text: At the management level, the Head of IT, who has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at the Company and elsewhere, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices and reports directly to the President and Co-Chief Operating Officer. The Head of IT receives reports on cybersecurity threats from his team and external service providers on an ongoing basis and, in conjunction with management, reviews risk management measures implemented by us to identify and mitigate data protection and cybersecurity risks. The Head of IT works closely with our Legal and Compliance departments to oversee compliance with legal, regulatory and contractual security requirements and to develop reports and presentations to the board of directors and its audit committee. The Head of IT is responsible for providing training to employees in respect of information security.


text: Risk Management and Strategy We take a multifaceted approach to managing risk from cybersecurity threats. Our cybersecurity program leverages people, processes, and technology to identify and respond to cybersecurity threats in a timely manner. Our information security program and supporting policies apply to all employees, contractors and certain vendors servicing the firm. The program outlines the development, maintenance, and distribution of information security policies and procedures that detail the implementation and maintenance of the information security program and its safeguards, and cover various areas such as information handling, user access management, encryption, data retention and backups, computer and network security and monitoring, physical security, incident reporting and response, service provider oversight, and employee and contractor use of technology. We also undergo annual SOC 1 Type 2 testing of our financial processes and supporting technical controls. In addition to the foregoing, we conduct regular employee trainings on cybersecurity and perform phishing exercises to test employees' understanding of how to identify social engineering attacks. We perform diligence, including in respect of information security, of vendors and third parties with significant access to confidential information and personal data, and periodically monitor such vendors. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems. We conduct annual penetration testing performed by a rotating group of third-party security firms to test our technical controls and security response. Our internal audit team has also conducted a cybersecurity assessment to test our preparedness. In addition to our internal cybersecurity capabilities and third-party penetration testing, we also, at times, engage consultants or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: StepStone Group Inc.

ticker: STEP

secItem: Item 1C


text: Material Cybersecurity Risks, Threats & Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. To date, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an effect. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Report under the heading "Cybersecurity risks and cybersecurity incidents could adversely affect our business by causing a disruption to our operations, which could adversely affect our financial condition and results of operations.", which should be read in conjunction with the foregoing information.


text: We maintain a cybersecurity program that is reasonably designed to protect our information, and that of our clients, portfolio companies and investment managers with which we conduct business, against cybersecurity threats that may result in significant adverse effects on the confidentiality, integrity, and availability of our information systems.


text: Board of Directors The board of directors oversees our processes for assessing and managing risk. Our audit committee is responsible for reviewing and discussing our practices with respect to risk assessment and risk management, including risks related to information technology and cybersecurity. The board of directors and audit committee periodically review the measures implemented by us to identify and mitigate risks from cybersecurity threats. As part of such reviews, the board of directors and audit committee receive reports and presentations from those responsible for overseeing our cybersecurity risk management, including the Partner, Chief Information Security Officer & Head of Information Technology ("CISO") and our Legal team, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers, industry participants, service providers and other third parties. The CISO also periodically presents to the board of directors and audit committee, including to describe our information security infrastructure and improvements made, and to report on any significant developments. From time to time, external legal advisers provide education to the board of directors and/or audit committee in respect of information security related developments and to provide training in respect of directors' responsibilities. We have a framework under which certain cybersecurity incidents are escalated and, where appropriate, reported to the board of directors or audit committee in a timely manner.


text: We have a cybersecurity working group composed of members of the Information Technology (including Information Security), Legal and Compliance departments, including the CISO, Chief Technology Officer, Chief Legal Officer, Chief Compliance Officer, and a number of their respective team members. The working group meets regularly to identify and mitigate data protection and cybersecurity risks, implement information security governance mechanisms, discuss developments in information security, and discuss and respond to any significant cyber incidents. The working group is expected to escalate matters of significance to our Incident Response Team, ERMC (defined below) and/or the disclosure committee, as appropriate.


text: We have adopted an Incident Response Plan ("IRP") that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process leverages the NIST framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all personnel, networks and systems, third-party systems and end-user devices.


text: In addition, we have an Enterprise Risk Management Committee ("ERMC") composed of a number of members of senior management from operations across our businesses, legal, compliance, information technology, finance, human resources and internal audit and risk. The ERMC was established to oversee and promote the efficient and effective management of our enterprise risks. Cybersecurity and significant information security matters are to be brought before the ERMC or certain of its members, and matters of primary significance are to be further escalated and reported to our Global Executive Committee and the audit committee of our board of directors, as appropriate.


text: At the management level, the CISO, who has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at the Company and elsewhere, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices and reports directly to the President and Co-Chief Operating Officer. The CISO receives reports on cybersecurity threats from his team and external service providers on an ongoing basis and, in conjunction with management, reviews risk management measures implemented by us to identify and mitigate data protection and cybersecurity risks. The CISO works closely with our Legal and Compliance departments to oversee compliance with legal, regulatory and contractual security requirements and to develop reports and presentations to the board of directors and its audit committee. The CISO is responsible for providing training to employees in respect of information security.


text: Material Cybersecurity Risks, Threats & Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. To date, based on information available as of the date of this annual report, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an effect and there can be no assurance that we will not be subject to future cybersecurity attacks, threats or incidents that may materially affect our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Report under the heading "Cybersecurity risks and cybersecurity incidents could adversely affect our business by causing a disruption to our operations, which could adversely affect our financial condition and results of operations.", which should be read in conjunction with the foregoing information.


text: Cyber Security Plan We have implemented various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature (including without limitation tenant and property related data) ("Information Systems and Data").

companyName: NETSTREIT Corp.

ticker: NTST


text: Our information security processes are overseen by our IT Manager and our Chief Accounting Officer, and supported by a cybersecurity monitoring service provider, who work to help identify, assess and manage the Company's cybersecurity threats and risks. Our IT Manager, as well as our service provider, work to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including, for example subscribing to reports and services that identify certain cybersecurity threats, evaluating certain threats reported to us, engaging a third-party vendor to audit our security protocols in certain systems, and deploying automated monitoring tools across certain systems. Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response policy, risk assessments, network security controls for certain environments, periodic back-ups of certain data, access controls for certain environments, employee training addressing awareness of cyber risks and how to detect certain cyberattacks, and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is integrated into the Company's overall risk management processes, which includes an assessment of risks posed to data that is critical to our business operations (e.g., to support financial reporting, process payroll, and collect and maintain property and lease information).


text: Third Party Risk Management The Company uses third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example a managed service security provider that monitors certain of the Company's computer networks and third-party hosted services.


text: We use third-party service providers to perform a variety of functions throughout our business, including application providers and hosting companies. The Company has implemented certain measures designed to help identify and mitigate cybersecurity threats associated with the use of third-party service providers, such as assessing the security protocols of certain service providers and obtaining security reports from certain vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K. Any material failure, weakness, interruption or breach in security of our information systems or data, or those of our third party vendors, could prevent us from effectively operating our business.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our IT Manager, who has worked in various roles responsible for securing networks, hardware and other application systems, Chief Financial Officer, and Chief Accounting Officer.


text: Our Chief Financial Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including senior management. The Company has identified and designated certain Company employees as members of a cybersecurity incident response team, including the Chief Accounting Officer and the IT Manager. This team helps the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee of the board of directors receives quarterly reports concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. These quarterly reports include summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: Cyber Security Plan We have implemented various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature (including without limitation tenant and property related data) ("Information Systems and Data").


text: Our information security processes are overseen by our IT Manager, Chief Accounting Officer, and Chief Financial Officer, and are supported by a cybersecurity monitoring service provider, who works to help identify, assess, and manage the Company's cybersecurity threats and risks. Our IT Manager, as well as our service provider, work to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including, for example, subscribing to reports and services that identify certain cybersecurity threats, evaluating certain threats reported to us, engaging a third-party vendor to audit our security protocols in certain systems, and deploying automated monitoring tools across certain systems. Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response policy, risk assessments, network security controls for certain environments, periodic back-ups of certain data, access controls for certain environments, employee training addressing awareness of cyber risks and how to detect certain cyberattacks, and cybersecurity insurance.


text: Third Party Risk Management The Company uses third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, a managed service security provider that monitors certain of the Company's computer networks and third-party hosted services.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including Any material failure, weakness, interruption, or breach in security of our information systems or data, or those of the third parties with whom we work, could prevent us from effectively operating our business.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our IT Manager, who has worked in various roles responsible for securing networks, hardware, and other application systems, Chief Financial Officer, and Chief Accounting Officer.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including senior management. The Company has identified and designated certain Company employees as members of a cybersecurity incident response team, including the Chief Accounting Officer, the Chief Financial Officer, and the IT Manager. This team helps the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: Cyber Risk Management and Strategy We rely on information technology systems that we or our third-party providers operate to process, transmit and store electronic information in our day-to-day operations. To help protect against risks from cybersecurity threats to these systems, we have implemented cybersecurity processes in accordance with our risk profile and business that are informed by a recognized cybersecurity industry standard.

companyName: Jade Biosciences, Inc.

ticker: JBIO


text: Our cybersecurity risk management process includes a number of components implemented by internal and external resources, including security monitoring tools, penetration tests and vulnerability assessments, and employee cybersecurity awareness training. We also engage the services of external partners who provide information security services to help maintain our hardware and software, assist with security monitoring on our devices, and help us draft and implement appropriate information security policies.


text: As part of our cybersecurity risk management process, we take a risk-based approach to the evaluation of third-party vendors based on the criticality and size of the vendor. This process includes a review by our external partners, as appropriate.


text: Governance Related to Cybersecurity Risks Our President meets regularly with representatives from our external partners to, as applicable, review aspects of the Company's cybersecurity processes or evaluate risks from cybersecurity threats.


text: Management, including our President and Chief Financial Officer, reports to the Audit Committee on our major cybersecurity risk exposures, their potential impact on us, and the steps we take to manage them. The Audit Committee considers the Company's cybersecurity risk exposures and the steps that the Company's management has taken to monitor and control such exposures in connection with the Audit Committee's discussion of the Company's risk assessment and management guidelines.


text: The Audit Committee reviews and discusses, at least annually, the Company's cybersecurity risks, including the Company's information security and risk management programs, controls and procedures, as well as high level review of the threat landscape facing the Company and the Company's strategy to mitigate cybersecurity risks and potential security incidents. The Audit Committee also reviews the recovery and communication plans for any unplanned outage or security incident.


text: The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents. The Audit Committee provides updates to the board of directors regarding such oversight.


text: At Dun & Bradstreet, we are committed to identifying, categorizing, evaluating, managing, and mitigating risks related to our data, technology, and operations through our enterprise risk management ("ERM") program, our cybersecurity ("Cyber") program, and our compliance and ethics ("C&E") program. Our ERM, Cyber, and C&E programs continuously coordinate on vulnerability, threat, and risk monitoring and periodic reporting to provide a comprehensive view of evolving cybersecurity risks. Through these programs, we evaluate risks at various levels ranging from systems, applications, processes, products, and analytics, to incidents, and macro and aggregate risks in the environment and ecosystems in which we operate. We also utilize this risk-based approach to assess, identify and manage risks from cybersecurity threats associated with third parties with whom we do business, including those that provide services, systems, and data processing. We apply consistent methodologies to evaluate inherent and residual risk levels to identify and prioritize management of our highest risks, including material cybersecurity risks.

companyName: Dun & Bradstreet Holdings, Inc.


text: We utilize our risk management processes to prioritize our annual Cyber workplans, including monitoring and internal audit and external assurance reviews, such as our SOC 2, Type 2 Independent Service Auditor's Report on controls relevant to security, availability, and confidentiality, and our participation in the TRUSTe Data Privacy Framework verification program. We have engaged an industry-leading cybersecurity firm to conduct a cyber threat profile that addresses not only our immediate environment, but also the broader cyber threat landscape and threat actors that may be targeting our industry or the geographic locations in which we operate. We actively participate in several global and regional trade and policy associations, think tanks, and professional organizations related to cybersecurity, information policy, privacy, and artificial intelligence to maintain timely insights on rapidly evolving cybersecurity and data risks affecting our business.


text: We take a holistic approach to identification, mitigation and management of cybersecurity and data risks through governance and compliance processes integrated across our Cyber program and our C&E program. These processes include integrated policies, risk assessments, impact assessments, third party reviews and monitoring, incident response, and external certification programs such as ISO 27001: Information Security Management Systems, ISO 27701: Privacy Information Management Systems, and APEC Cross-Border Privacy Rules System. We recognize that our first line of defense is our employees and we incorporate cybersecurity awareness education in our annual Code of Conduct and Ethics training program to ensure our employees understand their roles in safeguarding against potential cyber threats.


text: We have established an Enterprise Risk Committee, which is led by our Chief Risk Officer and includes our executive management team, our Chief Cybersecurity and Technology Risk Officer, our Chief Ethics and Compliance Officer, and our Head of Internal Audit, for the purpose of monitoring the Company's identification, assessment, mitigation and management of enterprise risks, including cybersecurity risks. Our Chief Risk Officer, Chief Cybersecurity and Technology Risk Officer and Chief Ethics and Compliance Officer each report to the Enterprise Risk Committee on relevant cyber and data risks, controls, and progress against action plans on at least a quarterly basis, and work in coordination with cross-functional teams to oversee our information security strategy and work collaboratively with business leaders across the organization to assess, identify, and manage risks from cybersecurity threats, and to address cybersecurity incidents globally when they arise.


text: With respect to incident response, we maintain a global incident and breach response program coordinated by our Chief Cybersecurity and Technology Risk Officer and our Chief Ethics and Compliance Officer. Our incident and breach response program follows requirements of applicable laws and recognized frameworks, such as those established by ISO and the U.S. National Institute of Standards and Technology, and applies a risk-based approach across six phases comprised of (i) preparation, (ii) detection, (iii) reporting and escalation, (iv) analysis and evaluation, (v) response, and (vi) post-incident activities.


text: Our ERM program is led by our Chief Risk Officer, who reports to our Chief Executive Officer. Our Cyber program is led by our Chief Cybersecurity and Technology Risk Officer, who reports to our Chief Technology Officer. Our C&E program is led by our Chief Ethics and Compliance Officer, who reports to our Chief Legal Officer. The collective relevant cybersecurity experience and expertise of the persons holding the positions of Chief Risk Officer, Chief Cybersecurity and Technology Risk Officer, and Chief Ethics and Compliance Officer is over 75 years, and includes multiple information security and privacy professional certifications, and various pan-industry leadership roles related to cybersecurity and data risks.


text: Our board of directors oversees risk directly and through its committees. Our audit committee is responsible for oversight of our policies and practices with respect to risk assessment and risk management including our cybersecurity and ERM programs. At each regular meeting of the audit committee of our board of directors, our Chief Risk Officer, Chief Cybersecurity and Technology Risk Officer and Chief Ethics and Compliance Officer each report on risks, controls, and risk mitigation actions to address existing and emerging cybersecurity and data risks, any incidents, and progress against the Company's cybersecurity strategic roadmap. The audit committee provides guidance and feedback to management on areas of focus to continuously improve the programs and to mitigate our evolving risks. Our audit committee chairman reports on these discussions and other matters to our board of directors on a quarterly basis.


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our overall business strategy, results of operations, or financial condition over the long term. See Item 1A. Risk Factors – "Data security and integrity are critically important to our business, and cybersecurity incidents, including cyberattacks, breaches of security, unauthorized access to or disclosure of confidential information, business disruption, or the perception that confidential information is not secure, could result in a material loss of business, regulatory enforcement, substantial legal liability and/or significant harm to our reputation." for more information about these and other risks related to information security.


text: We take a holistic approach to identification, mitigation and management of cybersecurity and data risks through governance and compliance processes integrated across our Cyber program and our C&E program. These processes include integrated policies, risk assessments, impact assessments, third party reviews and monitoring, incident response, and external certification programs such as ISO 27001: Information Security Management Systems, ISO 27701: Privacy Information Management Systems, APEC Cross-Border Privacy Rules System and TRUSTe Responsible AI. We recognize that our first line of defense is our employees and we incorporate cybersecurity awareness education in our annual Code of Conduct and Ethics training program to ensure our employees understand their roles in safeguarding against potential cyber threats.


text: We have established an Enterprise Risk Committee, which is led by our Chief Risk Officer and includes our executive management team, our Chief Cybersecurity and Technology Risk Officer, our Chief Ethics and Compliance Officer, and our Head of Internal Audit, for the purpose of monitoring the Company's identification, assessment, mitigation and management of enterprise risks, including cybersecurity risks. Our Chief Risk Officer, Chief Cybersecurity and Technology Risk Officer and Chief Ethics and Compliance Officer each report to the Enterprise Risk Committee on relevant cyber and data risks, controls, and progress against action plans on at least a quarterly basis, and work in coordination with cross-functional teams to oversee our information security strategy and work collaboratively with business leaders across the organization to assess, identify, and manage risks from cybersecurity threats, and to address cybersecurity incidents globally when they arise. We have established a Cybersecurity Sub-Committee of the Enterprise Risk Committee to regularly review cybersecurity developments.


text: Our ERM program is led by our Chief Risk Officer, who reports to our Chief Executive Officer. Our Cyber program is led by our Chief Cybersecurity and Technology Risk Officer, who reports to our Chief Technology Officer. Our C&E program is led by our Chief Ethics and Compliance Officer, who also serves as our chief data protection officer and reports to our Chief Legal Officer. The collective relevant cybersecurity experience and expertise of the persons holding the positions of Chief Risk Officer, Chief Cybersecurity and Technology Risk Officer, and Chief Ethics and Compliance Officer is over 75 years, and includes multiple information security and privacy professional certifications, and various pan-industry leadership roles related to cybersecurity and data risks.


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our overall business strategy, results of operations, or financial condition over the long term. See Item "1A.— Risk Factors—Operational Risks – Data security and integrity and digital resilience are critically important to our business, and cybersecurity incidents, including cyberattacks, breaches of security, unauthorized access to or disclosure of confidential information, business disruption, or the perception that confidential information is not secure, could result in a material loss of business, regulatory enforcement, substantial legal liability and/or significant harm to our reputation." for more information about these and other risks related to information security.


text: We recognize that the safety and security of our systems, technology and infrastructure (and those of key third-party service providers upon which we rely), as well as our content and confidential or sensitive user and employee information, is critical to maintaining the trust and confidence of our users and subscribers, consumers, advertisers and investors (among other stakeholders). As a result, Company management has established programs and related processes designed to manage cybersecurity issues, including the assessment, identification and management of cybersecurity risks, together with related mitigation and recovery efforts. Our board of directors, directly and through our Audit Committee, oversees Company management in the execution of its cybersecurity responsibilities, including the assessment of the Company's approach to cybersecurity risk management.

companyName: IAC Inc.

ticker: IAC


text: Cybersecurity Risk Management and Strategy Overview. Our cybersecurity programs and related processes generally consist of the following key elements: (i) risk assessment and management efforts, (ii) technical safeguards and incident response and recovery efforts, (iii) third-party risk management efforts, (iv) education, training and preparedness efforts and (v) governance efforts.


text: Risk assessment and management efforts. We assess, identify and manage cybersecurity risks as part of a comprehensive information security program that is intended to be aligned with standard industry frameworks, such as International Standard for Organization (ISO) 27000 and the National Institute of Standards and Technology (NIST) Cyber Security Framework.


text: As part of the ongoing refinement of our information security program, we engage (as appropriate) various third-party risk management services to assist with the identification of potential cybersecurity issues, such as those involving software vulnerabilities, configuration errors, data exposure and credential theft (among others), as well as consult with external legal counsel, third-party experts and other advisors to assist with incident response and recovery efforts, forensic investigations, extortion negotiations and crisis management or readiness for the same. We also maintain a cyber insurance policy to help manage, in part, costs associated with significant cybersecurity incidents that may occur.


text: In addition, as discussed in more detail below under the caption "Cybersecurity Governance," the assessment, identification and management of cybersecurity risks have been integrated into our overall enterprise risk management ("ERM") efforts.


text: Technical safeguards and incident response and recovery efforts. As part of our information security program, we have implemented a number of tools and procedures designed to identify and remediate vulnerabilities and misconfigurations in our applications and infrastructure, as well as manage access and identities throughout their lifecycles. These tools and procedures are intended to be consistent with ISO and NIST frameworks, In addition, we have implemented an incident response policy that outlines established processes for addressing cybersecurity issues that leverages a cross-functional cybersecurity incident response team and outside advisors intended to allow the Company to take action in a timely and decisive manner in compliance with applicable laws, rules and regulations during the response, investigation and remediation of a given cybersecurity incident.


text: Third-party risk management efforts. In addition to the assessment, identification and management of our own cybersecurity related risks, we also consider and evaluate cybersecurity risks associated with certain third-party service providers upon which we rely for a wide variety of technical and business functions. Our efforts in this regard consist of (among other efforts): (i) security assessments to determine whether key third-party service provider information security procedures meet our expectations, (ii) the use of a monitoring service that detects evidence of the compromise of key third-party provider systems, technology and infrastructure, (iii) assessments designed to identify business and technical risks to our systems, technology and infrastructure posed by key third-party service providers and (iv) the development of strategies to determine the potential adverse impact of, and develop mitigation strategies for, any cybersecurity incidents experienced by key third-party service providers on our business, financial condition and results of operations.


text: Education, training and preparedness efforts. Education, training and preparedness are an important part of our information security program. In connection with our education and training efforts, we have developed and implemented a set of Company-wide policies and procedures regarding cybersecurity matters that impose responsibility on our employees through the course of their work to: (i) protect our systems, technology, infrastructure and data from cybersecurity threats, (ii) quickly report known or suspected cybersecurity incidents or other suspicious activity through designated channels and respond effectively to such events and (iii) use Company and personal information technology in a secure manner. In addition, we generally mandate information security training for our employees and our software developers generally receive mandatory additional technical training, each on an annual basis. In connection with our preparedness efforts, we periodically participate in tabletop exercises with the goal of helping management effectively respond to cybersecurity incidents that may occur. We also maintain documented incident response policies to help ensure that our response activities are consistent and appropriate. Governance. See the disclosure under the caption "Cybersecurity Governance" below.


text: Cybersecurity Governance Our board of directors is responsible for overseeing Company management's execution of its cybersecurity responsibilities, including our approach to cybersecurity risk management. Our board of directors executes this oversight in coordination with our Audit Committee, which pursuant to its charter, assists the Board with risk assessment and risk management policies as they relate to cybersecurity risk exposure (among other risk exposures), as well as part of its regularly scheduled meetings and through discussions with Company management on an as needed basis.


text: In addition, the assessment, identification and management of cybersecurity risks has been integrated into our ERM efforts. As part of that annual process, cybersecurity risks across our businesses are included in the risk universe that our Executive Risk Committee (consisting of members of Company senior management) evaluates to identify our top enterprise risks and develop related mitigation plans. The cybersecurity and other risks are reviewed during the year through our ERM process and discussed with our Audit Committee at least semi-annually and with our board of directors at least annually.


text: Our Chief Information Security Officer ("CISO") is responsible for the development and implementation of our information security program on a Company-wide basis, together with a dedicated team of experienced, Company-wide information security analysts. Our CISO has over twenty-five years of experience leading the development, implementation and oversight of information security programs and members of the information security team have relevant certifications, educational and industry experience.


text: Our CISO is also responsible for reporting on the status of our information security program and related efforts and processes to Company senior management periodically, and to the Audit Committee on a quarterly basis. In addition, our CISO reports cybersecurity matters to Company senior management and the Audit Committee on an as-needed basis. At each regularly scheduled meeting of our board of directors, the Chair of our Audit Committee provides quarterly updates regarding significant matters discussed, reviewed, considered and approved by the committee since the last regularly scheduled board meeting (including cybersecurity matters, as and if applicable), as well as timely updates outside of quarterly updates on an as needed basis. Lastly, our CISO promptly informs Company management and our Audit Committee of cybersecurity incidents that meet established reporting thresholds or when otherwise determined appropriate, as well as provides ongoing updates regarding such incidents until they have been resolved.


text: Cybersecurity Risks As discussed above and under " Item 1A —Risk Factors—Risk Factors—General Risk Factors," we face a number of cybersecurity risks across our various businesses, and we have experienced threats to and unauthorized intrusions of our systems, technology and infrastructure from time to time. While to our knowledge we have not to date experienced a cybersecurity incident or threat that has materially and adversely affected our business, financial condition and results of operations, we cannot provide assurances that they will not be materially affected in the future by such incidents.


text: We recognize that the safety and security of our systems, technology and infrastructure (and those of key third-party service providers upon which we rely), as well as our content and confidential or sensitive user and employee information, is critical to maintaining the trust and confidence of our users and subscribers, consumers, advertisers and investors (among other stakeholders). As a result, Company management has established programs and related processes designed to manage cybersecurity issues, including the assessment, identification and management of cybersecurity risks, together with related mitigation and recovery efforts. Our board of directors, directly and through our audit committee, oversees Company management in the execution of its cybersecurity responsibilities, including the assessment of the Company's approach to cybersecurity risk management.


text: Education, training and preparedness efforts. Education, training and preparedness are an important part of our information security program. In connection with our education and training efforts, we have developed and implemented a set of Company-wide policies and procedures regarding cybersecurity matters that impose responsibility on our employees through the course of their work to: (i) protect our systems, technology, infrastructure and data from cybersecurity threats, (ii) quickly report known or suspected cybersecurity incidents or other suspicious activity through designated channels and respond effectively to such events and (iii) use Company and personal information technology in a secure manner. In addition, we generally mandate information security training for our employees and our software developers generally receive additional technical training, each on an annual basis. In connection with our preparedness efforts, we periodically conduct tabletop exercises with the goal of helping management effectively respond to cybersecurity incidents that may occur. We also maintain documented incident response policies to help ensure that our response activities are consistent and appropriate. Governance. See the disclosure under the caption "Cybersecurity Governance" below.


text: Cybersecurity Governance Our board of directors is responsible for overseeing Company management's execution of its cybersecurity responsibilities, including our approach to cybersecurity risk management. Our board of directors executes this oversight in coordination with our audit committee, which pursuant to its charter, assists the board of directors with risk assessment and risk management policies as they relate to cybersecurity risk exposure (among other risk exposures), as well as part of its regularly scheduled meetings and through discussions with Company management on an as needed basis.


text: In addition, the assessment, identification and management of cybersecurity risks has been integrated into our ERM efforts. As part of that annual process, cybersecurity risks across our businesses are included in the risk universe that our Executive Risk Committee (consisting of members of Company senior management) evaluates to identify our top enterprise risks and develop related mitigation plans. The cybersecurity and other risks are reviewed during the year through our ERM process and discussed with our audit committee at least semi-annually and with our board of directors at least annually.


text: Our CISO is also responsible for reporting on the status of our information security program and related efforts and processes to Company senior management periodically, and to the audit committee on a quarterly basis. In addition, our CISO reports cybersecurity matters to Company senior management and the audit committee on an as-needed basis. At each regularly scheduled meeting of our board of directors, the Chair of our audit committee provides quarterly updates regarding significant matters discussed, reviewed, considered and approved by the committee since the last regularly scheduled board meeting (including cybersecurity matters, as and if applicable), as well as timely updates outside of quarterly updates on an as needed basis. Lastly, our CISO promptly informs Company management and our audit committee of cybersecurity incidents that meet established reporting thresholds or when otherwise determined appropriate, as well as provides ongoing updates regarding such incidents until they have been resolved.


text: Cybersecurity Risks As discussed above and under " Item 1A —Risk Factors—Risk Factors—General Risk Factors," we face a number of cybersecurity risks across our various businesses, and from time to time we have experienced threats to and unauthorized intrusions of our systems, technology and infrastructure. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. While we have implemented a risk management process designed to mitigate cybersecurity risks that arise from utilizing third-party service providers, suppliers, and vendors, our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes multiple layers of security controls, including network segmentation, security monitoring, endpoint protection, and identity and access management, as well as a cybersecurity incident response plan.

companyName: Opendoor Technologies Inc.

ticker: OPEN


text: We assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). While we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business, this does not imply that we meet any particular technical standards, specifications, or requirements, and our maturity varies across our cybersecurity program.


text: Our cybersecurity risk management program considers cybersecurity risks alongside other company risks as part of our overall cybersecurity risk assessment process, and shares common methodologies, reporting channels and governance processes that apply to other risks impacting the company, such as regulatory, financial and operational risks.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of vulnerability scans and penetration testing; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management, including annual incident training, regular phishing email simulations and tabletop exercises to simulate incident responses; • a robust cybersecurity incident response plan that includes documented procedures for preparing for, detecting, responding to and recovering from cybersecurity incidents, as well as processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident; and OPENDOOR TECHNOLOGIES INC. • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. See "Item 1A. Risk Factors" for additional discussion regarding the risks we face from cybersecurity threats.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives reports at least annually from our Chief Technology Officer and management on our cybersecurity risk management and strategy, including, as applicable, progress towards our risk-mitigation goals, results from third-party assessments, and the emerging threat landscape. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity and, will, from time to time, brief the full Board on our cybersecurity risk management program. From time to time, our Committee members receive presentations on cybersecurity topics from our internal or external experts as part of its continuing education on topics that impact public companies.


text: Our Chief Technology Officer, in coordination with our Head of Security and our internal security staff, is responsible for assessing and managing our material risks from cybersecurity threats, and has primary responsibility for our overall cybersecurity risk management program and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our Chief Technology Officer, who possesses a 25-year track record in overseeing technology, 15 of which includes oversight of information security systems, reports directly to our Chief Executive Officer. This extensive experience spans both public and private companies and includes over a decade as the dedicated key individual responsible for cybersecurity. Our Head of Security, who leads our internal security staff and reports directly to our Chief Technology Officer, has over 20 years of software development experience, ten of which have focused on cybersecurity, and includes managing information security systems, developing cybersecurity strategy and implementing effective information and cybersecurity programs.


text: Our Chief Technology Officer and Head of Security supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, and alerts and reports produced by security tools deployed in the IT environment, such as regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; OPENDOOR TECHNOLOGIES INC.


text: • the use of vulnerability scans and penetration testing; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management, including annual incident training, regular phishing email simulations and tabletop exercises to simulate incident responses; • a robust cybersecurity incident response plan that includes documented procedures for preparing for, detecting, responding to and recovering from cybersecurity incidents, as well as processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have experienced a limited number of immaterial cybersecurity incidents in the past, regularly experience cybersecurity attempts, and expect that we will continue to experience varying degrees of cybersecurity attempts and incidents in the future. To date, we have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. See "Item 1A. Risk Factors" for additional discussion regarding the risks we face from cybersecurity threats.


text: The Committee receives updates at least annually from our Chief Technology and Product Officer and management on our cybersecurity risk management and strategy, including, as applicable, progress towards our risk-mitigation goals, results from third-party assessments, and the emerging threat landscape. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our Chief Technology and Product Officer, in coordination with our internal security staff, is responsible for assessing and managing our material risks from cybersecurity threats, and has primary responsibility for our overall cybersecurity risk management program and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our Chief Technology and Product Officer, who possesses a 20-year track record in product development and engineering, eight years of which consist of overseeing technology, including the oversight of information security systems, reports directly to our Chief Executive Officer. This extensive experience spans both public and private companies.


text: Our Chief Technology and Product Officer supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, and alerts and reports produced by security tools deployed in the IT environment, such as regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises.


text: Risk Management and Strategy Due to the sensitivity of the personal information, including protected health information, or PHI, that the Company and its subsidiaries store and transmit, in the ordinary course of business, identifying, assessing, and managing material cybersecurity risks is an important component of the Company's overall cybersecurity and enterprise risk management program.

companyName: CLOVER HEALTH INVESTMENTS, CORP. /DE

ticker: CLOV


text: We maintain a cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework's guidance and HIPAA, which applies to the Company and each of its subsidiaries. The cybersecurity program seeks to protect the enterprise against threats from cybersecurity risks, to comply with applicable laws and regulations, and to establish and enhance our processes for responding to cybersecurity events.


text: Among other things, the program includes the following components: • security event monitoring and detection; • extended detection and response; • vulnerability scanning; • security awareness and privacy training for personnel; • phishing simulations; and a cybersecurity incident response team. The Company also engages third-party vendors and consultants, respectively, to perform audits and penetration tests.


text: The Company and its subsidiaries' third-party service providers collect, process, and store certain information, including PII, PHI, or other confidential and proprietary information. We maintain a third-party vendor security risk management program to assess the cybersecurity risk and measures taken by such service providers. The program includes a dedicated third-party risk assessor, security risk reports, and formal business owner risk response.


text: During the period covered by this report, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Risks from cybersecurity threats, however, in the future may, among other things, cause material disruptions to our or our subsidiaries' operations, which may materially affect our liquidity, results of operations and financial condition, as well as damage our reputation. For additional information related to risks from cybersecurity threats, please refer to Item 1.A. — "Risks Related to Our Business and Industry — Our failure to protect our sites, networks, and systems against security breaches, or otherwise to protect our confidential or health information or the confidential or health information of our beneficiaries, providers, or other third parties, would damage our reputation and brand, and substantially harm our business and results of operations."


text: The Company's Board of Directors (the "Board") oversees the Company's overall risk management program, and has assigned oversight of cybersecurity risk management to its Audit Committee. The Audit Committee reviews the adequacy and effectiveness of the Company's cybersecurity policies and internal controls regarding information and cybersecurity, and together with the full Board, regularly receives reports from our and our subsidiaries' management, including our Chief Information Security Officer (the "CISO") on cybersecurity matters, including, but not limited to: Security Awareness, Internal Risk, Third-Party Risk, IR / DR Readiness, Access Control IAM/PAM, HIPAA Security Rule Compliance, Phishing, Security Monitoring, Vulnerability Management, Application Security, Governance, Data Security, and Cloud Security.


text: The Company's CISO is responsible for developing and managing the cybersecurity program, including security incident response, remediation, and setting security policy and standards required by applicable law or regulation. The CISO holds a dual-accredited Executive MBA, and Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), Certified Data Privacy Solutions Engineer (CDPSE) certifications. The security team holds multiple certifications including but not limited to CISSP, CRISC, CCSFP, and AWS CP, a bug bounty hall of fame member, and a range of experience with different firms. The CISO is informed by the cybersecurity team about the prevention, detection, mitigation, and remediation of cybersecurity incidents through general communications, and reporting. The cybersecurity team is made aware of security risks and incidents by various means including our SIEM, assessments, audit, threat feeds, and security team connections and network.


text: Depending on the circumstances, information regarding cybersecurity risks and incidents may be elevated from the CISO and his team through a variety of different channels, including risk response forms as part of our formal security risk process, discussions with the Audit Committee and reports to the Board on a quarterly basis.


text: Among other things, the program includes the following components: • security event monitoring and detection; • extended detection and response; • vulnerability scanning; • security awareness and privacy training for personnel; • phishing simulations; and • a cybersecurity incident response team. The Company also engages third-party vendors and consultants, respectively, to perform audits and penetration tests.


text: The Company and its subsidiaries' third-party service providers collect, process, and store certain information, including PII, PHI, or other confidential and proprietary information. We maintain a third-party vendor security risk management program to assess the cybersecurity risk and measures taken by such service providers. The program includes a third-party risk assessor, security risk reports, and formal business owner risk response.


text: During the period covered by this report, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Risks from cybersecurity threats, however, in the future may, among other things, cause material disruptions to our or our subsidiaries' operations, which may materially affect our liquidity, results of operations and financial condition, as well as damage our reputation. For additional information related to risks from cybersecurity threats, please refer to Item 1.A. — "Risks Related to Our Business and Industry — Our failure to protect our sites, networks, and systems against security breaches, or otherwise to protect our confidential or health information or the confidential or health information of our members, providers, or other third parties, could damage our reputation and brands, and substantially harm our business and results of operations."


text: The Company's Board of Directors (the "Board") oversees the Company's overall risk management program, and has assigned oversight of cybersecurity risk management to its Audit Committee. The Audit Committee reviews the adequacy and effectiveness of the Company's cybersecurity policies and internal controls regarding information and cybersecurity, and together with the full Board, regularly receives reports from our management, including our Chief Information Security Officer (the "CISO") on cybersecurity matters, including, but not limited to: AI Security, Security Awareness, Internal Risk, Third-Party Risk, IR / DR Readiness, Access Control IAM/PAM, HIPAA Security Rule Compliance, Phishing, Security Monitoring, Vulnerability Management, Application Security, Governance, Data Security, and Cloud Security.


text: The Company's CISO is responsible for developing and managing the cybersecurity program, including security incident response, remediation, and setting security policy and standards required by applicable law or regulation. The CISO holds a dual-accredited Executive MBA, and Certified Information Security Manager ("CISM"), Certified Information Systems Auditor ("CISA") and Certified Data Privacy Solutions Engineer ("CDPSE") certifications. The security team holds multiple certifications including but not limited to CISSP, CRISC, CCSFP, and AWS CP, a bug bounty hall of fame member, and a range of experience with different firms. The CISO is informed by the cybersecurity team about the prevention, detection, mitigation, and remediation of cybersecurity incidents through general communications, and reporting. The cybersecurity team is made aware of security risks and incidents by various means including our SIEM, assessments, audit, threat feeds, and security team connections and network.


text: The Company's information security program is managed by a dedicated Chief Technology Officer ("CTO"), who has over 25 years of professional experience within information technology roles, including 15 years of security consulting experience. The CTO leads the information technology department, which is responsible for enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Company's Cybersecurity Incident Response Committee (the "CIRC"), which is comprised of the Company's CTO, Chief Financial Officer, General Counsel, Senior Vice President of Financial Reporting and Technical Accounting, and Senior Director of Internal Audit, meets periodically and more often, as needed, in the event cybersecurity incidents are identified.

companyName: MP Materials Corp. / DE

ticker: MP


text: As part of the Company's overall risk assessment process, the enterprise risk management framework considers cybersecurity risk alongside other company risks. The Company's internal audit department collaborates with the Company's information technology department to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations. The Company actively engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to evaluate and enhance the effectiveness of its information security policies and procedures.


text: In addition, the Company's vendor management program addresses cybersecurity risks associated with its use of third-party service providers including suppliers, software and cloud-based service providers. The Company proactively evaluates the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, threat intelligence during contracting, and vendor selection processes. Security issues are documented and tracked, and periodic monitoring of third parties is conducted in an effort to mitigate risk.


text: The Company's CTO provides periodic reports to the Audit Committee of the Company's Board of Directors, as well as the CIRC, as appropriate. These periodic reports include updates on the Company's cyber risks and threats, the status of projects to strengthen its information security systems, assessments of the information security program, and the emerging threat landscape. The information security program is regularly evaluated by the CTO with the results of those reviews reported to the CIRC, the Audit Committee of the Company's Board of Directors, and the Board of Directors, as appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected nor are they reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: The Company's information security program is managed by a dedicated Chief Technology Officer ("CTO"), who has over 25 years of professional experience within information technology roles, including 15 years of security consulting experience. The CTO leads the information technology department, which is responsible for enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Company's Cybersecurity Incident Response Committee (the "CIRC"), which is comprised of the Company's CTO, Chief Financial Officer, General Counsel, Senior Vice President of Financial Reporting and Technical Accounting, and Vice President of Internal Audit, meets periodically and more often, as needed, in the event cybersecurity incidents are identified.


text: As part of the Company's overall risk assessment process, the enterprise risk management framework considers cybersecurity risk alongside other company risks. The Company's internal audit department collaborates with the Company's information technology department to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations. The Company actively engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to evaluate and enhance the effectiveness of its information security policies and procedures. Additionally, the Company provides cybersecurity awareness training to its employees, incident response personnel, and senior management.


text: Furthermore, the Company's vendor management program addresses cybersecurity risks associated with its use of third-party service providers including suppliers, software, and cloud-based service providers. The Company proactively evaluates the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, threat intelligence during contracting, and vendor selection processes. Security issues are documented and tracked, and periodic monitoring of third parties is conducted to mitigate risk.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats (including those associated with third-party service providers), and have integrated these processes into our overall enterprise risk management systems and processes. We routinely assess material risks from cybersecurity threats, including taking reasonable steps to detect any potential unauthorized occurrence on or behaviors conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Skillz Inc.

ticker: SKLZ


text: Risk Management and Strategy We have implemented policies and processes designed to detect, prevent, and respond to cybersecurity incidents. All these policies are reviewed annually and updated as needed to address emerging risks or gaps in compliance. The Company has not experienced a material cybersecurity incident to date. If a material cybersecurity breach occurs, the incident will be reviewed to determine whether further escalation is appropriate. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive leadership team and if deemed necessary, the Board of Directors. We plan to consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and make the final materiality determination regarding disclosure and other compliance decisions. We also plan to keep our independent public accounting firm informed of such incidents as appropriate. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. Although our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: Role of the Board and Management Our Board of Directors has the ultimate responsibility for oversight of our risk management framework. The Board receives information and periodic updates and actively engages with management with respect to the effectiveness of the Company's cybersecurity and information security framework, data privacy, and risk management. In addition, as necessary, the Board of Directors receives reports summarizing threat detection and mitigation plans, audits of internal controls, training and certification, and other cyber priorities and initiatives, as well as timely updates from management on material incidents relating to information systems.


text: Role of Other Employees Members of the Company's technology and security team periodically discuss cybersecurity program updates and challenges, to watch for potential threats from both external and internal sources, to monitor compliance in existing or emerging business practices, and to respond to stakeholder inquiries. This is composed of individuals with over 10 years of software, infrastructure, and security experience. The Company is continuously monitoring trends and stays current with the various cybersecurity threats and related mitigation opportunities. The Company periodically engages a third-party service provider to perform an external vulnerability scan of the Company's network to identify known threats and to date no critical vulnerabilities have been identified during these assessments.


text: We take a comprehensive approach to cybersecurity risk management. While securing our customers and stakeholders' data is a top priority, like many companies with a public presence, we are subject to human-targeted and AI-assisted cyberattacks. Our board of directors (the "Board") and our management are involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices designed to assess, identify, and manage material risks from cybersecurity threats. We have devoted significant financial and personnel resources to implement and maintain security measures in an effort to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments in our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be effective, as cyber criminals are becoming more sophisticated and effective every day and increasingly targeting enterprise software companies. Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that such incidents will not materially affect us, including our business strategy, results of operations, or financial condition. For the year ended December 31, 2024, we are not aware of any material cybersecurity incidents that had a significant impact on our operations or financial condition. For more information on our cybersecurity related risks see the risk factor entitled "We rely on information technology ("IT") and other systems and platforms, and any failures, errors, defects or disruptions in our or our vendors' or other partners' systems or platforms could diminish our brand and reputation, subject us to liability, disrupt our business, affect our ability to scale our technical infrastructure and adversely affect our business, financial condition, operating results and growth prospects" in Part I, Item 1A Risk Factors of this Annual Report on Form 10-K, above.


text: Risk Management and Strategy Our policies, standards, processes and practices designed to assess, identify, and manage material risks from cybersecurity threats are integrated into our overall risk management program. These policies, standards, processes, and practices are based on maintaining a security-in-depth methodology as informed by the National Institute of Standards and Technology ("IST") Cybersecurity Framework, the International Organization for Standardization ("ISO")/IEC 27001 and other applicable industry standards. Key controls include: (a) Zero trust network architecture for employee privileged and non-privileged application access (b) Mandatory employee security awareness training and phishing simulations, plus follow-up remedial training if necessary,(c)Periodic third-party network and host vulnerability scans and (d) 24/7 Security Operations Center monitoring all corporate endpoints which escalates to senior engineering resources as necessary for incident response and remediation. We also maintain a cyber insurance policy to mitigate financial exposure from any security incidents.


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet periodically to develop strategies designed to preserve the confidentiality, integrity and availability of Company and customer information, identify, prevent and mitigate cybersecurity threats, and to attempt to effectively respond to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in an informed and timely manner.


text: We conduct a cybersecurity risk assessment at least annually that takes into account information from internal resources (e.g., vulnerability scans, incident reporting), known information security vulnerabilities, and information received from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants).


text: Technical Safeguards We periodically assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are periodically evaluated and improved as necessary, based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: Incident Response and Recovery Planning We have established comprehensive incident response ("IR") and recovery plans and continue to periodically test and evaluate the effectiveness of those plans. Our IR plan provides our team with strategies for how to respond to incidents appropriately.


text: Third-Party Risk Management We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers may be subject to security risk assessments at the time of onboarding, contract renewal, or upon detection of an increase in risk profile, according to our vendor security review process. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties.


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We periodically remind and reinforce with our employees the importance of handling and protecting customer and employee data, including through annual privacy and security training designed to enhance awareness of how to prevent, detect, report, and respond to cybersecurity threats. We also conduct periodic phishing training and follow-up with remedial testing and training as necessary.


text: External Assessments Our cybersecurity policies, standards, processes and practices are periodically assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. For example, in 2022, 2023 and 2024 we conducted independent cyber maturity assessments to review our controls against portions of the NIST Cybersecurity Framework. We also have achieved PCI SAQ-A Compliance every year since 2019. The results of significant assessments are reported to management, the Board and Audit Committee. Cybersecurity processes are adjusted, as appropriate, based on the information provided from these assessments.


text: Our Principal Security Engineer ("PSE") is responsible for the day-to-day assessment and management of our material cybersecurity risks. Since November 2021 until May 2025, the Principal Security Engineer (the "PSE-1") that served in this role had more than 18 years of experience in various information technology, cybersecurity and systems engineering roles. PSE-1's previous experience includes building and leading cybersecurity functions at large enterprises, startups, and research and development centers, as well as leading software teams which were acquired by Fortune 50 enterprises. PSE-1 also had expertise in building and designing secure software, scalable and resilient systems, incident response practices, privacy programs and other critical security disciplines and practice areas. The Principal Security Engineer holds a master's degree in physics and systems engineering. Since May 2025, the Company's Manager of IT ("PSE-2") has assumed the responsibilities of the Principal Security Engineer role. With more than 18 years of experience in information technology and over 12 years in IT management across technology-driven and interactive entertainment organizations, PSE-2 has frequently led both IT operations and cybersecurity initiatives, often as the sole technical lead. Responsibilities have included securing infrastructure, implementing security controls, and supporting secure business operations.


text: To ensure robust oversight, we are establishing a Security Council, led by our Principal Security Engineer, that is comprised of senior leaders, including our Chief Executive Officer, Controller, Chief Financial Officer, and Interim General Counsel. The Security Council has primary management oversight responsibility for assessing and managing risks related to information security, fraud, vendor oversight, data protection and privacy, and our cybersecurity program, as well as responsibility for management of our information security systems.


text: The Board is responsible for overseeing the Company's enterprise risk. The Security Council reports to the Board on cybersecurity risks. In addition to our ongoing ordinary course cybersecurity oversight procedures, we also have a security incident response framework in place. We use this incident response framework as part of the process we employ to keep our management and the Board informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The framework is a set of coordinated procedures and tasks that our incident response team, under the direction of the Security Council, executes in the event of a cybersecurity incident that is designed to provide timely and accurate information flow, escalation for remediation and consideration of public disclosures, and resolution of cybersecurity incidents. Our cybersecurity framework includes periodic compliance assessments with our policies and standards and applicable state and federal statutes and regulations. In addition, we seek to validate compliance with our internal data security controls through the use of security monitoring utilities and internal and external audits. We also conduct annual cybersecurity tabletop exercises, with the intent of validating our IR policies and procedures.


text: Risk management and strategy We have implemented and maintain information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature ("Information Systems and Data").

companyName: Origin Materials, Inc.

ticker: ORGN


text: The Director of IT and General Counsel are responsible for helping to identify, assess and manage the Company's cybersecurity threats and risks by monitoring and evaluating our threat environment using, among other things, manual processes, automated tools, internal audits, threat and vulnerability assessments, evaluating threats reported to us, evaluating our and our industry's risk profile, and subscribing to reports and services that identify cybersecurity threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include, for example, an incident response plan and team, data encryption, risk assessments, network security and access controls, physical security, asset management, tracking, and disposal, systems monitoring, employee training including tabletop exercises and other simulated cybersecurity threats, and cybersecurity insurance. In addition, to oversee and identify any risks associated with our use of third-party service providers, we review Service Organization Controls ("SOC") reports of such third-party service providers when onboarding the provider and annually thereafter. We also maintain proper essential information sharing and access controls, aiding in the secure exchange of information between us and our third-party service providers.


text: Assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Director of IT coordinates with our General Counsel and representatives of the Company's departments and teams to evaluate the Company's risk profile and identify and mitigate cybersecurity threats. Our General Counsel evaluates material risks from cybersecurity threats and reports to both the Company's executive management team and the Audit Committee of the Board of Directors. We also use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, data backup and recovery providers, cyber insurers, and legal counsel.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function and has delegated to the Audit Committee primary responsibility for monitoring the Company's cybersecurity risk management processes, including mitigation of cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of the Company's management. In particular, the Director of IT and General Counsel are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes and technologies, and reviewing security assessments and other security-related reports. In addition, the General Counsel provides regular reports to the Audit Committee concerning the Company's cybersecurity posture and significant threats and risks and the processes to address them.


text: Our security incident response plan ("SIRP") is designed to escalate certain cybersecurity incidents to members of the Company's executive management team depending on the circumstances. The General Counsel, Director of IT, and relevant department heads work with our incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. The SIRP provides for escalation of potentially material cybersecurity incidents to the Audit Committee.


text: Our VP of Technology and Director of IT, together with our managed service provider ("MSP"), are responsible for helping to identify, assess and manage the Company's cybersecurity threats and risks by monitoring and evaluating our threat environment using, among other things, manual processes, automated tools, internal audits, threat and vulnerability assessments, evaluating threats reported to us, evaluating our and our industry's risk profile, and subscribing to reports and services that identify cybersecurity threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data. These include, for example, an incident response plan and team, data encryption, risk assessments, network security and access controls, physical security, asset management, tracking, and disposal, systems monitoring, employee training including tabletop exercises and other simulated cybersecurity threats, and cybersecurity insurance. In addition, to oversee and identify any risks associated with our use of third-party service providers, we review Service Organization Controls ("SOC") reports of such third-party service providers when onboarding the provider and annually thereafter. We also maintain proper essential information sharing and access controls, aiding in the secure exchange of information between us and our third-party service providers.


text: Assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Director of IT coordinates with our VP of Technology and representatives of the Company's departments and teams to evaluate the Company's risk profile and identify and mitigate cybersecurity threats. Our General Counsel evaluates material risks from cybersecurity threats and reports to both the Company's executive management team and the Audit Committee of the Board of Directors. We also use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, data backup and recovery providers, cyber insurers, and legal counsel.


text: Our Board of Directors (the "Board") addresses the Company's cybersecurity risk management as part of its general oversight function and has delegated to the Audit Committee primary responsibility for monitoring the Company's cybersecurity risk management processes, including mitigation of cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of the Company's management. In particular, the VP of Technology and Director of IT are responsible for hiring appropriate personnel and helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes and technologies, and reviewing security assessments and other security-related reports. In addition, the General Counsel provides regular reports to the Audit Committee concerning the Company's cybersecurity posture and significant threats and risks and the processes to address them.


text: Our security incident response plan ("SIRP") is designed to escalate certain cybersecurity incidents to members of the Company's executive management team depending on the circumstances. Our VP of Technology, Director of IT, General Counsel, and MSP, along with relevant department heads, work with our incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. The SIRP provides for escalation of potentially material cybersecurity incidents to the Audit Committee.


text: Risk Management and Strategy We have a dedicated team focused on cybersecurity and we maintain a cybersecurity program designed to protect our systems, technology infrastructure, operations and the data entrusted to us by our employees and counterparties. Our cybersecurity program is led by our Chief Technology Officer, who is a part of our senior leadership team and works closely with our team to develop and advance our cybersecurity strategy and regularly reports to our board of directors and the audit committee of our board of directors on cybersecurity matters.

companyName: Royalty Pharma plc

ticker: RPRX


text: Cybersecurity threats are assessed as part of our enterprise risk management assessments. Our cybersecurity strategy includes procedures for identifying material cybersecurity risks, prioritizing risks and analyzing risk mitigation. Our cybersecurity strategy also includes developing and implementing policies and procedures, escalating any issues as necessary that present a material risk and ensuring that all employees have sufficient cybersecurity training. We have engaged consultants and other third parties in connection with our enterprise risk management assessments, including with respect to cybersecurity.


text: We conduct regular testing to identify vulnerabilities before they can be exploited by attackers. We examine and validate our program with third parties, measuring it against industry standards and established frameworks to help identify areas for focus, improvement and compliance. We have comprehensive plans to ensure that any non-routine events are properly escalated. These plans are validated through cyber incident exercises to consider the types of decisions that would need to be made in the event of a cyber incident. We have engaged in scenario planning exercises around cyber incidents with cybersecurity consultants in this process.


text: Our security awareness platform aims to reduce vulnerabilities in our systems if they are the target of phishing or social engineering through simulations of attacks coupled with employee training. We assess third party vendors who have access to our data or systems to measure their adherence to relevant industry practices and standards, including due diligence and monitoring compliance with security assessments.


text: In 2023, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors—Cybersecurity vulnerabilities or other failures in information systems could result in information theft, data corruption and significant disruption of our business operations."