text: Our technology committee receives periodic reports from the CTO concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. Our board of directors, our Audit Committee and our technology committees also have access to certain reports or presentations related to cybersecurity threats, risk and mitigation.


text: Risk management and strategy Our security team, managed by our Chief Technology Officer ("CTO") who works with a team of security professionals to help identify, assess and manage our cybersecurity threats and risks. Our security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example: manual and automated tools; conducting vulnerability scans; penetration tests conducted internally and by third parties; leveraging threat intelligence feeds; reports and services that identify cybersecurity threats; and working with third parties who conduct threat assessments of our platform and APIs.

companyName: WM TECHNOLOGY, INC.

ticker: MAPS

secItem: Item 1C


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our systems and data. We use third-party service providers to assist us from time to time with the identification, assessment, and management of material cybersecurity risks. We have a vendor management program designed to manage cybersecurity risks associated with our use of these providers, as well as other third-party suppliers and business partners, which may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. Our CTO and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and provide periodic reports to the technology and audit committees of our board of directors, which evaluate our overall enterprise risk.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including If our information technology systems or those third parties with whom we work, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee and technology committee of our board of directors are responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our security team, led by our CTO. Our CTO has over 14 years of experience in engineering and development, including leadership roles. Other members of our security team collectively have over 50 years of experience in information security.


text: Our cybersecurity incident response and vulnerability management plans are designed to escalate certain cybersecurity incidents to members of leadership depending on the circumstances. In these situations, members of our leadership team work with our incident response team to help us evaluate, mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management plans include reporting to the Audit Committee (who may consult with our technology committee) for certain cybersecurity incidents.


text: Our technology committee receives periodic reports from our security team concerning our significant cybersecurity threats and risk and the processes we have implemented to address them.


text: We recognize the importance of identifying, assessing and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Momentus Inc.

ticker: MNTS


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT controls, governance, risk and compliance reviews.


text: We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our results of operations and financial condition, under the heading "Data breaches or incidents involving our technology could damage our business, reputation and brand and substantially harm our business and results of operations." in Item 1A, "Risk Factors" of Part I of this report.


text: Our Audit Committee is responsible for overseeing cybersecurity risks and updates our Board of Directors on cybersecurity matters as needed. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified as promptly as practicable of significant new cybersecurity threats or incidents.


text: Management is responsible for the operational oversight of the company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks.


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: Management is responsible for the day-to-day management of risks we face, while our board of directors, as a whole and through committees, has responsibility for the oversight of risk management. Our Security Committee oversees the management of risks from cybersecurity threats. As required, the full board reviews our major risk exposures, their potential impact on us, and the steps we take to manage them. Our Chief Security Officer (CSO) is responsible for developing, implementing, and maintaining our cybersecurity risk management policies and procedures. The CSO provides regular cybersecurity updates to the Chairman of the Board. Our Cyber Risk Advisory Committee oversees matters regarding the Company's Information Technology strategy, priorities, and governance, including cybersecurity threats and risk assessments.


text: We face significant and persistent cybersecurity risks due to: the scope of geographies, networks and systems we must defend against cybersecurity attacks; the complexity, technical sophistication, value, and widespread use of our systems, products and processes; the attractiveness of our systems, products and processes to threat actors (including state-sponsored organizations) seeking to inflict harm on us or our Clients; and our use of third-party products, services and components.

companyName: Baldwin Insurance Group, Inc.

ticker: BWIN


text: While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing Clients with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate unauthorized attempts and attacks against our network, products and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our products and services; however, we remain potentially vulnerable to known or unknown threats. In some instances, we, our trading partners, our Clients, and our service providers and contractors can be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. Refer to Item 1A. Risk Factors of this Annual Report on Form 10-K for more information on our cybersecurity risks.


text: Our business involves the storage and transmission of a significant amount of confidential and sensitive information. As a result, we take the confidentiality, integrity and availability of this highly sensitive information seriously and invest significant time, effort and resources into protecting such information. Our cybersecurity strategy was designed with the foregoing principles in mind and prioritizes detecting and responding to threats and effective management of security risks.


text: To implement our cybersecurity strategy, we maintain various safeguards to secure the data we hold, including encrypting sensitive data, utilizing a robust 24/7/365 security monitoring system, regularly assessing product features for security vulnerabilities, conducting continuous internal penetration tests, and leveraging multi-factor authentication to help effectively protect sensitive information and appropriate access rights. We also have data and cybersecurity protection and control policies to facilitate a secure environment for sensitive information and to preserve the availability of critical data and systems. We have processes in place to assess and manage vendor cybersecurity risks, which include initial and periodic security program reviews through the use of third party vendors who specialize in this subject matter. We have engaged our independent, internal audit team that reports directly to the Chair of the Audit Committee of our board of directors to audit our adherence to our cybersecurity policies. These audits help us assess our internal preparedness, adherence to best practices and industry standards, and compliance with applicable laws and regulations as well as help us to identify areas for continued focus and improvement. We conduct annual information security awareness training for employees involved in the systems or processes connected to confidential and sensitive information. We also carry insurance that provides certain, limited protection against potential losses arising from a cybersecurity incident.


text: The Technology & Cyber Risk Committee of our board of directors (the "TCRC") is responsible for overseeing and reviewing our cybersecurity program and cybersecurity risk exposure and the steps taken to monitor and mitigate such exposure. The TCRC updates the full board of directors on cybersecurity matters periodically.


text: Our information security team for IAS, MIS and Corporate is led by our Chief Digital & Information Officer ("CDIO"), who also serves as our Chief Information Security Officer ("CISO") for IAS, MIS and Corporate. Our CDIO/CISO reports to our President, BRP & CEO, Retail Brokerage Operations. Our CDIO/CISO has served in the role since 2021 and has experience in application security, intrusion detection, penetration testing, complex threat modeling, and unconventional cyber-attack vectors, having previously led technology teams at Comerica Bank, HSBC, Citibank and General Electric. Our CDIO/CISO oversees a team of information security professionals who are devoted full time to assessing and managing cybersecurity threats on a day-to-day basis. Our CDIO/CISO attends each quarterly meeting of the TCRC to brief members on information security matters and discuss cybersecurity risks generally.


text: Our information security team for UCTS is led by our President of Digital Strategy & Innovation ("PDSI"), who also serves as our CISO for UCTS. Our PDSI/CISO reports to our President, BRP & CEO, Underwriting, Capacity and Technology Operations. Our PDSI/CISO has served in the role since 2022 and has experience in application security, intrusion detection, penetration testing, complex threat modeling, and unconventional cyber-attack vectors, having previously led technology teams at Crum & Forster, QBE North America, QBE FIRST, N.E.W. Customer Service Companies, Inc. and Wipro Technologies. Our PDSI/CISO oversees a team of information security professionals who are devoted full time to assessing and managing cybersecurity threats on a day-to-day basis. Our PDSI/CISO also attends each quarterly meeting of the TCRC to brief members on information security matters and discuss cybersecurity risks generally.


text: In addition, our management team has established an internal Cyber Steering Committee (the "Cyber SteerCo"), which includes processes designed to identify, assess, categorize, and monitor key current and evolving risks facing us, including cybersecurity risks. Each of the CDIO/CISO and PDSI/CISO sit on the Cyber SteerCo along with the our General Counsel and former CISO.


text: Management is made aware of current and evolving cybersecurity risks through the Cyber SteerCo reporting. Furthermore, in the event of a material or potentially material cybersecurity event, senior members of management are promptly informed of such event and oversee triage, response, and disclosure efforts pursuant to the terms of a documented incident response plan.


text: We face significant and persistent cybersecurity risks due to: the scope of geographies, networks and systems we must defend against cybersecurity attacks; the complexity, technical sophistication, value, and widespread use of our systems, products and processes; the attractiveness of our systems, products and processes to threat actors (including state-sponsored organizations) seeking to inflict harm on us or our clients; and our use of third-party products, services and components.


text: While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing clients with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate unauthorized attempts and attacks against our network, products and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our products and services; however, we remain potentially vulnerable to known or unknown threats. In some instances, we, our trading partners, our clients, and our service providers and contractors can be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. Refer to Item 1A. Risk Factors of this Annual Report on Form 10-K for more information on our cybersecurity risks.


text: To implement our cybersecurity strategy, we maintain various safeguards to secure the data we hold, including encrypting sensitive data, utilizing a robust 24/7/365 security monitoring system, regularly assessing product features for security vulnerabilities, conducting continuous internal penetration tests, and leveraging multi-factor authentication to help effectively protect sensitive information and appropriate access rights. We also have data and cybersecurity protection and control policies to facilitate a secure environment for sensitive information and to preserve the availability of critical data and systems. We have processes in place to assess and manage vendor cybersecurity risks, which include initial and periodic security program reviews through the use of third-party vendors who specialize in this subject matter. We have engaged our independent, internal audit team that reports directly to the Chair of the Audit Committee of our board of directors to audit our adherence to our cybersecurity policies. These audits help us assess our internal preparedness, adherence to best practices and industry standards, and compliance with applicable laws and regulations as well as help us to identify areas for continued focus and improvement. We conduct annual information security awareness training for employees involved in the systems or processes connected to confidential and sensitive information. We also carry insurance that provides certain, limited protection against potential losses arising from a cybersecurity incident.


text: Our information security team for IAS, MIS and Corporate is led by our Chief Digital & Information Officer ("CDIO"), who also serves as our Chief Information Security Officer ("CISO") for IAS, MIS and Corporate. Our CDIO/CISO reports to our President, The Baldwin Group & CEO, Retail Brokerage Operations. Our CDIO/CISO has served in the role since 2021 and has experience in application security, intrusion detection, penetration testing, Continuous Threat Exposure Management ("CTEM"), and unconventional cyber-attack vectors, having previously led technology teams at Comerica Bank, HSBC, Citibank and General Electric. Our CDIO/CISO oversees a team of information security professionals who are devoted full time to assessing and managing cybersecurity threats on a day-to-day basis. Our CDIO/CISO attends each quarterly meeting of the TCRC to brief members on information security matters and discuss cybersecurity risks generally.


text: Our information security team for UCTS is led by our Chief Technology Officer—UCTS ("CTO"), who also serves as our CISO for UCTS. Our CTO/CISO reports to our President, The Baldwin Group & CEO, Underwriting, Capacity and Technology Operations. Our CTO/CISO has served in the role since 2022 and has experience in application security, intrusion detection, penetration testing, complex threat modeling, and unconventional cyber-attack vectors, having previously led technology teams across various sectors, including financial services and travel management. Our CTO/CISO oversees a team of information security professionals who are devoted full time to assessing and managing cybersecurity threats on a day-to-day basis. Our CTO/CISO also attends each quarterly meeting of the TCRC to brief members on information security matters and discuss cybersecurity risks generally.


text: In addition, our management team has established an internal Cyber Steering Committee (the "Cyber SteerCo"), which includes processes designed to identify, assess, categorize, and monitor key current and evolving risks facing us, including cybersecurity risks. Each of the CDIO/CISO and CTO/CISO sit on the Cyber SteerCo along with our General Counsel and former CISO.


text: Management is made aware of current and evolving cybersecurity risks through the Cyber SteerCo reporting. Furthermore, in the event of a material or potentially material cybersecurity event, our process as designed is intended to result in senior members of management being promptly informed of such event and oversee triage, response, and disclosure efforts pursuant to the terms of a documented incident response plan.


text: Risk Management and Strategy We rely on the cybersecurity policies and procedures implemented by New Mountain Capital. New Mountain Capital has processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of controls, processes, systems, and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our data. Pursuant to New Mountain Capital's Information Security Program, the New Mountain Capital Information Technology Steering Committee ("ITSC") is responsible for the development, evolution, and implementation of policies and technical measures to reasonably prevent security incidents. At times New Mountain Capital may also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: New Mountain Guardian III BDC, L.L.C.


text: New Mountain Capital uses processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, New Mountain Capital uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, New Mountain Capital also maintains an incident response plan that is utilized when cybersecurity incidents impacting us, our Investment Adviser, or our Administrator are detected. New Mountain Capital also requires that all employees, including employees of the Investment Adviser and Administrator, complete interactive security awareness training on an annual basis.


text: Material Impact of Cybersecurity Risks As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "The failure of cybersecurity protection systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively," which should be read in conjunction with the information above.


text: Our cybersecurity risks and associated mitigations are evaluated by our management and the ITSC as needed, but no less frequently than annually. Management and representatives of the ITSC periodically report to our board of directors on developments to the information security and cybersecurity risks facing us. Reports include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to us. Additional information about cybersecurity risks we face is discussed in Item 1A..—Risk Factors.—Cybersecurity Breaches, Identity Theft and Other Disasters, which should be read in conjunction with the information above.


text: Cybersecurity Risk Management Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to follow our industry's best practices and provides a framework for identifying, monitoring, assessing, and responding to cybersecurity threats and incidents, including threats and incidents associated with the use of third-party vendors and service providers, and facilitating coordination across different departments of the Company. This framework includes steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider; assessing the severity and risk of a cybersecurity threat or incident; implementing cybersecurity countermeasures and mitigation strategies and informing management, our audit and risk committee, and our board of directors of potentially material cybersecurity threats and incidents or other significant changes in the evolving cybersecurity threat landscape.

companyName: Remitly Global, Inc.

ticker: RELY


text: Our information security team is responsible for assessing and maintaining our cybersecurity risk management program. In addition, our information security team engages third-party security experts on an as-needed basis for risk assessment and system enhancements. Our information security team also facilitates training to all employees during the onboarding process and annually, with additional training as we deem appropriate. We review or update our cybersecurity policies annually, or more frequently on an as-needed basis, to account for changes in the evolving cybersecurity threat landscape as well as legal and regulatory developments. Although we have continued to invest in our due diligence, onboarding, and monitoring capabilities over critical third parties with whom we do business, including our third-party vendors and service providers, our control over the security posture of, and ability to monitor the cybersecurity practices of, such third parties remains limited, and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the cybersecurity infrastructure owned or controlled by such third parties. When we do become aware that a third-party vendor or service provider has experienced such compromise or failure, we attempt to mitigate our risk, including by terminating such third party's connection to our information systems and networks where appropriate.


text: In 2023, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors–Cybersecurity, Privacy, Intellectual Property, and Technology Risks" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Our management, Chief Information Security Officer ("CISO"), information security team, and legal team are responsible for identifying and assessing cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are managed under the direction of our CISO, who receives reports from our information security team and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks. Our CISO and dedicated information security personnel maintain certain cybersecurity-related certifications and are experienced information systems security professionals and information security managers with many years of experience. In particular, our CISO maintains the following certifications: Certified Information Systems Auditor from the Information System Audit and Control Association and Certified Information Systems Security Professional from ISC2. Our management, CISO, and information security team provide updates on at least a quarterly basis to our audit and risk committee on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies, and provide cybersecurity reports on at least a quarterly basis that cover, among other topics, third-party assessments of the Company's cybersecurity programs, updates to the Company's cybersecurity programs and mitigation strategies, and other cybersecurity developments. In addition to such regular updates, and as part of our incident response processes, our CISO also provides updates on certain cybersecurity threats and incidents to the audit and risk committee and, as necessary, to the full board of directors, based on the assessment of risk by our management, CISO, information security team, and legal team.


text: Our board of directors has oversight responsibility for our overall enterprise risk management, and delegates cybersecurity risk management oversight to our audit and risk committee. As part of its enterprise risk management efforts, our board of directors also meets with management, including our CISO, to assess and respond to critical business risks, including those that may arise from cybersecurity threats and incidents. Our audit and risk committee is responsible for ensuring that management has policies and processes in place designed to identify, monitor, assess, and respond to cybersecurity, data privacy, and other information technology risks to which the Company is exposed. Further, our audit and risk committee reports material cybersecurity risks to our full board of directors, based on the assessment of risk by our management, CISO, information security team, and legal team.


text: Cybersecurity Risk Management Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to follow our industry's best practices and provides a framework for identifying, monitoring, assessing, and responding to cybersecurity threats and incidents, including threats and incidents associated with the use of third-party vendors and service providers, and facilitating coordination across the Company. This framework includes steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider, assessing the severity and risk of a cybersecurity threat or incident, implementing cybersecurity countermeasures and mitigation strategies, evaluating any related disclosure obligations, and informing management, our audit and risk committee, and our board of directors of potentially material cybersecurity threats and incidents or other significant changes in the evolving cybersecurity threat landscape.


text: In 2024, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors–Cybersecurity, Privacy, Intellectual Property, and Technology Risks" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Our management, Chief Information Security Officer ("CISO"), information security team, and legal team are responsible for identifying and assessing cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are managed under the direction of our CISO, who receives reports from our information security team and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks. Our CISO and dedicated information security personnel maintain certain cybersecurity-related certifications and are experienced information systems security professionals and information security managers with many years of experience. In particular, our CISO maintains the following certifications: Certified Information Systems Auditor from the Information System Audit and Control Association and Certified Information Systems Security Professional from ISC2. Our management, CISO, and information security team provide updates on at least a quarterly basis to our audit and risk committee on the Company's cybersecurity programs and material cybersecurity risks and mitigation strategies, and provide cybersecurity reports on at least a quarterly basis that cover, among other topics, third-party assessments of the Company's cybersecurity programs, updates to the Company's cybersecurity programs and mitigation strategies, and other cybersecurity developments. In addition to such regular updates, and as part of our incident response processes, our CISO also provides updates on certain cybersecurity threats and incidents to the audit and risk committee and, as necessary, to the full board of directors, based on the assessment of risk by our management, CISO, information security team, and legal team.


text: Our board of directors has oversight responsibility for our overall enterprise risk management, and delegates cybersecurity risk management oversight to our audit and risk committee. As part of its enterprise risk management efforts, our board of directors also meets with management to assess and respond to critical business risks, including those that may arise from cybersecurity threats and incidents. Our audit and risk committee is responsible for ensuring that management has policies and processes in place designed to identify, monitor, assess, and respond to cybersecurity, data privacy, and other information technology risks to which the Company is exposed. Further, our audit and risk committee reports material cybersecurity risks to our full board of directors, based on the assessment of risk by our management, CISO, information security team, internal audit team, and legal team.


text: Risk management and strategy The Company and the broader financial services industry face an increasingly complex and evolving threat environment.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: Morgan Stanley has made and continues to make substantial investments in cybersecurity and fraud prevention technology, and employ experienced talent to lead its Cybersecurity and Information Security organizations and program under the oversight of Morgan Stanley's Board of Directors (the "MS Board") and the Operations and Technology Committee of the MS Board ("BOTC").


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify, and manage risks arising from the cybersecurity threats confronting the Firm ("Cybersecurity Program"). Morgan Stanley's Cybersecurity Program helps protect the Firm's clients, customers, employees, property, products, services, and reputation by seeking to preserve the confidentiality, integrity, and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems, including as applicable to the Company and its stockholders. Morgan Stanley continually adjusts its Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.


text: The Adviser and the Administrator manage the Company's day-to-day operations, and the Company uses the Cybersecurity Program to assess, identify and manage material cybersecurity risks affecting the Company and its operations. The Company's business is dependent on the communications and information systems of Morgan Stanley, including but not limited to the Cybersecurity Program, and other third-party service providers.


text: Processes for assessing, identifying, and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and stockholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley forensics team, which develops and implements technologies designed to help detect these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Where a potential threat is identified in Morgan Stanley's environment or which impacts the Company, Morgan Stanley's incident response team evaluates the potential impact to the Firm and, as relevant, the Company, and coordinates remediation where required. These groups, as well as Morgan Stanley's Operational Risk Department, review external cybersecurity incidents that may be relevant to the Firm and the Company, and the outcomes of these incidents further inform the design of the Cybersecurity Program. In addition, Morgan Stanley maintains a robust global training program on cybersecurity risks and requirements and conducts regular training exercises for its employees and consultants, including those personnel relied upon by the Company.


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to the Firm or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity program to identify the impact of their services on the cybersecurity risks to the Firm or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or a Firm audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, certain elements of the Cybersecurity Program are subject to an audit by an independent consultant, as well as an assessment by a separate, independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley and Company Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Risk, is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company. Those processes are periodically tested through tabletop exercises.


text: The Chief Compliance Officer ("CCO") of the Company is responsible for overseeing the Company's risk management function and generally and relies on the CIO, CISO, and Head of Operational Risk to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of Operational Risk has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies. The Company's CCO has worked in the financial services industry for 19 years and has covered business developments from a compliance perspective for over 10 years, during which time the Company's CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of Operational Risk report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our Board.


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO, the CISO, and the Head of Operational Risk, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2023, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley cyber threat detection team, which develops and implements strategies designed to defend against these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Morgan Stanley's vulnerability management team, as well as Morgan Stanley's Non-Financial Risk function ("NFR") review external cybersecurity incidents that may be relevant to the Firm and the Company, to further inform the design of the Cybersecurity Program. To assess the efficacy of Morgan Stanley's controls and defenses designed to mitigate cybersecurity risk, it utilizes internal and external testing, including penetration testing and red team engagements. The results of these assessments are used to strengthen the Cybersecurity Program. Additionally, Morgan Stanley maintains a global training program covering cybersecurity risks and requirements, including heightened security training to specialized employees, and conducts regular phishing email simulations for its employees and consultants as preventative measures.


text: When a threat is identified in Morgan Stanley's environment, its incident response team follows an incident response plan to evaluate the impact to the Firm and coordinate appropriate remediation. If warranted, the cybersecurity incident will be reported to applicable regulators, authorities, impacted clients or counterparties, as appropriate. The Firm's cybersecurity incident response and remediation processes, including assessing materiality and reporting requirements, are reviewed through tabletop exercises.


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to the Firm or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity program to identify the impact of their services on the cybersecurity risks to the Firm or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or a Firm audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's minimum cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, key elements of the Cybersecurity Program are subject to review by an independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley and Company Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Cyber, Technology, and Information Security Non-Financial Risk, ("Head of NFR CTIS"), is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company.


text: The Chief Compliance Officer ("CCO") of the Company is responsible for overseeing the Company's risk management function and generally relies on the CIO, CISO, and Head of NFR CTIS to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of NFR CTIS has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies. The Company's CCO has worked in the financial services industry for 19 years and has covered business developments from a compliance perspective for over 10 years, during which time the Company's CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of NFR CTIS report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our Board.


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO, CISO, and Operational Risk functions, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Material cybersecurity risks are addressed by Morgan Stanley management-level ERM committees with escalation to the BOTC and Board, as appropriate. The BOTC has primary responsibility for assisting the Morgan Stanley board in its oversight of significant operational risk exposures of the Firm and its business units, including IT, information security, fraud, third-party oversight, business disruption and resilience, and cybersecurity risks (including review of cybersecurity risks against established risk management methodologies) and the steps management has taken to monitor and control such exposures.


text: In accordance with its charter, the BOTC receives quarterly reports from (i) Technology, including the CIO or the CISO; (ii) Operations; and (iii) NFR. Such reporting includes updates on Morgan Stanley's Cybersecurity Program, risks from cybersecurity threats, our programs to address and mitigate the risks associated with the evolving cybersecurity threat environment, and NFR's assessment of cybersecurity risks. Senior officers in Technology and NFR also provide an annual report to the BOTC on the status of Morgan Stanley's broader information security program in compliance with the Gramm-Leach-Bliley Act, which includes a discussion of risks arising from cybersecurity threats. At least annually, senior management representatives in Technology and NFR discuss the status of the Cybersecurity Program and key cybersecurity risks with the Morgan Stanley board and, in accordance with such board's Corporate Governance Policies, all board members are invited to attend BOTC meetings and have access to meeting materials. The BOTC, which meets at least quarterly, also reviews and approves significant policies related to cybersecurity, receives an annual independent assessment of key aspects of Morgan Stanley's Cybersecurity Program from an independent third party and holds joint meetings with the BAC and BRC, as necessary and appropriate. The chair of the BOTC regularly discusses cybersecurity developments with senior Morgan Stanley management and reports to the Morgan Stanley board on cybersecurity risks and threats and other related matters.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2024, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: As discussed under the "Risk Factors" heading in this Annual Report, our business has been and may again in the future be impacted by disruptions to our IT infrastructure or our third-party providers' IT infrastructures from (among other causes) cybersecurity-based risks, including attacks (i) on our IT infrastructure (ii) targeting the security, integrity and/or availability of hardware and software; (iii) exploiting weaknesses or vulnerabilities in products, or capturing information installed, stored or transmitted in our products (including after the purchase of those products and when they are installed into third-party products); and (iv) on facilities or similar infrastructure. Risk Management and strategy.

companyName: CARRIER GLOBAL Corp

ticker: CARR


text: We mitigate cybersecurity risks (and other material risks) through our enterprise risk management ("ERM") program, which is a company-wide effort, managed by senior executives and overseen by our Audit Committee and Board of Directors to identify, assess, manage, report and monitor material risks that may affect our ability to achieve our business objectives.


text: In connection with the ERM process, cybersecurity risks, including those relating to risks posed by our use of third-party service providers, are assigned to cross-functional management committees responsible for identifying and classifying the cybersecurity risks in accordance with our ERM risk rating methodology, and developing and administering risk mitigation and incident response plans. These cross-functional management committees regularly meet to review current and emerging cybersecurity risks and maintain policies and procedures governing the evaluation and classification of such risks.


text: Cybersecurity risks deemed to be critical are reviewed by a Critical Threat Committee, which is comprised of members of our senior leadership team including our Chief Financial Officer, Chief Legal Officer, Chief Digital Officer, Chief Operating Officer, Chief Technology Officer, and Controller. The Critical Threat Committee reviews the risk and mitigation plan with the applicable cross-functional management team and facilitates notification to the Audit Committee of emerging critical cybersecurity risks. The Audit Committee and the Board of Directors receive regular briefings on cybersecurity risks. See "—Governance" below for further discussion of governance of our cybersecurity program.


text: In the event of a cybersecurity incident, we maintain incident response plans to investigate, classify, respond to, and manage cybersecurity incidents that may compromise the availability or integrity of our information systems, network resources, or data. In accordance with the incident response plans, cross-functional management teams assess and assign a threat level to each cybersecurity incident. A cybersecurity incident (or incidents, if aggregated together) assigned a critical threat level is escalated to the Critical Threat Committee for review.


text: To ensure that our employees are equipped to identify and mitigate material cybersecurity incidents and to empower them to help us maintain a secure environment for our operations and data assets, we utilize a multifaceted training approach aimed at fostering a culture of security awareness and responsibility among all employees. These tailored programs are designed and updated to address evolving threats and industry best practices. In addition to annual cybersecurity training for employees and contractors and simulated phishing email campaigns, our cybersecurity teams conduct tabletop exercises with our senior management team. Our cybersecurity teams also oversee a security assessment process that is used to screen our third-party service providers for cybersecurity vulnerabilities based on the level of inherent risk they pose to the company or our customers, based on factors including but not limited to the products or services they provide and their ability to access our information systems, network resources, or data.


text: We engage and retain outside consultants and legal advisors and we are members of several cybersecurity industry groups to keep us apprised of emerging cybersecurity risks, defense and mitigation strategies and governance best practices. Many of our processes and procedures have been independently audited and assessed against some of the leading international cybersecurity standards and programs.


text: Cybersecurity threats are constantly evolving, are becoming more frequent and more sophisticated and are made by groups of individuals with a wide range of expertise and motives which increases the difficulty of detecting and successfully defending against them. However, to date, cybersecurity threats have not materially affected us, including our business, strategy, results of operations or financial condition.


text: Our cybersecurity programs, including the cross-functional management committees responsible for identifying, assessing, and mitigating cybersecurity risks and incidents, are owned by our Chief Information Officer. Day-to-day administration of the cybersecurity programs are led by our Chief Information Security Officer and Chief Product Security Officer who collectively possess over 30 years of experience related to cybersecurity issues in both the private and government sectors, and possess certifications including but not limited to Certified Information Systems Security Professional ("CISSP") and Certified Information Security Manager ("CISM").


text: Cybersecurity risk oversight continues to remain a top priority for the Board of Directors. Although the Audit Committee maintains primary responsibility for oversight of cybersecurity risks through the ERM program, responsibility related to oversight of cybersecurity risks is also delegated to other committees in alignment with their focus charter responsibilities. For example, the Technology and Innovation and Governance Committees assist with the cybersecurity programs through their oversight of our technology, digital, and innovation strategies and product integrity program, respectively.


text: The Critical Threat Committee is also responsible for evaluating the materiality of a cybersecurity incident based on criteria that has been reviewed with the Board of Directors, and for determining whether there are disclosure obligations under applicable securities laws. In the event that the Critical Threat Committee determines that a critical cybersecurity incident (or incidents, if aggregated together) is deemed to be material, the Critical Threat Committee will brief the Board of Directors and oversee the disclosure process. For all critical cybersecurity incidents that are not deemed to be material, the Critical Threat Committee will notify the Chairman of the Board to determine whether the Board of Directors will be notified of the critical incident during the next regularly-scheduled cybersecurity update to the Audit Committee, or sooner as circumstances warrant.


text: As discussed under the "Risk Factors" heading in this Annual Report, our business has been and may again in the future be impacted by disruptions to our Technology infrastructure or our third-party providers' Technology infrastructures from (among other causes) cybersecurity-based risks, including attacks (i) on our Technology infrastructure (ii) targeting the security, integrity and/or availability of hardware and software; (iii) exploiting weaknesses or vulnerabilities in products, or capturing information installed, stored or transmitted in our products (including after the purchase of those products and when they are installed into third-party products); and (iv) on facilities or similar infrastructure.


text: Risk Management and strategy We mitigate cybersecurity risks (and other material risks) through our enterprise risk management ("ERM") program, which is a company-wide effort, managed by senior executives and overseen by our Audit Committee and Board of Directors to identify, assess, manage, report and monitor material risks that may affect our ability to achieve our business objectives.


text: Cybersecurity risks deemed to be critical are reviewed by a Critical Threat Committee, which is comprised of members of our senior leadership team including our Chief Financial Officer, Chief Legal Officer, Chief Digital Officer, Senior Vice President of Operations, Chief Technology Officer, Chief Product Officer and Controller/Chief Accounting Officer. The Critical Threat Committee reviews the risk and mitigation plan with the applicable cross-functional management team and facilitates notification to the Audit Committee of emerging critical cybersecurity risks. The Audit Committee and the Board of Directors receive regular briefings on cybersecurity risks. See "Governance" below for further discussion of governance of our cybersecurity program.


text: We engage and retain outside consultants and legal advisors and we are members of several cybersecurity industry groups to keep us apprised of emerging cybersecurity risks, defense and mitigation strategies and governance best practices. Many of our processes and procedures are independently audited and assessed on a periodic basis against leading international cybersecurity standards and programs.


text: Our cybersecurity programs, including the cross-functional management committees described above are the responsibility of our Chief Information Security Officer. Day-to-day administration of the cybersecurity programs are led by our Chief Information Security Officer and Chief Product Security Officer who collectively possess significant experience related to cybersecurity issues in both the private and government sectors, and possess certifications including but not limited to Certified Information Systems Security Professional ("CISSP") and Certified Information Security Manager ("CISM").


text: We rely on technology, including the internet and mobile services, to conduct much of our business activity and allow our customers to conduct financial transactions on our platform. As a result, our systems and operations as well as those of the third parties on which we rely to conduct certain key functions are vulnerable to cybersecurity incidents, which we have experienced in the past. We have a cybersecurity program that includes physical, technological, and administrative controls to detect, contain, respond to and remediate cybersecurity threats and incidents and defined processes to assess, identify and manage material risks from cybersecurity threats. These controls and processes include, among others: • maintaining a vulnerability management program that performs regular vulnerability scans and relies on our risk-based information security program to promote coverage of critical areas; • establishing an offensive security team that actively tests our security controls, imitating methods persons trying to achieve unauthorized access might use to identify any weaknesses; • our global privacy program supported by our privacy engineering and privacy legal teams and the Privacy Advisory Council, a cross functional team of senior leaders from legal, engineering, product, and compliance; • maintaining an incident response plan which includes required responses in the event of a cybersecurity incident; • conducting mandatory annual security and privacy training for all employees and contractors and, where appropriate, giving employees and contractors role-based training focused on content specific to their role at the Company; • undertaking an annual review of our consumer facing policies and statements related to cybersecurity; • requiring employees to treat customer information and data with care through policy, practice and contract (as applicable); • leveraging the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and • carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Robinhood Markets, Inc.

ticker: HOOD


text: Our cybersecurity program is managed by the Company's Security and Corporate Engineering organization, which is led by our CSO, who reports directly to the CEO. Currently, our CSO is Erika Dean. Ms. Dean, who joined the Company in 2021, has over twenty years of experience in the security industry. Prior to joining our Company, she held a variety of leadership positions in cybersecurity at Capital One, including as Vice President, Divisional Chief Information Security Officer. Additionally, several of Robinhood's subsidiaries, including RHC, RHF, and RHS, have a Chief Information Security Officer, who reports to the CSO, and a Risk Operating Committee ("ROC") that manages risks, including cybersecurity risks, specific to each entity. The Chief Information Security Officers have expertise in cybersecurity, industry and regulatory standards, risk management, and security operations. The Security organization elevates risks to the ROCs where applicable. Our cybersecurity program is aligned with industry standards and best practices, such as the NIST CSF, and we engage third-party consultants annually to conduct a NIST CSF maturity assessment of our cybersecurity program.


text: We maintain a Third Party Security and Privacy Policy and conduct security reviews of vendors, including for potential fourth-party risks, prior to and during their contracts with Robinhood and require all third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. Any identified security or privacy risks of doing business with a vendor, including potential fourth-party risks, are highlighted to business owners to help make informed risk-based decisions.


text: We also engage the assistance of third-party consultants to increase protection of our information and IT systems and network to help secure long-term value for our stakeholders. Services provided by third-party consultants include, but are not limited to: regular assessments to our cybersecurity program including cyber maturity assessments and penetration tests; risk scoring of our critical business partners and vendors; and participating in incident response processes.


text: Management is responsible for day-to-day risk operations and management processes. Management has established cybersecurity standards to improve the Company's cybersecurity risk posture and to help define and implement appropriate measures to protect the Company's systems and data from cyber threats. In addition to our Internal Audit and Compliance functions, the Company has a management ERC, which comprises senior leaders of the Company, including the CEO, CFO, CLO, CSO, Vice President of Risk and Audit, and CBO, among others, and reviews on at least a quarterly basis risks that are escalated by the Company's ERM function, including cybersecurity risks. ERM maintains a risk taxonomy and a scoring methodology design to ensure risks are elevated in a clear and transparent manner, and further escalates top risks to the Safety Committee, along with planned mitigants and monitoring procedures.


text: If a cybersecurity incident occurs, incident response procedures are in place to ensure that the occurrence is appropriately reported to the CSO, and business continuity plans are mobilized to minimize disruption to business operations. We have also implemented guidelines to outline communications responsibilities during incidents of all severity levels, including the escalation process for alerting senior management of high severity incidents.


text: If a significant cybersecurity incident occurs, we will conduct an assessment to determine if it is material to us. If a materiality assessment is required, the CSO will report such an incident to our Materiality Assessment Committee ("MAC"), which consists of the CFO, CLO, and CBO (in addition to the CSO). The MAC will then determine, without unreasonable delay, whether the incident is material to the Company. In making such determination, the MAC may consult with the CEO, other members of the Company's management, and the Company's outside professional advisors, in each case, as appropriate. The incident materiality determination will be made by considering all relevant quantitative and qualitative factors, including without limitation: the nature, size and scope of the incident; financial condition; results of operations; litigation or regulatory investigations/actions; the Company's reputation, and customer and vendor relationships; and competitiveness.


text: The principal role of our board of directors and the Safety Committee is one of oversight, recognizing that management is responsible for the design, implementation, and maintenance of an effective program for protecting against and mitigating data privacy and cybersecurity risks. The Safety Committee reviews management's exercise of its responsibility to identify, assess, manage, monitor and mitigate material risks not specifically allocated to the board of directors or another of its committees. The Safety Committee has been explicitly assigned the responsibility to oversee risks from cybersecurity threats, among others, and the full board of directors will be notified when the MAC is assessing a cybersecurity incident and informed of any required disclosures. Our board of directors and Safety Committee receive updates on relevant industry developments, threats, and material risks identified as needed each quarter. The board of directors and the Safety Committee also receive updates, including material legal and legislative developments, concerning data privacy and security, the rapidly evolving cybersecurity risk landscape, and the Safety Committee facilitates the board of directors' oversight responsibilities.


text: Our systems and those of our customers and third-party service providers have been and might in the future be vulnerable to cybersecurity threats. For more information about risks related to cybersecurity threats, including previous cybersecurity incidents (including the November 2021 Data Security Incident (defined below)), that have materially affected or are reasonably likely to materially affect our business, financial condition, and results of operations, see "Risk Factors–Our business could be materially and adversely affected by a cybersecurity breach or other cybersecurity incident involving our information systems or data or those of our customers or third-party or fourth-party service providers."


text: We rely on technology, including the internet and mobile services, to conduct much of our business activity and allow our customers to conduct financial transactions on our platform. As a result, our systems and operations as well as those of the third parties on which we rely to conduct certain key functions are vulnerable to cybersecurity incidents, which we have experienced in the past. Although no organization can eliminate cybersecurity and information technology risk completely, w e have a cybersecurity program that includes physical, technological, and administrative controls designed to detect, contain, respond to and remediate cybersecurity threats and incidents and defined processes to assess, identify and manage material risks from cybersecurity threats. These controls and processes include, among others: • maintaining a vulnerability management program that performs regular vulnerability scans and relies on our risk-based information security program to promote coverage of critical areas; • establishing an offensive security team that actively tests our security controls, imitating methods persons trying to achieve unauthorized access might use to identify any weaknesses; • our global privacy program supported by our privacy engineering and privacy legal teams; • maintaining an incident response plan which outlines the roles and responsibilities of key personnel in the event of a cybersecurity incident; • conducting mandatory annual security and privacy training for employees and contractors and, where appropriate, giving employees and contractors role-based training focused on content specific to their role at the Company; • undertaking an annual review of our consumer facing policies and statements related to cybersecurity; • requiring our employees to treat customer information and data with care through policy, practice and contract (as applicable); and • carrying cybersecurity insurance that provides some protection against potential losses arising from a cybersecurity incident.


text: Our cybersecurity program is managed by the Company's Security and Corporate Engineering organization, which is led by our CSO, who reports directly to the CEO. Our CSO has over twenty years of experience in the security industry and has held a variety of leadership positions in cybersecurity at Capital One, including as Vice President, Divisional Chief Information Security Officer. Additionally, several of Robinhood's subsidiaries, including RHC, RHF, and RHS, have a Chief Information Security Officer, who reports to the CSO, and a Risk Operating Committee ("ROC") that manages risks, including cybersecurity risks, specific to each entity's business. Each of our Chief Information Security Officers has expertise in cybersecurity, industry and regulatory standards, risk management, and security operations. The Security organization elevates risks to the relevant ROCs where applicable. Our cybersecurity program is aligned with industry standards and best practices, such as the NIST CSF, and we engage third-party consultants annually to conduct a NIST CSF maturity assessment of our cybersecurity program.


text: We maintain a Third Party Security and Privacy Standard and conduct security reviews of vendors, including for potential fourth-party risks, prior to and during their contracts with Robinhood and require all third-party service providers with access to personal, confidential or proprietary information to implement and maintain cybersecurity practices consistent with applicable legal standards and industry standards. Any identified security or privacy risks of doing business with a vendor, including potential fourth-party risks, are highlighted to business owners to help make informed risk-based decisions.


text: We also engage the assistance of third-party consultants to increase protection of our information and IT systems and network to help secure long-term value for our stakeholders. Services provided by third-party consultants include, but are not limited to: regular assessments of our cybersecurity program including cyber maturity assessments and penetration tests; risk scoring of our critical business partners and vendors; and participating in incident response processes.


text: Our management is responsible for the Company's day-to-day risk operations and management processes. Management has established cybersecurity standards to improve the Company's cybersecurity risk posture and to help define and implement appropriate measures to protect the Company's systems and data from cyber threats. In addition to our Internal Audit and Compliance functions, the ERM team partners with various front-line risk teams and risk owners across Robinhood, to foster consistent risk management practices across Robinhood. In particular, the ERM team provides governance over risk management practices and reports on a quarterly basis on top risks to the Safety Committee, along with planned mitigants and monitoring procedures.


text: If a cybersecurity incident occurs, incident response procedures are in place to facilitate the appropriate reporting to the CSO, and business continuity plans are mobilized to minimize disruption to business operations. We have also implemented guidelines to outline communications responsibilities during incidents of all severity levels, including an escalation process for alerting senior management of high severity and material incidents.


text: If a significant cybersecurity incident occurs, we will conduct an assessment to determine if it is material to us. If a materiality assessment is required, the CSO will report such an incident to our Materiality Assessment Committee ("MAC"), which consists of the CFO, CLO, and CBO (in addition to the CSO) and notify the CEO. The MAC will then determine, without unreasonable delay, whether the incident is material to the Company. In making such determination, the MAC may consult with the CEO, other members of the Company's management, and the Company's outside professional advisors, in each case, as appropriate. The incident materiality determination will be made by considering all relevant quantitative and qualitative factors, including without limitation: the nature, size and scope of the incident; financial condition; results of operations; litigation or regulatory investigations/actions; the Company's reputation, and customer and vendor relationships; and competitiveness.


text: The principal role of our board of directors and the Safety Committee, a board-level committee composed solely of independent directors, is one of oversight, recognizing that management is responsible for the design, implementation, and maintenance of an effective program for protecting against and mitigating data privacy and cybersecurity risks. The Safety Committee reviews management's exercise of its responsibility to identify, assess, manage, monitor and mitigate material risks not specifically allocated to the board of directors or another of its committees. The Safety Committee has been explicitly assigned the responsibility to oversee risks from cybersecurity threats, among others, and the full board of directors will be notified when the MAC is assessing a cybersecurity incident and informed of any required disclosures. Our board of directors and Safety Committee receive updates on relevant industry developments, threats, and material risks identified as needed each quarter, including material legal and legislative developments, concerning data privacy and security, the rapidly evolving cybersecurity risk landscape, and the Safety Committee facilitates the board of directors' oversight responsibilities.


text: Risk Management and Strategy The Company maintains a cybersecurity program that establishes safeguards for protecting the confidentiality, integrity, and availability of the Company's data, technology, and information systems, and the material risks associated with the threats identified from time to time under the cybersecurity program are incorporated into the Company's corporate risk register. The program includes general controls for managing changes in and access to the Company's information technology environment, cybersecurity awareness and training programs to help employees identify and mitigate against cybersecurity threats, cybersecurity incident response plans and third-party incident response retainers to help expedite the Company's response in the event of a cybersecurity incident, and guidelines regarding system vulnerability management, third-party threat intelligence, endpoint detection and response solutions, and network security measures.

companyName: APA Corp

ticker: APA


text: The program also establishes protocols for identifying and managing material risks related to cybersecurity threats associated with the Company's use of third-party service providers. The Company monitors and oversees the material risks related to vulnerabilities, threats, and incidents impacting its third-party service providers via onboarding reviews, threat intelligence reports, and annual assessments. As an example of the Company's efforts to manage third-party cybersecurity risks, when third parties are engaged to provide software-as-a-service offerings, the Company's standard licensing terms require such third parties to utilize safeguards to protect the Company's data, in compliance with applicable standards from the International Organization for Standardization (ISO) regarding security techniques, and to notify the Company within 24 hours of becoming aware of a cybersecurity incident impacting the Company's data.


text: As of December 31, 2023, no risks from cybersecurity threats or incidents have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.


text: In 2023, the Company's Board of Directors established a standing Cybersecurity Committee to assist with oversight of the Company's cybersecurity program and the material risks associated with the threats identified under the program. Given the Cybersecurity Committee's chair's previous military experience in positions relevant to information security and his NACD-sponsored CERT Certificate in Cybersecurity Oversight from Carnegie Mellon University's Software Engineering Institute, the committee benefits from his perspectives, skills, and training when reviewing and managing the Company's exposure to cybersecurity risks.


text: As stated in its charter, the Cybersecurity Committee's responsibilities include: • providing oversight of the Company's cybersecurity policies, procedures, and plans, including the quality and effectiveness of the cybersecurity program; • reviewing the Company's policies and procedures related to its preparation for, defense against, response to, and recovery from material cybersecurity incidents; • reviewing with management the plans and methodology for periodic assessments of the Company's cybersecurity program by outside professionals, including the findings of such assessments and plans to remediate any material deficiencies identified by such assessments; • overseeing the Company's management of risks related to its cybersecurity systems and processes; • reviewing with management any cybersecurity insurance program the Company may procure, including with respect to coverage and limits; and • overseeing the preparation of the Company's disclosures in its reports filed with the Securities and Exchange Commission relating to the Company's cybersecurity systems.


text: The Cybersecurity Committee also has authority to retain cybersecurity and other consultants and advisors to assist and advise the committee in its evaluation of the Company's cybersecurity program.


text: The Cybersecurity Committee receives regular reports from Company management regarding the Company's cybersecurity systems and programs, and the committee from time to time also receives updates from external cybersecurity specialists on cybersecurity trends and incidents, including those that may be particularly relevant to the Company's industry or operations. In addition, in exercising its oversight responsibilities, the Cybersecurity Committee has full access to Company management and may inquire into any matter that it considers to be of material concern to the committee or the full Board of Directors.


text: The Cybersecurity Committee reports regularly to the full Board of Directors, with respect to such matters as are relevant to the committee's discharge of its responsibilities and with respect to such recommendations as the committee deems appropriate for consideration by the Board of Directors. The Cybersecurity Committee also refers to the Audit Committee any matters that come to the attention of the Cybersecurity Committee that fall within the purview of the Audit Committee, including any matters related to the Company's internal control over financial reporting.


text: APA's Chief Information Officer (the CIO) is primarily responsible for the day-to-day operation of the Company's cybersecurity program and for identifying, assessing, and managing the material risks associated with the cybersecurity threats and incidents identified from time to time thereunder. The CIO manages the Company's Information Security Team, which is comprised of cybersecurity professionals responsible for managing the Company's threat intelligence, vulnerability management, forensics, and security architecture systems and processes. The CIO has a Bachelor of Science in Computer Science and over 25 years of experience managing data and technology in the energy industry. He also receives regular updates from external cybersecurity specialists on emerging trends, threats, and technologies in the cybersecurity industry. The CIO reports directly to APA's Executive Vice President, Administration, who, along with the CIO, presents all relevant information to the Cybersecurity Committee.


text: Additionally, in 2023, the Company established its CyberSmart Defender Network, which is a multi-disciplinary team that includes representatives from across the Company's various departments, responsible for raising awareness of cybersecurity issues, sharing learnings, and gaining access to advanced cybersecurity information and training.


text: Under the direction of the CIO, management's responsibilities with respect to the Company's cybersecurity program include (i) identifying and managing cybersecurity risks, (ii) coordinating cybersecurity incident response, (iii) assessing the health and maturity of the Company's cybersecurity policies, procedures, and plans, including the program, and (iv) reporting overall progress to the Cybersecurity Committee and to the full Board of Directors.


text: For additional information regarding relevant cybersecurity risks, see Item 1A Risk Factors "A cyberattack targeting systems and infrastructure used by the Company or others in the oil and gas industry may adversely impact the Company's operations."


text: Risk Management and Strategy As a wholly owned subsidiary of APA, the Company relies on APA for its information systems in connection with the Company's day-to-day operations. Consequently, the Company also relies on the processes undertaken by APA for assessing, identifying, and managing material risks from cybersecurity threats. The Company's executive officers are executive officers of APA, and one of such officers (John J. Christmann IV) is also a member of APA's board of directors (the APA Board of Directors).

companyName: APACHE CORP


text: APA maintains a cybersecurity program that establishes safeguards for protecting the confidentiality, integrity, and availability of APA's data, technology, and information systems, and the material risks associated with the threats identified from time to time under the cybersecurity program are incorporated into APA's corporate risk register. The program includes general controls for managing changes in and access to APA's information technology environment, cybersecurity awareness and training programs to help employees identify and mitigate against cybersecurity threats, cybersecurity incident response plans and third-party incident response retainers to help expedite APA's response in the event of a cybersecurity incident, and guidelines regarding system vulnerability management, third-party threat intelligence, endpoint detection and response solutions, and network security measures.


text: APA's Chief Information Officer (the CIO) is primarily responsible for the day-to-day operation of APA's cybersecurity program and for identifying, assessing, and managing the material risks associated with the cybersecurity threats and incidents identified from time to time thereunder.


text: In 2023, the APA Board of Directors established a standing Cybersecurity Committee to assist with oversight of APA's cybersecurity program and the material risks associated with the threats identified under the program. The Cybersecurity Committee receives regular reports from APA management, including the CIO, regarding APA's cybersecurity systems and programs, and the committee from time to time also receives updates from external cybersecurity specialists on cybersecurity trends and incidents.


text: As a regular part of our ordinary business operations, we collect and store data, including information necessary for our operations, information from our customers, employees, and our business partners. We recognize these networks and systems may be subject to increasing and continually evolving cybersecurity risks. Our Audit Committee is responsible for overseeing risk management and Cybersecurity is an integral part of the Company's overall risk management program. Our risk management process is designed to identify, prioritize, and monitor risks that could affect our ability to execute our corporate strategy and fulfill our business objectives and to appropriately mitigate such risks.

companyName: Mediaco Holding Inc.

ticker: MDIA


text: Our management team is involved in assessing and managing the Company's material risks from cybersecurity threats, including by hiring appropriate personnel, considering cybersecurity risk in our enterprise risk management strategy, helping prepare for cybersecurity incidents, and participating in the cybersecurity incident response and remediation process for incidents escalated to it including determining materiality. Our management that is involved in these processes includes our Chief Technology Officer, Chief Financial Officer and General Counsel. Management also escalates, as appropriate, reports relating to cybersecurity incidents or threats to our Board or to its Audit Committee.


text: As part of our risk management processes, we are developing risk assessments to identify the probability, immediacy, and potential magnitude of information security risks. Our internal experts regularly conduct audits and tests of our information systems, and our cybersecurity program is periodically assisted by established, independent third-party consultants, who provide assistance through tabletop and other preparedness exercises. Additionally, we review regular publications on cyber awareness and conduct ongoing simulated phishing exercises. We use the findings from these and other processes to improve our information security practices, procedures and technologies.


text: While we have not yet experienced any material impacts from a cyber-attack, any one or more future cyber-attacks could materially adversely impact the Company, including a loss of trust among our customers, departures of key employees, general diminishment of our reputation and financial losses from remediation actions, loss of business or potential litigation or regulatory liability. Further, evolving market dynamics are increasingly driving heightened cybersecurity protections and mandating cybersecurity standards for our products, and we may incur additional costs to address these increased risks and to comply with such demands.


text: See the section titled Item IA. Risk Factors, including "Our business is dependent upon the proper functioning of our internal business processes and information systems. The modification, change of, or interruption of such systems may disrupt our business, processes and internal controls," for additional information about the risks from cybersecurity threats that may materially affect our business.


text: Our management team is involved in assessing and managing the Company's material risks from cybersecurity threats, including by hiring appropriate personnel, considering cybersecurity risk in our enterprise risk management strategy, helping prepare for cybersecurity incidents, and participating in the cybersecurity incident response and remediation process for incidents escalated to it including determining materiality. Our management that is involved in these processes includes our Chief Technology Officer, Chief Financial Officer and General Counsel. Our Senior Vice President of Information Technology and Infrastructure brings over 25 years of expertise in media, information security, technology risk management, spearheading our cybersecurity program. In close collaboration with the senior executive team, IT leadership is responsible for ensuring compliance, addressing identified risks, and driving comprehensive employee training initiatives. Management also escalates, as appropriate, reports relating to cybersecurity incidents or threats to our Board or to its Audit Committee.


text: We have certain processes for the identification, assessment, and mitigation of cybersecurity risks which are incorporated into our overall risk management processes in coordination with our information technology function. Such processes include physical, procedural and technical safeguards, and routine review of our policies and procedures to identify risks and improve our practices. We conduct cybersecurity training and testing for all of our employees covering timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, and mobile security, and we educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We engage third-party consultants to enhance our cybersecurity oversight and conduct penetration testing and vulnerability assessments. Further, we consider the cybersecurity practices of our third-party service providers, including through a general security assessment and contractual requirements, as appropriate, before engaging them in order to help protect us from any related vulnerabilities.

companyName: Werewolf Therapeutics, Inc.

ticker: HOWL