text: Our Board of Directors considers cybersecurity to be a business risk and oversees enterprise-wide risks through the Audit Committee. The Audit Committee is designated by the Board with the responsibility for monitoring and reporting on management's cybersecurity and risk management processes. The ERM Committee is the management-entity designated by the Chief Executive Officer with the responsibility to direct and execute our risk governance and strategy, including cyber risk. This ERM Committee is composed of the Company's Executive Vice Presidents and each of the Company's Senior Vice Presidents. Our Senior Vice President and Treasurer chairs the ERM Committee. The Vice President for Information Technology ("IT") leads the information security program, manages cyber governance and incident management. The Vice President of IT and the Director of Infrastructure and Security have over forty-five years of combined information technology experience and over a decade of cybersecurity experience. The ERM Committee and Vice President for IT assess cyber risk and provide recommendations for management. The Chair of the ERM Committee and the Vice President for IT brief the Audit Committee regularly. These updates include an overview of cyber risk management activities, cyber threats, and key information security processes and mitigation efforts. The Chair of the Audit Committee provides regular reports to the Board on critical cyber risk and security topics presented to the Audit Committee by management. In addition, informal and ad hoc conversations about cyber risk and industry developments frequently occur among Board members and management.


text: Incident Management We have implemented security procedures and measures in order to protect our information from theft, loss, damage or interruption from a number of potential sources or events. LSB maintains and tests an incident response plan that outlines steps for the containment, investigation of, response to and recovery from cybersecurity incidents. The plan also includes information pertaining to roles, responsibilities, and reporting process. This plan is a part of our formal, enterprise-wide crisis management process, which outlines a communication plan with executive leadership as well as guidelines for communication with the Board. During 2024, we did not experience a cybersecurity incident that resulted in a material adverse effect on our business strategy, results of operations, or financial condition; however, there can be no guarantee that we will not experience such an incident in the future. Although we make extensive efforts to maintain the security and integrity of our information systems and technology operations, these systems are subject to the cyber risk of incident or disruption, and there can be no assurance that our security safeguards, and those of our third-party providers, will prevent incidents to our or our third-party providers' systems that could adversely affect our business. For a discussion of these risks, see "Item 1A. Risk Factors—General Risk Factors."

companyName: LSB INDUSTRIES, INC.

ticker: LXU

secItem: Item 1C


text: The Board, through the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Audit Committee receives periodic presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee would also receive prompt and timely information regarding any cybersecurity incident that would meet the applicable established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least twice each year, the Audit Committee discusses the Company's approach to cybersecurity risk management with the Company's Chief Operating Officer.

companyName: Crinetics Pharmaceuticals, Inc.

ticker: CRNX


text: The Company's Chief Operating Officer is the member of the Company's executive management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Company's Chief Operating Officer has served in various roles in research and development, operations, portfolio management and compliance for over 30 years, including serving as a member of the executive leadership team and Sr. Vice President, Operations and Project and Portfolio Management at other companies. The Chief Operating Officer earned a Master's of Public Health (MPH) in biostatistics and epidemiology and a B.A. in psychology from the University of Oklahoma Health Sciences Center. He also earned a B.S. in nursing from the University of Kansas Medical Center.


text: The Company's Chief Operating Officer works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Chief Operating Officer and the IT Security Operations Team monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.


text: The Trust does not have a board of directors; therefore, the Trustee is responsible for oversight of the Trust’s risks from cybersecurity threats. The Trustee has dedicated personnel that are responsible for assessing and managing the Trust’s cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee’s information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. External partners are a key part of the Trustee’s cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.

companyName: SABINE ROYALTY TRUST

ticker: SBR


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee’s overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third party vendor, of the Trustee’s cyber risk management program.


text: Other, non-technical protocols include securing of documents and work areas that could contain personal, non-public information and independent verification of information changes by outside vendors.


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust’s business, financial condition, results of operations, or cash flows. See Item 1A. “Risk Factors – Business and Operational Risks – The Trustee may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.”


text: Risk Management and Strategy We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, mitigate or remediate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data includes confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also use systems and processes designed to reduce the impact of a security incident impacting our data at a third-party vendor or customer. Contracts with third-party vendors, who have access to our network or who hold or store personal information on our behalf, contain provisions requiring such vendors to maintain a program that meets our information security standards. We periodically assess risk of vendor compliance with our information security program requirements, including the obligation that our vendors must notify First Advantage within a designated time period upon identifying certain cybersecurity events. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions.

companyName: FIRST ADVANTAGE CORP

ticker: FA


text: As part of our incident detection and response processes, we have established internal teams to investigate and escalate notification of cybersecurity incidents. Pursuant to this process, cybersecurity incidents are reported to appropriate personnel within First Advantage (including the interim CISO, Chief Financial Officer, and Chief Legal Officer) and to the Audit Committee and Board of Directors based on incident materiality. We track incidents through resolution, conduct post-incident analysis and update our processes and procedures if areas for improvement are identified. On a monthly basis, a summary of prior period cybersecurity investigation escalations is reviewed by management, including our head of Internal Audit, our interim CISO, and our Chief Legal Officer. We maintain cybersecurity insurance, which provides coverage for certain costs related to cybersecurity incidents.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "Our business, brand, and reputation may be harmed as a result of security breaches, cyber-attacks, employee or other internal misconduct, computer viruses, or the mishandling of personal data" and should be read in conjunction with the information above."


text: We and Hess design and assess the program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we or Hess meet any particular technical standards, specifications or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our businesses.

companyName: Hess Midstream LP

ticker: HESM


text: The Company has not identified risks from known cybersecurity threats during the year ended December 31, 2024, including as a result of any prior cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Additional information about cybersecurity risks we face is discussed in Part I, Item 1A. Risk Factors, under the heading "Disruption, failure or cybersecurity attacks affecting or targeting information technology systems and infrastructure used by us, Hess or our business partners may materially impact our business and operations" which should be read in conjunction with the information above.


text: Material risks from cybersecurity threats are assessed and managed by a dedicated team comprised of internal and external IT professionals experienced in cybersecurity threat risk management, who ultimately report to our senior vice president, finance and accounting. Our senior vice president, finance and accounting has extensive operational and leadership experience overseeing accounting and finance functions at various organizations, including oversight of critical accounting and finance IT systems. Our senior IT consultant has over 20 years of experience with IT and cybersecurity risk management, having served in senior executive-level IT positions at multiple Fortune 500 companies and companies within the life sciences industry.

companyName: LeonaBio, Inc.

ticker: LONA


text: Our team of IT professionals, which continuously monitors our IT environment for cybersecurity threats and incidents, routinely reports on cybersecurity incident prevention, detection, mitigation, and remediation efforts to our senior vice president, finance and accounting and chief compliance officer. Additionally, we have established policies addressing processes for responding to potential cybersecurity incidents, including assessment, communication, and remediation protocols. Our incident response processes further provide for the escalation of cybersecurity incidents to our executive management team and board of directors, as appropriate.


text: Our cybersecurity program is overseen by a full-time security team led by our Chief Information Security Officer ("CISO"), reporting directly to our Chief Information Officer ("CIO"). Our CISO has over 20 years of experience in the field of cybersecurity, including prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CIO has over 18 years of experience as a Chief Information Officer, over 35 years of experience in the field of information technology and oversees the cybersecurity function.

companyName: Moelis & Co

ticker: MC


text: In today's digital world, protecting our systems and data from cyberattacks and unintentional or malicious breaches is a priority for our leadership and Board of Directors. Our cybersecurity team is overseen by our Senior Vice President and Chief Technology Officer, who is directly supported by our Vice President of IT and Station Operations and our Senior Director of IT Security and Compliance. This leadership team has decades of experience leading cybersecurity oversight and managing our organization's cybersecurity risks. Team members who support our information security program have relevant educational, industry experience, and technical certifications. The technical leadership team provides quarterly and annual cybersecurity updates to our Board of Directors, briefing the Board on our cyber program, industry trends and risks, and any incidents the Company has experienced. Directors with experience in cybersecurity and technology play crucial roles in strategy, innovation, and oversight of the Company's technology investments. The Board oversees our annual enterprise risk assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats.

companyName: TEGNA INC

ticker: TGNA


text: TEGNA uses the National Institute of Standards and Technology (NIST) Cybersecurity Framework and has clearly defined policies and standards for all employees and technical systems. We use external subject matter experts to provide independent assessments of the cybersecurity program. Following the NIST Cybersecurity Framework, TEGNA utilizes internal reporting, policies, software, training programs, secure software development coding practices and hardware solutions to protect and monitor our environment, including multifactor authentication on all critical systems, firewalls, intrusion, detection and prevention systems, vulnerability and penetration testing and identity management systems. Our network is continuously monitored using prevailing industry tools, and our cybersecurity team promptly investigates any anomalies. TEGNA has an extensive patching and software update program, and performance metrics are reported to our Board. All new employees are required to take a cybersecurity training course, and we have mandatory quarterly training modules for all employees.


text: Notwithstanding the extensive approach TEGNA takes to cybersecurity, we face a number of cybersecurity risks in connection with our business. Although to date such risks have no t materially affected us, including our business strategy, results of operations or financial condition, we have from time-to-time experienced threats to our information systems and data. For more information about the cybersecurity risks we face, see Item 1A. "Risk Factors".


text: Although the Company has put in place the cybersecurity policies, procedures and processes described above, the Company remains exposed to cybersecurity attacks and incidents and misuse or manipulation of any of its IT systems, which could have a material adverse effect on its business strategy, results of operations or financial condition. As of the filing of this Form 10-K, we are not aware of any attacks, incidents, misuse or manipulation that have occurred since the beginning of 2024 that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. For risks associated with cybersecurity threats, see the risk factor "Interruption of, damage to or compromise of the Company's information technology (IT) systems, failure to maintain the integrity of customer, colleague or Company data or illegal or fraudulent activities committed against the Company could harm the Company's reputation and have an adverse effect on the Company's business, financial position, results of operations and cash flows." included in "Part I—Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: STEPAN CO

ticker: SCL


text: Cybersecurity Governance The Audit Committee of the Company's Board of Directors (the Audit Committee) oversees the Company's cybersecurity risk management. The Audit Committee receives quarterly reports on cybersecurity risks and risk management from the Company's Chief Information Officer. The Company's Chief Information Officer, who reports to the President and Chief Executive Officer, is in charge of assessing and managing our risks related to cybersecurity and oversees a team of full-time cybersecurity specialist employees. Utilizing the processes noted above, this team remains informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. The Company's Chief Information Officer has served in a variety of IT and cybersecurity roles for more than twenty-five years, including serving in IT infrastructure, cybersecurity, enterprise application, and project management office leadership roles for both public and privately held companies in the chemical, pharmaceutical, and manufacturing industries. He has earned the IT Infrastructure Library (ITIL) Service Master Certification. The Company's Cybersecurity Senior Manager, who reports to the Chief Information Officer, has earned multiple cybersecurity industry certifications and has over fifteen years of IT and cybersecurity experience. The Company's cybersecurity program and cybersecurity practices are reviewed by internal and external auditors. The Company's cybersecurity team provides periodic reports to such auditors.


text: In addition, the rapid evolution and increased adoption of artificial intelligence ("AI") and similar machine learning technologies may intensify our cybersecurity risks. In 2024, we established an AI council comprised of a cross-functional group of employees with an objective to deliver value by providing education regarding the uses, benefits and risks of AI and similar technologies in our business, establishing a governance framework and principles for our use of AI, and enabling deliberate experimentation with new technologies employing AI. At this time, our use of AI is focused primarily on data analytics and improving product quality and asset reliability.

companyName: Metallus Inc.

ticker: MTUS


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of Information technology and Director of Information Security, each Senior Principal Security and Infrastructure Architect with over 20 years' experience managing large scale enterprise information technology and security systems and programs.

companyName: Definitive Healthcare Corp.

ticker: DH


text: The audit committee receives quarterly reports concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: The Audit and Risk Committee of the board of directors has responsibility of oversight for our enterprise risk assessment and risk management systems. Our Chief Information Officer ("CIO"), Senior Director of Information Security and other delegated positions are responsible for assessing and managing our material risks from cybersecurity risks. Our CIO has 15 years of experience in cybersecurity and a degree in management information systems. We also have a Cybersecurity Infrastructure Committee that meets monthly. We have implemented an incident response strategy as an element of our overall risk management approach. Our incident response plan entails clearly-defined roles and responsibilities, established communication protocols and measures to mitigate the impact of any cybersecurity incidents. We have experienced adverse IT events in the past, but to date, we have seen no material impact on our business or operations from these attacks or events. We prioritize the detection, response, and recovery from potential breaches and carry cybersecurity insurance which includes cyber breach response services. The scope and coverage of our cybersecurity insurance is reviewed on an annual basis. Risks and potential threats are identified and measured through these monitoring, testing, and response processes procedures and significant risks, and threats are reported by the CIO to the Audit and Risk Committee.

companyName: Acadia Healthcare Company, Inc.

ticker: ACHC


text: The CITO, who has served in this role for over nine years, regularly reports cybersecurity updates to our Chief Operating Officer who, in his dual role as Chief Financial Officer, is our primary liaison with the Audit Committee. To inform about these updates and help guide cybersecurity related activities across our organization, the CITO has assembled a cybersecurity focus group and steering committee that meets on a quarterly basis and is made up of experienced representatives from various of our cybersecurity risk management consultants, external network security experts and cloud storage providers. These meetings are chaired by the CITO and include discussion of our cybersecurity needs, taking into account the latest industry trends.

companyName: Paramount Group, Inc.

ticker: PGRE


text: Cyber Risk Management and Strategy We face risks associated with security breaches through cyber attacks, cyber intrusions or otherwise, as well as other significant disruptions of our IT networks and related systems. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our data and systems. For more information about the cybersecurity risks we face, see Item 1A, Risk Factors. To help manage these risks, we have implemented and maintain a cybersecurity risk management program that includes processes for the identification, assessment, and treatment of cybersecurity risks. These assessments are aligned with industry standards and leading practices, and provide a comparison based on practices at comparable organizations and recommendations for management to consider. In addition to these external assessments, compliance readiness is assessed at a minimum annually by our CITO, in the form of penetration testing and vulnerability assessments. This program extends to a review of the cybersecurity measures in place at the properties that we own as well as our corporate headquarters, and selected senior managers also have participated in a tabletop exercise curated by our external security consultant to test and improve our incident response planning. We also maintain processes around third-party vendor risk management, such as the submission of vendor questionnaires to critical vendors and the inclusion of contractual security requirements as appropriate.


text: The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of company data and systems along with other material risks to company operations, at least annually or whenever there are material changes to the Company's systems or operations. Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material breaches. As part of our risk management process, the Company engages outside providers to conduct periodic penetration testing and other cybersecurity audits. The Company stores company data in cloud environments with security appropriate to data involved and has adopted controls around, among other things, vendor risk assessment, information classification, access and acceptable use and backup and recovery.

companyName: LifeStance Health Group, Inc.

ticker: LFST


text: The Company's Senior Vice President of IT Security ("SVP of IT Security") has over 35 years of experience in the informational technology field, with 19 years of healthcare IT experience with an emphasis in IT security and computer forensics. The SVP of IT Security has operational responsibility for ensuring the adequacy and effectiveness of the company's risk management, control and governance processes, who periodically reports to the Operational Risk Committee ("ORC"), responsible for applying the policy decisions and, in coordination with the Chief Digital Officer and Chief Executive Officer, reports to the Board of Directors at least annually or more regularly at the discretion of the ORC.


text: The Audit Committee of the Board of Directors is briefed on cybersecurity risks at least once each calendar year and also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds. The SVP of IT Security reports quarterly to the Audit Committee and such report addresses overall assessment of the Company's compliance with this and other cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, recommendations for changes and/or updates to policies and procedures.


text: Our executive team, along with our Audit Committee, assess and manage cybersecurity risk as part of our overall business strategy, financial planning and capital allocation. Our Audit Committee and Board of Directors engage with members of the executive team and are briefed on cybersecurity risks at least once each calendar year and with respect to any potentially material cybersecurity incidents. Our Chief Information Officer reports regularly, and at least annually, to our Audit Committee and such report may address overall assessment of our compliance with our cybersecurity policies, and include topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures. Our Chief Information Officer has served in various senior information technology roles, responsible for information security for over 20 years.

companyName: TransMedics Group, Inc.

ticker: TMDX


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our clinical trial and related data, or Information Systems and Data.

companyName: Silence Therapeutics plc

ticker: SLN


text: Our information security function, which is led by our Vice President and Head of Information Technology, known as our Head of IT, and supported by our security management, risk management, and legal teams, helps identify, assess, and manage our cybersecurity threats and risks, including through the use of our risk register. The information security function identifies and assesses cybersecurity threats and risks by monitoring and evaluating our threat environment and risk profile using various methods including, for example: automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats, evaluating threats reported to us, coordinating with law enforcement concerning threats, internal and external audits, leveraging internal and third party threat assessments, conducting vulnerability identification assessments, and leveraging external threat intelligence.


text: Depending on the environment or system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, vulnerability management, disaster recovery and business continuity plans, risk assessments, achievement of certain security certifications, encryption of certain data, network security controls, data segregation for certain data, access controls, physical controls, systems monitoring, employee training, penetration testing, and asset management and disposal.


text: Certain information about our assessment and management of material risks from cybersecurity threats is included in risk management reports as applicable to senior leadership and the audit committee.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: threat intelligence providers, cybersecurity consultants and software providers, managed cybersecurity service providers, and penetration testing service providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as software-as-a-service providers, hosting companies, contract research organizations, and contract manufacturing organizations. Depending on the nature of the services provided, the sensitivity of the critical systems, information and assets at issue, and the identity of the provider, we may conduct a review of security assessments provided by the vendor, review the vendor's written security program and/or requested security assessment and security questionnaire responses, and impose contractual obligations on vendors regarding their cybersecurity practices.


text: For a description of the risks from cybersecurity threats that may materially affect us, please, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "Cybersecurity risks and the failure to maintain the confidentiality, integrity, and availability of our computer hardware, software, data and internet applications and related tools and functions, or those of third parties with whom we work, could result in damage to our reputation and/or subject us to costs, fines or lawsuits."


text: Our board of directors addresses the review of our IT and cybersecurity risk management as part of its general oversight function. The board of directors' audit and risk committee is responsible for overseeing our cybersecurity risk management processes.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Head of IT, who has achieved ACC Internetworking Engineer and Global Secure Systems Internetworking Engineer qualifications and has over 25 years of experience leading international IT departments and owning responsibility for organizations' cybersecurity efforts.


text: Our Head of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Head of IT is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Executive Leadership Team, or ELT. The ELT works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified, in addition to notifying the audit and risk committee of the board of directors, as appropriate.


text: The board of directors' audit and risk committee receives annual reports from our Head of IT, concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit and risk committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: Cybersecurity Strategy and Risk Management Our Cybersecurity and Technology Risk Program (the "Program") is designed to protect critical assets, scale with business growth and identify and mitigate threats, enabling us to securely conduct the Company's business. The Program's design applies concepts from the frameworks of the National Institute of Standards and Technology ("NIST") as guidelines, incorporating their applicable principles while adapting certain elements to align with our specific operational needs and objectives. The Program and other cybersecurity processes have been integrated into our overall risk management framework.

companyName: PJT Partners Inc.

ticker: PJT


text: The ISP sets forth the controls and activities designed to protect our systems and data, such as establishing network perimeter security, managing system access, monitoring user activity and maintaining physical security. Other components of the Program related to assessing, identifying and managing risks from cybersecurity threats include annual cybersecurity training for all employees, regular review and update of our business critical and financial systems and the use of a variety of tools and methods to manage access to, and maintain the integrity of, our information systems. Our employees are critical in helping mitigate our cybersecurity risk and we continue to raise awareness and engagement through our formal training, frequent phishing campaigns and communication from our information security team with reinforcement from senior leaders across the Company. We also perform annual external penetration tests to identify certain potential vulnerabilities, and maintain a business continuity plan, which is tested annually.


text: The Company engages third parties to test and advise on the Program, including to conduct our annual external penetration test. At times, the Company may engage external experts to support the Program by, for example, facilitating an internal audit, advising on a cybersecurity incident or advising on legal and regulatory requirements.


text: Cyber Incident Response Plan The Company has adopted a written Cyber Incident Response Plan (the "Plan") to guide our response to cybersecurity incidents. The Plan established the Cyber Incident Response Team ("CIRT"), which is responsible for leading the Company's response in the event of a cybersecurity incident and is comprised of the Company's Chief Technology Officer ("CTO"), Chief Information Security Officer ("CISO") and Chief Operating Officer as well as other senior management.


text: Our Board retains responsibility for the oversight of management's role in assessing and managing cybersecurity risk. The Board is aware of the threats presented by cybersecurity incidents and is committed to taking measures to help prevent and mitigate the effects of any such incidents. The Company's management team, and either the CTO or the CISO or both, report at least twice annually to the Board on risks and issues including to evaluate the status of our cybersecurity efforts. The Board also discusses cybersecurity issues with external experts.


text: Management Oversight The CIRT also acts as a cybersecurity risk committee. The CIRT has responsibilities that include receiving and reviewing reports from the CTO and CISO on their management, monitoring and coordination of the Company's cybersecurity and technology risk management and any required remedial or corrective actions, reviewing reports from the CTO and CISO on the effectiveness of the ISP and serving as the primary response and escalation point for cybersecurity matters under the ISP.


text: CIRT members regularly report to the Operational Risk Committee, which is part of our overall risk management framework. The Operational Risk Committee is responsible for incorporating risk management considerations into our business activities. The Operational Risk Committee reports to the Executive Committee, our principal management-level policy-making committee that reports directly to the Board. Under the Plan, the Executive Committee is responsible for escalating and informing the Board about significant cybersecurity incidents and steps being taken by management to address them. In the event of an ongoing threat incident, the CIRT may engage directly with members of the Executive Committee in real-time.


text: Our CISO leads management's efforts to assess and manage cybersecurity risks through execution and enforcement of the Program, implementation of the ISP, reporting cybersecurity risks to senior managers of the Company, and meeting at least twice annually with the Board to discuss cybersecurity risks. The CISO works closely with the CTO, the Company's Executive Committee and other senior managers, including through his participation in the Operational Risk Committee and the CIRT. In addition to the processes described above, our CISO leads a team of information security specialists with which he holds dedicated cybersecurity meetings and regularly reviews key cybersecurity metrics. The information security team monitors public cybersecurity threats and meets with external experts periodically to review these threats and to stay abreast of the evolving threat landscape. Our CISO brings over 25 years of experience in the field of cybersecurity and technology infrastructure having held similar roles at leading global asset managers and investment banks. He has a broad technical background in information security strategy, risk management, and enterprise system design.


text: We regularly engage external consultants to assess and independently verify our cybersecurity risk management, striving for continuous optimization of our cybersecurity policies, cybersecurity risk management processes, and technical measures. These engagements assist us in ensuring our cybersecurity management practices and technical measures comply with applicable laws, regulations, industry standards and the Company's policies. The Company has maintained ISO/IEC 27001 certification since 2018 for certain online business.

companyName: Yum China Holdings, Inc.

ticker: YUMC


text: Our information security team manages and enhances our cybersecurity infrastructure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. We utilize cybersecurity tools, including the NIST Cybersecurity Framework, in assessing the threat landscape and continuously monitoring our environment.

companyName: Organogenesis Holdings Inc.

ticker: ORGO


text: Third-party service providers and consultants Cybersecurity partners are a key part of our cybersecurity infrastructure. We partner with cybersecurity companies and leverage their technology and expertise to better protect the Company. From time to time, we engage certain vendors to monitor our environment, which includes an outsourced security operations center. We may also from time to time engage partners for periodic penetration testing and vulnerability assessments. Our third-party service providers, suppliers, and vendors face their own risks from cybersecurity threats that could potentially impact Organogenesis. We are developing and implementing processes for overseeing and managing these risks and are committed to maintaining robust governance and oversight of these risks. Those processes include assessing the third parties' cybersecurity practices and where applicable, requiring the third parties to implement appropriate cybersecurity controls and otherwise agree to contractual requirements designed to address cybersecurity risks in our agreements with them including conducting ongoing monitoring of their compliance with those requirements.


text: We have also identified the potential for cybersecurity risks stemming from the use of artificial intelligence (AI) tools developed by third parties. We have implemented policies and training programs to govern the use of AI by our employees. Additionally, the Company's Audit Committee regularly reviews our uses of AI as part of its ongoing risk oversight responsibility.


text: We maintain a cyber risk management program which includes processes for identifying, assessing, and managing risks for all of our information technology ("IT") systems, services and applications, including cybersecurity threats. Our program aligns with industry standards, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the IMO guidelines.

companyName: Excelerate Energy, Inc.

ticker: EE


text: These processes include analyzing potential risks from the use of IT components and our use of third-party service providers, engaging third-party service providers to identify potential cybersecurity threats, conducting penetration tests to detect vulnerabilities, conducting employee trainings, monitoring network activities, ensuring patches are applied timely, analyzing and reacting to threat intelligence, and layering controls to prevent unauthorized access to IT assets. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition.


text: Our IT risk management processes are integrated into our Enterprise Risk Management (ERM) program, which is designed to identify and evaluate potentially material risks, the potential impact of these risks on the enterprise, as well as steps to control and mitigate those risks. Our ERM program is overseen by our Enterprise Risk Committee ("ERC"). Our ERC is comprised of various members of senior management, including our Chief Information Officer ("CIO") and internal audit and compliance department leaders. The ERC is responsible for the governance of enterprise risks assessments, identification and management of internal risks, and development of related mitigation strategies. See "Risk Factors – Information system failures, cyber incidents or breaches in security could adversely affect us" for further information on how cybersecurity threats could harm our business, financial condition, and results of operations.


text: If a cybersecurity incident were to occur, we would utilize our incident response plan. This plan governs our process of assessing the incident and our internal and external communications strategy. Our response would be led by our CIO, in coordination with other senior leaders. Depending on the nature and severity of an incident, we may escalate notification to our board of directors.


text: The cyber risk management program is overseen by our CIO who has over 20 years of experience in leading all aspects of IT. This is done in coordination with our Vice President, IT Audit and Security, who has over 25 years of experience in cybersecurity and other IT security roles, including the management of cybersecurity and compliance teams.


text: We rely on both internal information technology systems and networks, and those of third-party vendors and contractors, to acquire, transmit, store and otherwise process information in connection with our business activities. Our ability to effectively manage our business depends on the security, reliability and adequacy of our and our third-party contractors' and vendors' technology systems. As such, we have implemented an information security program designed to identify, assess, and manage risks from cybersecurity threats.

companyName: Xenon Pharmaceuticals Inc.

ticker: XENE


text: The Audit Committee of our Board of Directors bears the primary responsibility for oversight of cybersecurity risks. The Audit Committee is composed of board members with diverse expertise, including risk management, technology and finance, equipping them to oversee cybersecurity risks effectively. Management's oversight is performed through an IT Strategy Committee, a subset of executive management including our Chief Financial Officer, or CFO, and Chief Legal Officer, and relevant functional expertise, including our Senior Vice President, Information Systems, or SVP, IS. Our SVP, IS, is the primary member of the IT Steering Committee charged with responsibility for assessing, monitoring and managing our cybersecurity risks. With over 20 years of experience in information technology strategy and operations, his background includes extensive experience as an IT executive at various companies. At least annually, the SVP, IS, and the CFO provide a comprehensive report to the Audit Committee regarding cybersecurity risk assessments, planned enhancements to our cyber security program, and incident reports and remediation, if any.


text: During the fiscal year ended December 31, 2024, we did not experience any material impact to our business, financial position or operations resulting from previously identified cyberattacks or other information security incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material breaches. For a discussion of these risks, see "Item 1A—Risk Factors—Risk Related to Our Business and Industry—Our business and operations could suffer in the event of an actual or perceived information security incident such as a cybersecurity breach, system failure, or other compromise of our systems and/or information, including information held by a third-party contractor or vendor."


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. This program includes: • Robust Firewalls and Intrusion Detection Systems: The company has invested in state-of-the-art firewalls and intrusion detection systems designed to prevent unauthorized access to its networks. • Regular Security Assessments: The company conducts regular security assessments to identify vulnerabilities and address them promptly. This includes penetration testing, vulnerability scanning, and third-party audits. • Employee Training and Awareness: The company provides comprehensive cybersecurity training to all employees to educate them about potential risks, phishing attacks, and best practices for protecting sensitive information. • Incident Response Plan: The company has developed an incident response plan that outlines the steps to be taken in the event of a cybersecurity breach. This includes isolating affected systems, investigating the breach, and notifying relevant stakeholders. • Cyber Insurance: The company has obtained cyber insurance coverage to mitigate the financial impact of a cybersecurity breach. This insurance policy covers expenses related to incident response, legal fees, and potential customer compensation.

companyName: Arcellx, Inc.

ticker: ACLX


text: By implementing these risk management strategies, we aim to minimize the likelihood and impact of a cybersecurity breach, thereby safeguarding our assets and maintaining the trust of our stakeholders.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Director of Information Technology, who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.


text: We engage assessors, consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. To oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with its work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: Our Director of Information Technology and members of our cybersecurity committee (a management committee), which includes legal and privacy representatives, are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers. Our Director of Information Technology has expertise in security frameworks and standards (such as the Cybersecurity Framework established by the National Institute of Standards and Technology at the U.S. Department of Commerce), proficiency in security tools such as security information and event management systems, intrusion detection systems and vulnerability scanners, and has experience with threat intelligence, threat modeling, risk assessment, and risk management practices, as well as analyzing logs, investigating security incidents, and performing forensic analysis.


text: Our Director of Information Technology and members of our cybersecurity committee oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Director of Information Technology and members of our cybersecurity committee are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: Security Awareness Training, Patch Management Process, Endpoint Detection and Response, Managed Detection and Response, Incident Response Plan, Data Encryption, Access Control, Network Security, and Vulnerability Management.


text: Our Director of Information Technology, our Controller, and members of our cybersecurity committee provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: Risk Management and Strategy The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company relies on the cybersecurity strategy and policies implemented by Bain Capital, the parent of the Advisor and Administrator, which apply to the Company and its operations.

companyName: Bain Capital Specialty Finance, Inc.

ticker: BCSF


text: Bain Capital has adopted and implemented an Information and Cybersecurity Program ("Cybersecurity Program") that prioritizes detection and analysis of and response to cybersecurity threats, management of security risks and resilience against cyber incidents, including those that may impact the Company. The Cybersecurity Program aligns with National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and is reviewed and adjusted as needed and is approved by the Bain Capital's Chief Information Security Officer ("CISO").


text: Bain Capital's Cybersecurity Program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help prevent and respond to cybersecurity threats and incidents, including threats or incidents that may impact the Company, the Advisor or the Administrator. Bain Capital's cybersecurity risk management processes, which are part of Bain Capital's overall risk management system, seek to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessments of cybersecurity risks, including those which may impact the Company, the Advisor, or the Administrator, are reported to the Bain Capital Credit Risk Oversight Committee ("ROC") for awareness, review or action, as appropriate. In addition, the Company relies on Bain Capital to periodically engage with third-party consultants and key vendors to assist it in assessing, enhancing, implementing and monitoring its cybersecurity risk management processes and responding to incidents.


text: Internal and external networks, including the networks on which the Company relies, are assessed for vulnerabilities. Bain Capital also engages with independent third parties to conduct relevant technical assessments.


text: Bain Capital seeks to remain aware of the evolving global threat landscape through vendor relationships, partnerships with threat intelligence providers and membership of industry forums/groups, as well as research performed by members of the Information Security Team. Bain Capital is currently an active member of the Financial Services Information Sharing and Analysis Center (FS-ISAC) and the Alternative Investment ISAC.


text: Bain Capital provides information security awareness training to employees, and function-specific security training is also provided (where appropriate based on job function). Bain Capital also engages in phishing campaigns.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on Bain Capital's Vendor Risk Management Program in conjunction with a Third Party Risk Management (TPRM) steering committee to assess risks posed when engaging with external vendors and/or third parties, including identifying and overseeing risks from cybersecurity threats associated with the Company's use of such entities.


text: In the event of a cybersecurity incident impacting the Company, the Advisor has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational and risk functions of Bain Capital, which may include coordinating with the relevant employees of the Advisor and management of the Company. The incident response plan includes notification to the applicable members of cybersecurity leadership, including Bain Capital's CISO, and, as appropriate, escalation to other relevant individuals.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with Bain Capital's CISO, as well as other risk management, legal, information technology, and/or compliance personnel of Bain Capital.


text: Material Impact of Cybersecurity Risks During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or that are reasonably likely to materially affect the Company, including our business strategy, operational results, and financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors— General Risk Factors— We are highly dependent on information systems, and systems failures or cyber-attacks could significantly disrupt our business, which may, in turn, negatively affect the value of our common stocks and our ability to pay distributions."


text: The Company's Board of Directors ("Board") provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO"), which incorporates updates provided by Bain Capital's CISO regarding the overall state of the Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents potentially impacting the Company.


text: Bain Capital's CISO and Information Security Team are responsible for the Cybersecurity Program applicable to the Company and, along with the Company's CCO, are responsible for assessing and managing material risks from cybersecurity threats that impact the Company. The CCO of the Company oversees the Company's oversight function generally and relies on Bain Capital's CISO to assist with assessing and managing material risks from cybersecurity threats. The Company's CCO has been responsible for this oversight function as CCO to the Company for 10 years and has more than 14 years' experience in information security, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company. Members of Bain Capital's management also possess relevant expertise in various disciplines that are key to effectively managing such risks, such as extensive experience in managing compliance risks in the financial sector, including those related to cybersecurity. Bain Capital's CISO has deep expertise in cybersecurity, holding the CISSP certification and having completed an Executive Master's in Cyber Security from Brown University and having received a Chief Risk Officer Certificate from Carnegie Mellon. Members of Bain Capital's Information Security Team hold various industry certifications and regularly attend trainings and industry conferences.


text: Our corporate information security organization is led by our Chief Information Officer ("CIO"), who brings over 30 years of information technology experience across a wide range of industry sectors, including semiconductor and technology. Before joining Xperi, our CIO was the Chief Information Security Officer for a large technology company. Our CIO oversees our cybersecurity strategy and the development of our cybersecurity capabilities, encompassing risk management and mitigation, incident prevention, detection, and remediation. Our CIO and corporate information security organization collaborate with technical and business stakeholders across our businesses to analyze risks and devise detection, mitigation, and remediation strategies. Additionally, they engage outside legal counsel, experts, consultants, and other third parties to conduct regular audits, assist with forensic investigations, and address cybersecurity threats and incidents. When necessary, they seek input from external experts and consultants on security industry and threat trends.

companyName: Xperi Inc.

ticker: XPER


text: Although the risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition to date, there can be no assurance that they will not be materially affected by such risks or a material incident in the future, or that we have not experienced an undetected cybersecurity incident. As discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to the Company, including potentially to our results of operations and financial condition. See "Risk Factors — If we or our third-party providers experience significant disruptions of our IT Systems or data security incidents, this could result in harm to our reputation, subject us to liability, cause us to modify our business practices, and otherwise materially adversely affect our business, results of operations, and financial conditions."


text: Our Information Technology (IT) department and Senior Director of IT, with the assistance of our legal department, help identify, assess and manage our cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating our and our industry's risk profile, evaluating threats reported to us and coordinating with law enforcement about such threats as may be appropriate, conducting internal and external audits, conducting internal threat assessments to evaluate for both internal and external threats, having third parties conduct threat assessments, and conducting vulnerability assessments designed to identify vulnerabilities.

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: Depending on the environment, systems and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, an incident response policy; incident detection and response processes; a vulnerability management policy; a disaster recovery plan; risk assessments; encrypting certain data; network security controls; data segregation; maintaining access and physical controls; asset management, tracking and disposal; systems monitoring; employee training; penetration testing conducted by third parties; maintaining cybersecurity insurance; and having dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program; (2) the IT department and Senior Director of IT discuss cybersecurity risk with management, including our legal department to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports certain risks to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our personnel, including our Senior Director of IT, who has 20 years of experience in IT and cybersecurity and is a member of the Information Systems Audit and Control Association (ISACA).


text: Our Senior Director of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our General Counsel is responsible for approving budgets and, along with our Senior Director of IT, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability and patch management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CEO and General Counsel. Such management members work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from our Senior Director of IT concerning significant cybersecurity threats, related risks and the processes we have implemented to address them. The audit committee also has access to various reports, summaries and presentations related to cybersecurity threats, risks and mitigation.


text: Our information security program includes the following key elements to help identify, manage, mitigate, and respond to cybersecurity threats: • Risk assessments—We conduct risk assessments designed to help identify material cybersecurity risks, quantify the impact and probability of each risk, develop mitigating controls, and periodically reassess previously identified risks. • Testing—We conduct regular testing of our systems and controls to help identify and address potential vulnerabilities. • Technical safeguards—We utilize various technical safeguards to help protect our information systems from cybersecurity threats. We regularly review our technical safeguards and update them in accordance with recognized best practices and standards. • Business continuity and disaster recovery planning—We maintain business continuity and disaster recovery plans and periodically test those plans. • A cybersecurity incident response plan—We maintain a policy governing actions required for reporting and managing cybersecurity incidents. We have designated an Incident Response Team with clearly defined roles and responsibilities for managing all material aspects of our reporting and response plan. • Employee training and awareness programs—We provide training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees participate in annual training, including insider threat awareness, simulated phishing exercises, and other awareness training. • Third-party risk management —We maintain a third-party risk management program that is designed to help identify, assess, manage, mitigate, and respond to risks associated with the Company's suppliers and other third parties.

companyName: Red Violet, Inc.

ticker: RDVT


text: Our information security program and cyber risk management program is managed and overseen by Jeff Dell, our Chief Information Officer ("CIO") and a team of information security personnel reporting to the CIO. Our CIO reports directly to the CEO and is responsible for the assessment and management of material risks for cybersecurity threats. Mr. Dell brings over 30 years of experience in information technology and information security, working as an executive within data-driven companies for the last 20 years, including serving as CIO since our formation in August 2017 and continuing through our Spin-off from cogint. Mr. Dell holds a Bachelor of Science in Business from Arizona State University and has earned GCIA, GCWN, GWAPT and CISSP certifications. For additional information regarding Mr. Dell's business experience, see Part 1, Item 1 Business – Information About Our Executive Officers included in this Annual Report.


text: We did not experience a material cybersecurity incident during the year ended December 31, 2024, which has materially affected or is reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the possibility of future cybersecurity incidents, as well as cybersecurity and technology risks more generally, could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. See "Item 1A. Risk Factors – Cybersecurity and Technology Risks" for more information.


text: Managing Material Risks & Integrated Overall Risk Management Our cybersecurity team, led by our Chief Information Security Officer, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example, through manual and automated tools, internal and external audits, third-party threat assessments and third-party conducted red/blue team testing and tabletop incident response exercises and by subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments for internal and external threats and conducting vulnerability assessments.

companyName: CYTOKINETICS INC

ticker: CYTK


text: Oversee Third Party Risk Because we are aware of the potentially material risks from cybersecurity threats associated with third-party service providers, Cytokinetics implements processes to oversee and manage these risks. Depending on the nature of the services provided and the identity of the service provider, we may conduct security assessments of the provider before engagement and may monitor their compliance with our cybersecurity policies after engagement. The monitoring includes periodic assessments by our Chief Information Security Officer and on an ongoing basis by our security specialists. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Management's Role Managing Risk Our Chief Information Security Officer, Chief Executive Officer and Chief Financial Officer play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide cybersecurity briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including as applicable: the current cybersecurity landscape and emerging threats, the status of ongoing cybersecurity initiatives and strategies, incident reports and learnings from any cybersecurity events, and compliance with regulatory requirements and industry practices. In addition to our scheduled meetings, the Audit Committee, our Chief Information Security Officer, Chief Executive Officer and Chief Financial Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates from one another, as appropriate, on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Cytokinetics. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Management Personnel in Cybersecurity Primary responsibility for assessing, monitoring and managing our risks from cybersecurity threats rests with our Chief Information Security Officer, Mr. Eric Brown, Vice President of Information Technology. With over 10 years of experience in the field of cybersecurity and over 20 years of experience in IT more broadly, Mr. Brown brings a wealth of expertise to his role. His background includes extensive experience as an enterprise Chief Information Security Officer. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Chief Information Security Officer has overall responsibility for the Company's IT department and operations, including oversight over the cybersecurity team to ensure efforts to contain and remediate security incidents are sufficient and effective.


text: Reporting to Board of Directors Our Chief Information Security Officer, in his capacity, regularly informs our executive management team of material cybersecurity risks and incidents. This is how executive management is kept abreast of our cybersecurity posture and potentially material cybersecurity risks facing Cytokinetics. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated by any of our executive officers to the Audit Committee, so that the Audit Committee can oversee and provide guidance on critical cybersecurity issues.


text: We design and assess our program based on a combination of the International Organization for Standardization (ISO) 27001, Center for Internet Security (CIS) 18, and the National Institute of Standards and Technology Cybersecurity Framework (NIST). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Commerce.com, Inc.

ticker: CMRC


text: Our cybersecurity risk management program includes but is not limited to: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • an annual tabletop exercise conducted by a third party to simulate a cyber emergency and practice our response to such a scenario; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for relevant service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, could materially affect us, including our operations, business strategy, results of operations, or financial condition. See Risk Factors – "We store and process confidential information, including personal information of our customers and their shoppers. If we or our third-party providers fail to protect the security of this information and/or experience a data security incident, our reputation may be harmed and we may be exposed to material financial penalties and legal liability, which could materially adversely affect our business, results of operations, and financial condition."


text: The Board and Audit Committee receive regular reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also regularly receives briefings from management on our cyber risk management program. Board and Audit Committee members receive presentations on cybersecurity topics from our Chief Technology Officer and others within the Chief Technology Officer's team, as well as other internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: The board of director's audit committee and the internal cybersecurity team help identify, assess and manage the Company's cybersecurity threats and risks, including through the use of our risk register. Our internal cybersecurity team includes our information security function, security management, engineering operations, legal, risk management and third-party service providers. Our cybersecurity team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and Personalis' risk profile using various methods including, for example: using manual and automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments, employee reporting, encryption of data, penetration testing, and regular reviews and internal and external audits.

companyName: Personalis, Inc.

ticker: PSNL


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, threat intelligence service providers, forensic investigators, and professional services firms.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I, Item1A. Risk Factors in this Annual Report on Form 10-K, including " If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences. "


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our executive leadership team and led by the Vice President of Informatics, who has more than 20 years of experience in information technology and oversees the Informatics department which includes the Company's hardware, software, help desk, and cybersecurity team.


text: Risk Management and Strategy The Company's risk management program is designed to identify, assess, and mitigate risks across various areas and functions, including financial, operational, technological, regulatory, reputational, and legal. Cybersecurity is a critical component of the risk management program. The Company's information security program is designed to protect the security, availability, integrity, and confidentiality of its computer systems, networks, software and information assets, including customer and other sensitive data.

companyName: PROSPERITY BANCSHARES INC

ticker: PB


text: The structure of the Company's information security program is designed around the National Institute of Standards and Technology Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, the Company leverages certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. The Chief Information Security Officer (CISO), who reports directly to the Chief Risk Officer, and the Chief Information Officer (CIO), who reports directly to the Director of Corporate Strategy, along with key members of their teams, regularly collaborate with peer banks and industry groups to discuss cybersecurity trends, issues and best practices. The information security program is periodically reviewed with the goal of addressing changing threats and conditions.


text: The Company employs an in-depth, layered, defensive strategy that embraces a "secure by design" philosophy when designing new products, services, and technology. The Company leverages people, processes, and technology as part of its efforts to manage and maintain cybersecurity controls and employs a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity. The Company also actively monitors its email gateways for malicious phishing email campaigns and monitors remote connections as a portion of its workforce has the option to work remotely.


text: The Company has established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. It engages in regular assessments of its infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. The Company also maintains a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and its supply chain. The Company leverages internal and external auditors and independent external partners to periodically review its processes, systems, and controls, including with respect to its information security program, to assess their design and operating effectiveness and make recommendations to strengthen its risk management program.


text: The Company maintains an Information Security Incident Response Policy ("Incident Response Policy") and related procedures that provide a documented framework for responding to actual or potential cybersecurity incidents, including timely escalation of incidents to the Crisis Management Team and notification to the appropriate regulatory and governmental authorities. As needed, the notification may include the CEO and/or the Company's and Bank's Board of Directors. The Incident Response Policy and related procedures are coordinated through the Chief Risk Officer and key members of management, including but not limited to representatives from the information security, information technology and legal teams that are embedded into the procedures by design. The Incident Response Policy facilitates coordination across multiple parts of the organization and is evaluated at least annually.


text: To date, the Company has not experienced a cybersecurity incident that has materially impacted its business strategy, results of operations, or financial condition. Despite the Company's efforts, there can be no assurance that its cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in protecting its systems and information. The Company faces risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect its business strategy, results of operations or financial condition. See Item 1A. "Risk Factors" in this document for further discussion of the risks associated with an interruption or breach in the Company's information systems or infrastructure.


text: The Bank's Board of Directors is responsible for overseeing the risks associated with cybersecurity threats. The Strategic Technology Oversight Committee ("STOC") of the Board has primary responsibility for overseeing the technology program, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The CISO and the CIO provide quarterly reports to the STOC regarding the information security and technology programs, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The CISO also reports summaries of key issues, including significant cybersecurity and/or privacy incidents. In addition to the STOC, the management-level Operations Committee and the Enterprise Risk Management Committee ("ERM Committee") focus on and provide oversight of the information security program. The ERM Committee reviews and, as appropriate, approves the broad objectives, strategies and policies governing the Company's protection of data assets and information security framework. The ERM Committee additionally assesses the adequacy of information security practices and reports on cyber risk to the Risk Committee of the Company's Board of Directors. The Operations Committee is chaired by the Chief Operating Officer and includes the CISO, CIO and other key departmental managers from throughout the Company. This committee generally meets bi-weekly to discuss various operational strategy and issues, including information technology and information security policies, practices, controls, and mitigation and prevention efforts.


text: The CISO is accountable for managing the enterprise information security department and delivering the information security program. The responsibilities of the information security department include threat detection and prevention, cybersecurity risk assessment, a portion of defense operations, incident management, vulnerability assessment, threat intelligence, and third-party risk management. The department also provides security awareness training. The Company's information technology department works together with information security in defense operations and is responsible for business resilience, including identity management.


text: Goldman Sachs' process for managing cybersecurity risk includes the critical components of its risk management framework, as well as the following: • Training and education, to enable Goldman Sachs employees to recognize information and cybersecurity concerns and respond accordingly; • Identity and access management, including entitlement management and production access; • Application and software security, including software change management, open source software, and backup and restoration; • Infrastructure security, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems; • Mobile security, through the use of mobile applications; • Data security, including cryptography and encryption, database security, data erasure and media disposal; • Cloud computing, including governance and security of cloud applications, and software-as-a-service data; • Onboarding protocols; • Technology operations, including change management, incident management, capacity and resilience; and • Third-party risk management, including vendor management and governance, and cybersecurity and business resiliency diligence in vendor assessments.

companyName: Goldman Sachs BDC, Inc.

ticker: GSBD


text: Cybersecurity Risk Management and Strategy We use the CIS benchmarks as a guideline to strengthen our cybersecurity practices. This is intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our adoption of the CIS benchmarks is a helpful baseline for potential future alignment with internationally recognized frameworks such as NIST Cybersecurity Framework, or ISO 27001.

companyName: AIRGAIN INC

ticker: AIRG


text: Integration with Enterprise Risk Management Our cybersecurity risk management program is integrated into our enterprise risk management framework. It shares methodologies, reporting channels, and governance processes applied across other risk domains, including legal, compliance, strategic, operational, and financial risks.


text: Our program includes the following: • Risk Assessments: Conducting risk capacity evaluations, pressure tests, and gap analyses while formalizing risk tolerance. • Security Team: A team dedicated to managing cybersecurity risks, implementing security controls, and responding to incidents. • External Expertise: Engaging third-party providers to evaluate, test, and enhance aspects of our security controls. • Cybersecurity Awareness Training: Ongoing training for employees, incident response personnel, and senior leadership. • Third-Party Risk Management: Assessing and monitoring vendors, suppliers, and service providers to mitigate risks to our organization.


text: Material Cybersecurity Risk Assessment We have recently completed an IT Audit of our China Office as part of our broader cybersecurity risk management efforts. This audit identified certain gaps in our systems, processes, and controls specific to our operations in China. These gaps do not indicate the presence of any known cybersecurity threats or incidents, but they highlight areas for improvement to strengthen our overall cybersecurity posture.


text: We are actively and diligently working to address and mitigate these gaps by enhancing our security controls and aligning them with our enterprise-wide cybersecurity strategy. This proactive approach ensures that our systems remain resilient and secure in an evolving regulatory and operational environment.


text: At this time, no cybersecurity threats or incidents have been identified that have materially affected or are reasonably likely to materially affect our operations, business strategy, results, or financial condition.


text: Management updates the Audit Committee and executives as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team, including the CTO and IT Manager, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our management team has several years of experience and has been trained for various roles in information technology and cybersecurity at numerous technology companies. The team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: • Briefings from internal security personnel; • Threat intelligence and information obtained from governmental, public, or private sources, including external consultants engaged by us; and • Alerts and reports produced by security tools deployed in our IT environment.


text: We regularly evaluate the cybersecurity risks that could affect our information systems, as well as on an ad hoc basis when there is a significant change in how we do business that may increase the exposure of our information systems to such risks. These evaluations include identifying the possible internal and external risks, how likely and harmful they are, and whether our current policies, procedures, systems, and safeguards are adequate to handle them.

companyName: 89bio, Inc.


text: Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. For additional information regarding these risks, please refer to Item 1A, "Risk Factors," " We depend on our information technology systems and those of our third-party collaborators, service providers, contractors or consultants. Our internal computer systems, or those of our third-party collaborators, service providers, contractors or consultants, may fail or suffer security breaches, disruptions, or incidents, which could result in a material disruption of our development programs or loss of data or compromise the privacy, security, integrity or confidentiality of sensitive information related to our business and have a material adverse effect on our reputation, business, financial condition or results of operations" in this Annual Report on Form 10-K.


text: The IT Security Steering Committee, which is in charge of our cybersecurity policies and procedures, including the ones discussed in "Risk Management and Strategy" above, is led by our Chief Financial Officer, who has nine years of senior leadership experience at public biotechnology companies, including six years with 89bio. The IT Security Steering committee also includes our Director of IT, who is an experienced Information Technology professional and has over 20 years of experience managing information technology, of which more than 10 years pertain to cybersecurity related experience.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Compliance Officer and Chief Operating Officer who both report to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: Ventyx Biosciences, Inc.

ticker: VTYX


text: As of December 31, 2024, and through the date of this filing, we are not aware of any material cybersecurity incidents that have impacted the Company. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Our Chief Operating Officer and other members of senior management are primarily responsible to assess and manage our material risks from cybersecurity threats. We have engaged a third party, who authored security manuals and holds multiple industry certifications, as our Virtual Chief Information Security Officer (VCISO) to support our Head of IT in Cyber related architecture and assessment.


text: Our Chief Operating Officer and other members of senior management oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Operating Officer and other members of senior management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: rollout and expansion of cyber security tools, cyber industry awareness, trends, and simulated tabletop exercise with incident response plan.


text: Our Chief Operating Officer and other members of senior management provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our Chief Operating Officer provides annual briefings to the board of directors on cybersecurity risks and activities.


text: We recognize the critical importance of maintaining the trust and confidence of customers, suppliers, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our Board of Directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology (NIST) the International Organization for Standardization and other applicable industry standards. Our customers' requirements for their suppliers to have certain cybersecurity policies, standards and processes in place also drives and guides some of our policies and practices. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: ASPEN AEROGELS INC

ticker: ASPN