, the Company's Board and Secretary. Ultimately, we rely on the Investment Manager's full enterprise risk framework, which includes the ISP, information technology, business continuity, resiliency and cybersecurity risk, in combination with a broader risk management team, including the Investment Manager's Chief Security Officer.


text: The Investment Manager's CISO, with assistance from internal and external resources, is responsible for implementing and providing oversight of the ISP that applies to the Company. The ISP employs a defense-in-depth strategy: an information assurance concept in which multiple layers of security controls are distributed throughout an operating environment. The concept manages risk with diverse defensive strategies, so that if one layer of defense fails, another layer of defense will attempt to compensate. The ISP features cybersecurity policies, standards and guidelines, committee governance, training, access controls and data controls.


text: The ISP, together with related risk and compliance resources, is designed to proactively manage the risk of threat from cybersecurity incidents through (i) implementing protocols to take cybersecurity considerations into account in adopting and onboarding our technology resources, (ii) monitoring IT controls to better ensure compliance with cybersecurity and other related legal and regulatory requirements, (iii) assessing adherence by critical and material third parties we partner with to ensure that the appropriate risk management standards are met, (iv) ensuring essential business functions remain available during a business disruption, and (v) regularly developing and updating response plans to address potential IT or cyber incidents should they occur. The Investment Manager's security, risk and compliance resources are designed to prioritize IT and cybersecurity risk areas, identify solutions that minimize such risks, pursue optimal outcomes and maintain compliance standards. We also rely on the Investment Manager's ISP to maintain an operation security function that has a real time response capability that triages potential incidents and triggers impact mitigation protocols.


text: Additionally, we rely on the Investment Manager to utilize third parties to conduct periodic cybersecurity assessments, including assessments impacting the Company, and the Investment Manager's internal audit function includes certain cyber risk audits as part of any overall risk audit. We rely on the Investment Manager to review the recommendations and findings from those assessments and audits and implement corrective and other measures as appropriate and as may be relevant to the Company. The Investment Manager's cybersecurity processes rely predominantly on internal resources, but also include important third party resources for certain matters, including the aforementioned assessments as well as our continuous cybersecurity threat monitoring and initial incident reporting system.


text: As part of the ISP that is applicable to the Company, the Investment Manager also performs cyber risk assessments on the Company's critical and material third party vendors during onboarding and periodically thereafter.


text: During the reporting period, we have not had a cybersecurity incident that has materially affected, or was reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition, including as discussed in "Item 1A. Risk factors – A failure in cyber security systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning could impair our ability to conduct business effectively," although we do not currently believe that such a result is reasonably likely.


text: Cyber Risk Governance The Board provides strategic oversight over the Company generally, including oversight of risks associated with cybersecurity threats. The Investment Manager's CISO and the Company's Secretary periodically report to the Board on the status of the Investment Manager's ISP, cybersecurity risks, risk management policies and risk assessment initiatives. Such reports particularly emphasize any material risks concerning the Company.


text: The Secretary of the Company relies on the Investment Manager's Chief Compliance Officer to assist with assessing and managing material risks from cybersecurity threats. The Investment Manager's Chief Compliance Officer has 13 years of experience in the financial services industry, and during such time has acquired relevant experience overseeing and actively managing cybersecurity and information security programs for financial services companies with complex information systems. The Company's Secretary has been responsible for the general oversight function as Secretary to the Company since its inception and has worked in the financial services industry for 11 years.


text: Management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with ISP personnel of the Investment Manager.


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program, and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Adviser's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and are fully integrated into the Adviser's overall risk management processes. In general, the Adviser seeks to address material cybersecurity threats through a entity-wide approach that addresses the confidentiality, integrity, and availability of the Adviser's information systems or the information that the Adviser collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: TCW Direct Lending VII LLC


text: Cybersecurity Risk Management and Strategy The Adviser's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Adviser has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Adviser's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: The Adviser implements technical safeguards that are designed to protect the Adviser's information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as assistance from third party experts where necessary. • Incident Response and Recovery Planning: The Adviser has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Adviser's response to a cybersecurity incident. The Adviser conducts occasional tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Adviser maintains a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Adviser's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside consultants who advise on the Adviser's cybersecurity systems. • Education and Awareness: The Adviser provides regular, mandatory training for all levels of personnel regarding cybersecurity threats as a means to equip the Adviser's personnel with effective tools to address cybersecurity threats, and to communicate the Adviser's evolving information security policies, standards, processes, and practices.


text: The Adviser conducts periodic assessment and testing of its policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. This includes penetration testing of network infrastructure and phishing tests targeting the Adviser's employees. The results of such assessments and reviews are evaluated by management, and the Adviser adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments and reviews.


text: The Board receives annual updates and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by the Company'. The Board also receives prompt and timely information regarding any material cybersecurity risk, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Adviser discuss the Company's approach to overseeing cybersecurity threats.


text: The Adviser has established an internal working group that includes relevant representation from senior management including the CCO, COO and CISO who work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans.


text: Risk Management Strategy We have developed our cybersecurity risk management program, including a cybersecurity incident response plan, based on the National Institute of Standards and Technology Cybersecurity Framework's (NIST CSF) principles: Identify, Protect, Detect, Respond, and Recover. This does not, however, imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Boundless Bio, Inc.

ticker: BOLD


text: Our cybersecurity risk management program, which is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas, is intended to address current vulnerabilities and anticipate future cybersecurity threats and risks to our cyber ecosystem. Our cybersecurity risk management program includes: (a) assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; (b) a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; (c) the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; (d) cybersecurity awareness training of our employees, including our senior management, and incident response personnel; (e) a cybersecurity incident response process that includes procedures for responding to cybersecurity incidents; and (f) a risk evaluation of the service providers, suppliers, and vendors of critical systems during contracting.


text: As of the filing date of this report, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance, however, that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. For more information, see the section titled "Risk Factors—Risks Related to Our Business Operations and Industry— Our information technology systems, or those of any of our service providers, may fail or suffer security incidents and other disruptions, which could result in a material disruption of our ecDTx development programs, compromise sensitive information related to our business, or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to our audit committee oversight of cybersecurity and other information technology risks. Our audit committee oversees our management team's implementation of our cybersecurity risk management program, receives periodic reports from our management team on our cybersecurity risks, and receives reports from our management team, as necessary, regarding material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our audit committee reports to our board of directors regarding its activities, including those related to cybersecurity. Our board of directors also receives briefings from our management team on our cyber risk management program.


text: O ur management team is responsible for assessing and managing our material risks from cybersecurity threats, and has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We engage an external Head of Information Technology, or IT, consultant to work with the company, including the Chief Operating Officer, Chief Financial Officer, and Executive Leadership Team, to help identify, assess and manage the company's cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, and evaluating threats reported to us.

companyName: Equillium, Inc.

ticker: EQ


text: Our assessment and management of material risks from cybersecurity threats are integrated into the company's overall risk management processes. For example, the Head of IT works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as outsourced business critical functions, clinical research, professional services, Software-as-a-Service, or SaaS, platforms, managed services, cloud-based infrastructure, encryption and authentication technology, corporate productivity services, and other functions. We have certain vendor management processes to help manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, requiring their completion of written questionnaires regarding their services and data handling practices and conducting periodic re-assessments during their engagement.


text: Management is also responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the company's overall risk management strategy, and communicating key priorities to relevant personnel. The Head of IT and Chief Operating Officer are responsible for helping prepare the company for cybersecurity incidents, training personnel, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: The Board's Roles and Responsibilities The Board of Directors, as a whole and at the subcommittee level, oversees and monitors our cybersecurity risk, receiving regular updates from management on the status of our current cybersecurity risks, a prioritization of key risk areas to be mitigated, and any significant cyber incidents that have occurred or are reasonably likely to occur.

companyName: Third Harmonic Bio, Inc.


text: Since 2023, we have engaged in periodic formal cybersecurity risk assessments conducted by an expert third party. The findings from that formal assessment have informed our ongoing cybersecurity roadmap which is updated at least annually. The Audit Committee plays a key role by ensuring that the prioritization of the roadmap supports our business objectives, and by making decisions, when called upon, of whether specific cybersecurity risks should be mitigated or if that risk is acceptable to the business.


text: Risk Management and Strategy Information technology and the digital transformation of our assets and business processes are critical to our growth strategy. Inherent to information technology and digital transformation is the commensurate cybersecurity risk, which we manage by maintaining a cybersecurity program that is integrated into our overall risk management process.


text: Our cybersecurity program is overseen by our Director, IT Infrastructure & Cybersecurity and utilizes a risk-based methodology to support the confidentiality, integrity and availability of our digital assets. The cybersecurity program is supported at the highest level within the Company, formally reporting to the Audit Committee twice annually and more often if required.


text: As a part of the cybersecurity program, we conduct assessments, both internally and by independent third parties, to identify and prioritize the mitigation of cybersecurity risks. We also maintain a formal and mandatory cybersecurity awareness training program for all employees that includes annual training on information security best practices in high risk areas such as phishing and authentication. Additional role-based training is provided to finance team members, due to the elevated privilege and risk associated with their duties. All employees are also tested periodically for their cybersecurity awareness.


text: For our non-finance service providers, we are currently implementing cybersecurity controls, including but not limited to requiring all critical vendors to notify us should the vendor fall victim to, and become aware of a material cybersecurity incident, and reviewing any available SOC2 or similar compliance reports should they be available. Our vendor selection and management processes include the assessment of vendors' cybersecurity controls.


text: Although we have implemented a cybersecurity program designed to protect and preserve the confidentiality, integrity and availability of our information systems and assets, we also maintain cybersecurity insurance to manage potential liabilities resulting from specific cyber incidents. However, it is important to note that although we maintain cybersecurity insurance, there can be no guarantee that the insurance will cover us, wholly or partially, from potential liabilities, or that such insurance proceeds will be paid to us in a timely manner.


text: While we are not aware of any significant cybersecurity incidents that have occurred to date, we are exposed to, and may in future be adversely impacted by cyberattacks and interruptions to our information technology systems and infrastructure. Despite the security measures we have implemented, certain cyber incidents could materially disrupt our operational systems, and/or result in the loss of trade secrets, proprietary information, or competitively sensitive data.


text: Governance and Management's Responsibilities IT management is responsible for the cybersecurity program that assesses and manages cybersecurity risk. Specifically, our Director, IT Infrastructure & Cybersecurity is responsible for the prevention, mitigation, detection, and remediation of cybersecurity incidents while at the executive level, the Chief Administrative Officer oversees the program and is the executive sponsor.


text: Our Director, IT Infrastructure & Cybersecurity monitors cybersecurity incidents and does so by working closely with expert technology and security partners. We and our partners deploy a variety of technologies and processes, including but not limited to intrusion monitoring, detection and response, patch management, threat hunting, identity and access management, assessments, audits and tests.


text: Our Director, IT Infrastructure & Cybersecurity has relevant expertise in cybersecurity having spent the previous two years prior to joining the Company building a SOX compliant IT controls framework for a biotechnology company in preparation for its initial public offering. Prior to that, our Director, IT Infrastructure & Cybersecurity spent five years at a publicly traded pharmaceuticals company, where he was responsible for the SOX cybersecurity and compliance of systems, processes, and policies. In addition to SOX compliance, our Director, IT Infrastructure & Cybersecurity has extensive experience with other compliance frameworks, including National Institute of Standards and Technology (NIST), HIPAA, Clinical Laboratory Improvement Amendments (CLIA), and GxP security models.


text: Cybersecurity threats, including any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect us, including its business strategy, results of operations or financial condition.


text: Cybersecurity Risk Management and Strategy We have implemented a cybersecurity risk management program in accordance with our risk profile and business size that is informed by recognized industry standards, including elements of the National Institute of Standards and Technology Cybersecurity Framework and International Organization for Standardization 27001 Framework.

companyName: Septerna, Inc.

ticker: SEPN


text: Our cybersecurity risk management program is comprised of a number of components, including but not limited to written information security policies, external cybersecurity risk assessments, and system monitoring. We also have an employee privacy and data security training awareness program that includes cybersecurity risk awareness trainings and phishing campaigns. We maintain an incident response plan to help guide our response to cybersecurity incidents.


text: We leverage the cybersecurity services of third-party vendors, including a third-party managed services provider and IT consultants, to support our cybersecurity risk management program and assist us in conducting external cybersecurity risk assessments. As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors. As part of our vendor diligence process we require vendors with access to our information technology systems and infrastructure to complete information security program questionnaires.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats relating to our and our third-party vendors' information systems and infrastructure. For more information, please see "Item 1A, Risk Factors."


text: Governance Related to Cybersecurity Risks Our board of directors has delegated cybersecurity risk management to our Audit Committee as part of the Audit Committee's general risk oversight function. The Audit Committee, through the oversight of the General Administrative Leadership team, is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our General Administrative Leadership team, which consists of our CEO, CFO, COO, CPO, Vice President of Finance and Business, Vice President of Technology and our Head of Information Technology ("IT"), and is responsible for the strategic leadership of our cybersecurity risk management program. Our Head of IT, who also serves as our Information Security Officer, is responsible for the day-to-day management of our cybersecurity risk management program. The individual who is currently in this role has over thirty years of experience in information technology and cybersecurity risk management. Our Head of IT relies on both internal and external cybersecurity resources to manage and remain appraised of overall cybersecurity risks to our business and our industry.


text: The General Administrative Leadership team provides regular briefings regarding cybersecurity risk and related matters to our Audit Committee. Such briefings may include a discussion of cybersecurity risks and applicable risk assessments, key updates regarding our cyber strategy and related initiatives, and the emerging cybersecurity threats that may impact our business. We also provided the full board of directors with updates on matters relating to cybersecurity risk management, as necessary.


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. The Company has designed and implemented a cybersecurity incident response plan and related processes, which is overseen by an internal information technology specialist. Cybersecurity threats are identified and escalated to a member of management pursuant to criteria set forth in these processes.

companyName: Sow Good Inc.

ticker: SOWG


text: The audit committee of the board of directors (the "Audit Committee") is responsible for establishing and monitoring the integrity and effectiveness of controls and other procedures, which are designed to ensure that (1) all information required to be disclosed is recorded, processed, summarized, and reported accurately and on a timely basis, and (2) all such information is accumulated and communicated to management and the Company's board of directors, as appropriate, to allow for timely decisions regarding such disclosures. The controls and procedures subject to the Audit Committee's oversight include processes related to managing material risks from cybersecurity threats. Accordingly, the Company's cybersecurity processes have been integrated into the Company's overall processes.


text: The Audit Committee operates under a written charter adopted by the Company's board of directors. The Audit Committee oversees, among other things, a system of internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is also responsible for the adequacy and effectiveness of the Company's internal controls, including those internal controls that are designed to assess, identify, and manage material risks from cybersecurity threats.


text: The Audit Committee is informed of material risks, if any, from cybersecurity threats pursuant to escalation criteria set forth in the Company's disclosure controls and procedures. Further, at least once per quarter, a member of the Company's Audit Committee reports material risks, if any, from cybersecurity threats to the Company's board of directors. The Company's management team also assesses and manages material risks, if any, from cybersecurity threats.


text: The Audit Committee is responsible for establishing and monitoring the integrity and effectiveness of controls and other procedures, including controls and procedures related to managing material risks from cybersecurity threats, which are designed to ensure that (1) all information required to be disclosed is recorded, processed, summarized, and reported accurately and on a timely basis, and (2) all such information is accumulated and communicated to management and the Company's board of directors, as appropriate, to allow for timely decisions regarding such disclosures.


text: The Company's Information Technology Manager oversees the Company's incident response plan and related processes designed to assess and manage material risks, if any, from cybersecurity threats. The Information Technology Manager also coordinates with any consultants, auditors and other third parties to assess and manage material risks, if any, from cybersecurity threats.


text: The Company's Information Technology Manager is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes. The Company's Information Technology Manager is also informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to notification criteria set forth in the Company's contracts with third-party service providers. Further, the Company's Information Technology Manager is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to reports prepared by consultants, auditors, and other third parties retained by the Company, if necessary, to investigate cybersecurity incidents.


text: The Company's Information Technology Manager informs the Audit Committee of cybersecurity incidents that may be material pursuant to escalation criteria set forth in the Company's incident response plan and related processes.


text: The Company's Information Technology Manager or a delegate thereof also prepares a report for the Audit Committee and the Company's board of directors concerning material risks, if any, from cybersecurity threats at least once per quarter, and more often to the extent necessary pursuant to the escalation criteria set forth in the Company's processes described herein.


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information concerning risks related to cybersecurity, see Item 1A. Risk Factors.


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee’s overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third-party vendor, of the Trustee’s cyber risk management program.

companyName: CROSS TIMBERS ROYALTY TRUST

ticker: CRT


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust’s business, financial condition, results of operations, or cash flows. See Item 1A. Risk Factors – The Trust may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including " Our information technology systems, or those of our CROs, contractors, consultants, or other third parties with whom we work, may fail or suffer security breaches, loss or leakage of data, and other disruptions, which could result in a material disruption of our product candidates' development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business. "

companyName: CalciMedica, Inc.

ticker: CALC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Scientific Officer, President and Chief Operating Officer, Chief Financial Officer, Vice President Finance and General Counsel who also serves as our compliance officer. These members of management have prior work experience in various roles involving managing information security programs and are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a written data security incident response policy and a security incident response plan, which were first developed in 2017 and are periodically reviewed and updated.

companyName: LANDS' END, INC.

ticker: LE


text: We have designed and assessed our program using the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program includes: • a written data security incident response policy and a security incident response plan that include detailed procedures for responding to cybersecurity incidents, determining severity of cybersecurity incidents and notifying appropriate internal and external parties; • third-party and internal risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team consisting of members of our information technology department, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • periodic tabletop exercises involving the security team, the data security incident management team, and members of management, with special sessions for the Board of Directors; • annual audit by a Payment Card Industry ("PCI") qualified security risk assessor to validate our PCI-Data Security Standard ("PCI-DSS") compliance; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • regular cybersecurity awareness training, including social engineering and phishing testing of our employees, incident response personnel, and senior management; • deployment of external tools designed to detect and protect against spam, malware and other cybersecurity threats and train personnel; and • third-party security event monitoring.


text: The Audit Committee receives regular reports from management on our cybersecurity risks, which include updates on trends and threats, the Company's backup and restore systems, internal and external risk assessments, results of PCI and other security audits, and planned updates and upgrades. The Audit Committee also receives regular enterprise risk management updates, which include management of cybersecurity risks.


text: In accordance with our data security incident response plan, management is required to promptly update and discuss with the Audit Committee any material or potentially material cybersecurity incidents and provide an update to the Board upon determination that an incident is material. Management regularly updates the Audit Committee regarding incidents with lesser impact potential.


text: Our management team, including our Chief Financial Officer, Chief Technology Officer and General Counsel (the cybersecurity disclosure committee), is responsible for assessing material risks from cybersecurity threats and our General Counsel oversees any required reporting obligations and notifications. Our Chief Technology Officer has primary responsibility for overseeing our security incident response plan, including identification and initial assessment of threat levels and escalations.


text: Critical incidents are escalated to a cross functional data security incident management team for review, which then escalates potentially material incidents and threats to the cybersecurity disclosure committee for determinations of materiality and Audit Committee and Board communications. Our Chief Technology Officer has over 20 years of experience with cybersecurity management response, and multiple direct reports who have 10 or more years of experience leading technology infrastructure and security incident response. Our General Counsel has over eight years of experience leading our incident response management team.


text: As of the date of this report, we have not identified cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. We have a formalized incident response policy in place. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," of this Annual Report.

companyName: Acrivon Therapeutics, Inc.

ticker: ACRV


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could effect our information or systems. For more information, please see the section entitled "Risk Factors".

companyName: ALLURION TECHNOLOGIES, INC.

ticker: ALUR


text: Governance Related to Cybersecurity Risks Our cybersecurity risk management program is managed by our Information Security Management Committee (the "InfoSec Committee"). The InfoSec Committee is currently made up of a cross-disciplinary team, including the Company's acting Chief Information Security Officer (CISO), Chief Legal Officer, VP of People, Senior Director of R&D & Engineering, VP of Global Marketing, Medical Affairs and our Senior Corporate Counsel. The InfoSec Committee meets on a monthly basis to provide oversight of the Company's information security management system ("ISMS"), review the performance and effectiveness of the ISMS, and review and discuss the direction of the Company's cybersecurity program, among other responsibilities. The committee also performs an annual audit to ensure Allurion's ISMS is effectively implemented and maintained. Our acting CISO, who is also our VP of Software Engineering, is responsible for the day-to-day oversight of the assessment and management of our information security program and cybersecurity risks. The individual who is currently in this role has approximately 25 years of experience in information technology.


text: The Board also engages in oversight of cybersecurity risks. With the input of the InfoSec Committee, our CISO may provide periodic updates to the Board on matters related to cybersecurity as needed.