text: Our cybersecurity program is focused on the following areas: • Governance: We leverage multiple cybersecurity frameworks (e.g., ISO 27001 and NIST CSF) and regulatory requirements to inform our externally managed information technology ("IT") infrastructure. Policies for IT use and management for each employee are part of the employee onboarding process and those policies are refreshed periodically as threats emerge that could be relevant to our IT infrastructure. • Technical Safeguards: The Company does not use a centralized server where all information is stored and therefore where all information is placed at risk. Instead, we deploy technical and procedural measures using a distributed model so that no one location or machine could cripple the company's IT infrastructure. Protection measures include network firewalls, network intrusion detection and prevention, penetration testing, vulnerability assessments and monthly risk assessments and management, threat intelligence, anti-malware and access controls, plus data loss prevention and monitoring. • Security Awareness / Training: All employees are required to adhere to our Standards of Business Conduct, which identifies an employee's responsibility for information security. We also disseminate security awareness information periodically throughout the year. • Third-Party Suppliers and Service Providers: We manage our IT infrastructure with an external vendor who maintains and evaluates risk exposure in real-time and conducts monthly risk assessments and adjustments to preclude cyberattacks. Vendor security reviews evaluate numerous key security controls and the outputs of these reviews are used as part of business decisions regarding storage and dissemination of virtual data and to assess a vendor's overall security posture.


text: Risks from Cybersecurity Threats While we are subject to ongoing cybersecurity threats, the risks from these threats have not materially affected, or are reasonably likely to materially affect the company, including our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, see "Item 1A. Risk Factors-Risks Related to Our Operations" in this Annual Report.

companyName: Inhibikase Therapeutics, Inc.

ticker: IKT

secItem: Item 1C


text: Board Oversight of Cybersecurity Risks Our Board of Directors (Board) is responsible for the oversight of our risk management program and regularly reviews information regarding our most significant strategic, operational, financial, legal and compliance risks, including cybersecurity risks. The Board reviews mitigation plans through discussions with management, which includes regular Board reports and findings from management's monthly discussions with our outside IT group. Our Board of Directors also reviews and approves our cybersecurity policies, strategies, and budgets on an annual basis.


text: Management's Role in Assessing and Managing Cybersecurity Risks Our CEO in conjunction with our external IT team are responsible for setting the strategy and communicating cybersecurity risks. With the Company's distributed model of data storage, risks have been limited and the Company has not experienced a cybersecurity breach. The Company's security measures and monthly system audits to identify potential vulnerabilities and remediate deficiencies in real time.


text: Chemours recognizes the critical importance of maintaining a cybersecurity program to provide a secure and reliable computing environment protecting the Company's information, systems and assets and to enable our digital transformation goals. Our cyber and information security program (the "Program") is based upon standards published by the National Institute of Standards and Technology ("NIST") in their Cybersecurity Framework. The goals of our Program are: • identifying, preventing, and mitigating cybersecurity threats to the Company; • preserving the confidentiality, security, and availability of the information that we collect and store to use in our business; • protecting the Company's intellectual property; • maintaining the confidence of our customers, business partners and other stakeholders; and • providing appropriate public disclosure of cybersecurity risks and incidents, when required.

companyName: Chemours Co

ticker: CC


text: The Chief Information Security Officer ("CISO") is the Chemours executive principally responsible for managing and maintaining the Program, is accountable for managing risk, ensuring that the organization's security posture is aligned with its business objectives, and providing timely updates to senior management on such efforts. The CISO reports to the Interim Enterprise Transformation Leader. The current CISO has more than six years with Chemours and over 25 years of total cyber and information security experience with multiple companies across both the private and public sector in CISO and other information security roles.


text: The CISO manages and is supported by a global team of risk managers, cyber defenders, architects, and engineers with the knowledge and experience to carry out day-to-day cybersecurity operations. They are also supported by third parties who provide threat intelligence, global infrastructure monitoring, and threat detection and response to cyber events. In addition, our Corporate Security team, a part of the Legal organization, has open lines of communication with various Federal, State and International law enforcement agencies to gain access to the latest cyber situational awareness.


text: We assess third-party cybersecurity controls through a cybersecurity questionnaire and include information security and privacy addendums to our contracts, where applicable. We also require that our vendors and other third parties report cybersecurity incidents to us so that we can assess the impact of the incident on us.


text: Chemours educates its employees and contractors annually on cyber risks and prevention, monthly using online situational awareness training, active employee engagement, and ongoing phishing simulations.


text: The CISO has an incident response plan designed to address potential cybersecurity incidents and notify appropriate leadership while determining the material impact through a cyber sub-committee of management's Disclosure Committee. The plan also includes implementing long-term strategies for recovery and prevention of future incidents.


text: We manage the cybersecurity risk under our Enterprise Risk Management ("ERM") program, where we assess key risks within the Company. The board of directors is responsible for oversight of the Company's enterprise risk management and is informed of the risks associated with cybersecurity through periodic ERM updates. A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises, threat modeling, and other exercises focused on evaluating the effectiveness of the Program.


text: The Chemours Company The Audit Committee is central to the board of directors' oversight of cybersecurity and regularly meets with the CISO to review and discuss cybersecurity risks, the status of ongoing cyber initiatives and strategies, incident reports and learnings, as well as key performance indicators. The results of any cyber risk assessments, audits, and reviews are reported to the Audit Committee and the board of directors, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: Although our Risk Factors include further details about the cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program, and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Adviser's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and are fully integrated into the Adviser's overall risk management processes. In general, the Adviser seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Adviser's information systems or the information that the Adviser collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: TCW Direct Lending VIII LLC


text: Cybersecurity Risk Management and Strategy The Adviser's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Adviser has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Adviser's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: The Adviser implements technical safeguards that are designed to protect the Adviser's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as assistance from third party experts where necessary. • Incident Response and Recovery Planning: The Adviser has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Adviser's response to a cybersecurity incident. The Adviser conducts occasional tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Adviser maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Adviser's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside consultants who advise on the Adviser's cybersecurity systems. • Education and Awareness: The Adviser provides regular, mandatory training for all levels of personnel regarding cybersecurity threats as a means to equip the Adviser's personnel with effective tools to address cybersecurity threats, and to communicate the Adviser's evolving information security policies, standards, processes, and practices.


text: The Adviser conducts periodic assessment and testing of its policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. This includes penetration testing of network infrastructure and phishing tests targeting the Adviser's employees. The results of such assessments and reviews are evaluated by management and reported to the Board, and the Adviser adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments and reviews.


text: The Board, in coordination with the Adviser, oversees the Company's risk management program, including the management of cybersecurity threats. The Board receives regular updates and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by the Company'. The Board also receives prompt and timely information regarding any material cybersecurity risk, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Adviser discuss the Company's approach to overseeing cybersecurity threats.


text: The Adviser has established an internal working group that includes relevant representation from senior management including the CCO, COO and CISO who work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through ongoing communication with these teams, the CISO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate.


text: The CISO has served in various roles in information technology and information security for many years and holds relevant professional certifications. The Adviser's COO and CCO each hold educational and professional degrees in their respective fields, and each has numerous years of experience managing risk at the Company and at similar companies, including assessing cybersecurity threats.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


companyName: TCW Star Direct Lending LLC


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Erasca, Inc.

ticker: ERAS


text: Our program is developed and informed by industry best practices such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and input from expert third-party consultants. It's important to note that our adoption of the NIST CSF serves as a blueprint to aid in the identification, assessment, and mitigation of cybersecurity risks pertinent to our operations, rather than as a certification of compliance with specific technical standards or requirements.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise IT environment; an IT security team (including Chief Operating Officer (COO)) principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: In the near-term our cybersecurity risk management program will include a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives reports from management on our cybersecurity risks no less than twice per calendar year. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Operating Officer as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Operating Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Collectively, the IT security team that is responsible for managing our cybersecurity risks has over 50 years of experience in mitigating cybersecurity risks.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal IT personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by cybersecurity tools deployed in the IT environment.


text: We strive to safeguard our important data, hardware, and internal network from digital attacks, theft and damage. In the ordinary course of our business, we collect, use, store, and digitally transmit confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. At Gyre Therapeutics, these processes are managed and monitored by a third-party information technology ("IT") consulting company (the "Managed Service Provider") and are overseen by our Chief Financial Officer. At Gyre Pharmaceuticals, these processes are managed and monitored by a dedicated IT team, which is led by the General Manager. Gyre Therapeutics' and Gyre Pharmaceuticals' processes include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data. For example, Gyre Therapeutics and Gyre Pharmaceuticals maintain software and hardware inventories, perform security monitoring and alerting, and complete ongoing risk assessments. Gyre Therapeutics and Gyre Pharmaceuticals also conduct regular employee trainings on cyber and information security, among other topics. In addition, both companies consult with outside advisors and experts on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: GYRE THERAPEUTICS, INC.

ticker: GYRE


text: Our Chief Financial Officer, who reports directly to our Chief Executive Officer, is responsible for assessing and managing Gyre Therapeutics' cybersecurity risks with support from the Managed Service Provider, which employs IT consultants with over 20 years of experience managing information technology and cybersecurity matters and are certified as Microsoft Certified Systems Engineers. Our Gyre Pharmaceuticals IT department senior supervisor, who reports directly to our General Manager at Gyre Pharmaceuticals and has over 20 years of experience managing information technology and cyber security matters, is responsible for assessing and managing Gyre Pharmaceuticals' cybersecurity risks. Our General Manager at Gyre Pharmaceuticals reports the Board of Directors. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Breach, failure or disruption in or to our information system could compromise sensitive information related to our business and expose us to liability or reputational harm, and our ability to effectively manage our business operations could be adversely affected."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our management team. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Risk Management and Strategy The Trust's cybersecurity risk management is established and governed by the Sponsor. The Sponsor determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for the Trust and the Trust relies on the Sponsor for assessing, identifying and managing material risks to the Trust's business from cybersecurity threats. The Sponsor's cybersecurity policies and practices are set out in the Sponsor's compliance manual and are reviewed on an annual basis. In addition, all officers of the Sponsor and all employees of Bitwise receive annual compliance training and annual cybersecurity training. Attendance at the annual cybersecurity training and the annual compliance training is tracked and recorded.

companyName: Bitwise Bitcoin ETF

ticker: BITB


text: The Sponsor engages a selection of third-party experts ("Experts") to assist its internal legal, compliance and engineering personnel in developing, implementing and testing its cybersecurity policies and procedures. The Experts assist in performing assessments, penetration tests and reviewed areas of potential vulnerability. In addition, the Experts work with the Sponsor to conduct cybersecurity training, exercises and quarterly internal phishing tests. The Sponsor uses the findings of such exercises and campaigns to improve its practices, procedures, and technologies. The Sponsor also engages the Experts to support its cybersecurity threat and incident response management and maintains information security risk insurance coverage.


text: The Sponsor conducts due diligence on the Experts and all third-party service providers both at the beginning of any contractual relationship and on an ongoing, periodic basis. The Sponsor reviews a selection of all of its service providers on an annual basis, with specific emphasis on any service providers deemed to be high risk and utilizes external compliance partners to assist with this review. As part of this review, the Sponsor tracks any identified deficiencies and requires that its third-party service providers have in place appropriate technical and organizational security measures and security-control principles based on recognized cybersecurity standards. The Sponsor also obtains contractual assurances from third-party service providers relating to their security responsibilities, controls, reporting, and roles and responsibilities as it pertains to cybersecurity incident response policies and notification requirements.


text: While neither the Sponsor nor the Trust has experienced a material cybersecurity incident, cybersecurity threat risks may materially affect either the Sponsor or the Trust, including the Trust's business strategy, results of operations or financial condition.


text: The Trust does not have any directors, officers or employees. Under the Trust Agreement, all management functions of the Trust have been delegated to and are conducted by the Sponsor, its agents and its affiliates. Hong Kim, the Chief Technology Officer of Bitwise is responsible for assessing and overseeing the Sponsor's and the Trust's cybersecurity risks and providing direction and oversight for risk mitigation action in conjunction with Katherine Dowling, the General Counsel, Chief Compliance Officer and Vice President of the Sponsor. Mr. Kim graduated from the University of Pennsylvania with a Bachelor of Science in Computer Science, and, prior to Bitwise, worked on Google's backend infrastructure for Google Drive and worked in software security for the South Korean military. Ms. Dowling has served as a Chief Compliance Officer at various companies since 2015 and has more than ten years of experience as an Assistant U.S. Attorney, most recently in the Economic Crimes Unit of the U.S. Attorney's Office for the Northern District of California. Mr. Kim and Ms. Dowling receive periodic reports from the Experts and members of the Sponsor's Legal and Compliance team who take part in cybersecurity review, implementation, training and testing.


text: Bitwise, the parent of the Sponsor, has a board of directors that is ultimately responsible for managing and directing the affairs of the Sponsor, including maintaining oversight of risks from cybersecurity threats. Mr. Kim serves on the Bitwise board of directors. Ms. Dowling serves as the General Counsel and Chief Compliance Officer and is on the Executive Management Team of Bitwise and therefore is able to report directly to Bitwise's board of directors regarding cybersecurity risks to the Trust and the Sponsor.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Mereo BioPharma Group plc

ticker: MREO


text: We design and assess our program based on the U.K. Cyber Essentials and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • Identification and Reporting: We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents to our critical systems, information and our enterprise information technology environment. Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Third Party Risk Management: We use external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls. We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third party systems, including any service providers, suppliers, and vendors that have access to our critical systems and information. • Education and Training: We provide annual cybersecurity awareness training and on-going phishing simulation testing for our employees, incident response personnel and senior management in order to communicate evolving information security policies, standards, processes and practices and to provide them with the tools to make them aware of processes on addressing cybersecurity threats. • Incident Response and Recovery Planning: We maintain incident response, business continuity, and disaster recovery plans designed to address our response to a cybersecurity incident.


text: We have not identified any specific risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section "Item 1A. Risk Factor—Risks Related to Healthcare Laws and Other Legal Compliance Matters—Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the audit and risk committee oversight of cybersecurity and other information technology risks. The audit and risk committee oversees management's implementation of our cybersecurity risk management program.


text: Material cybersecurity risks are identified by members of our team. Our Head of IT is primarily responsible for managing our cybersecurity risk assessment processes, including those described in "Cybersecurity Risk Management and Strategy" above, our security controls and our response to cybersecurity incidents, with assistance from third party service providers.


text: The audit and risk committee receives periodic reports and briefings from management on our cybersecurity risks. In addition, management updates the audit and risk committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The audit and risk committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal IT personnel; threat intelligence and other information obtained from governmental, public or private sources, including third party service providers engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: The Fund has processes in place designed to assess, identify, and manage material risks from cybersecurity threats. The Fund's business is dependent on the communications and information systems of the Investment Adviser and other third-party service providers. The Investment Adviser manages the Fund's day-to-day operations and has implemented a cybersecurity program that applies to the Fund and its operations.

companyName: John Hancock Comvest Private Income Fund


text: Cybersecurity Program Overview The Investment Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Fund. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Fund relies. The Investment Adviser, together with external consultants, actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Fund.


text: The Fund relies on the Investment Adviser's compliance and risk management program and processes, which include periodic review of the Investment Adviser's cybersecurity program.


text: The Fund depends on and engages various third parties, including service providers, to operate its business. The Fund relies on its Chief Compliance Officer ("CCO") and the expertise of risk management, legal, information technology, and compliance personnel of the Investment Adviser when identifying and overseeing risks from cybersecurity threats associated with its use of such entities.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the Investment Adviser regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Investment Adviser's operations, including those related to the Fund.


text: Management's Role in Cybersecurity Risk Management The Fund's management, including the Fund's CCO and a Technology Risk and Information Security Committee (the "Committee") established by the Investment Adviser, manage the Fund's cybersecurity program. The CCO of the Fund oversees the Fund's oversight function generally and relies on the Investment Adviser's Committee to assist with assessing and managing material risks from cybersecurity threats. The Committee is chaired by an outside cybersecurity and information technology expert, and its other members are the Investment Adviser's CFO, General Counsel, and Director of Information Technology. The CCO has been responsible for this oversight function since the Fund's inception and has worked in the financial services industry for more than 25 years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Fund.


text: The Fund's Senior Management team is regularly informed regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, and/or other comparable SEC regulated investment funds and their managers, including through the receipt of notifications from service providers and reliance on communications with operations, risk management, legal, information technology, and/or compliance personnel of the Investment Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Fund are assessed on an ongoing basis, and how such risks could materially affect the Fund's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Fund has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Fund believes have materially affected, or are reasonably likely to materially affect, the Fund, including its business strategy, operational results, and financial condition. The CCO monitors best-practices and developments in data privacy and security, including increased scrutiny of third-party service providers with access to sensitive company data. The CCO continues to work with key third-party service providers to monitor and support the control environment and breach notification processes.


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Advisor and other third-party service providers. The Advisor manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Kennedy Lewis Capital Co


text: Cybersecurity Program Overview The Advisor has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Advisor actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Advisor to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Advisor's risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on its Chief Compliance Officer ("CCO") and the expertise of risk management, legal, information technology, and compliance personnel of the Advisor when identifying and overseeing risks from cybersecurity threats associated with its use of such entities.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the CCO of the Advisor regarding the overall state of the Advisor's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, and the CCO of the Advisor, manage the Company's cybersecurity program. The CCO is responsible for monitoring and reporting to the board about the Adviser's compliance with its responsibilities for the Adviser's and the Company's cybersecurity program. The CCO has been responsible for this oversight function as CCO to the Company since inception and has worked in the financial services industry for more than 30 years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Advisor.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Risk Management & Strategy. AVD has adopted a comprehensive set of controls and processes to encourage a high level of awareness of, and responsiveness to, cybersecurity threats. The foundational document outlining the program is embodied in Registrant's Enterprise Information Security Policy (the "REIS Policy"). The REIS Policy establishes a framework for the continuous monitoring of its computing resources, the maintenance and reporting of audit logs and the assessment of events that could form the basis of a threat. In addition, the REIS Policy sets forth requirements for employee awareness training, user authentication, software usage restrictions and boundary protection, among other things. The policy also establishes an incident response plan, including back-up hosting, alternate processing and system recovery, along with assignment of responsibility and resources for those activities. Within the exhibit of the REIS Policy, management either working alone or, in case of greater complexity, with consultants, will assess an incident or series of incidents for materiality, taking into account the nature of the incident,, duration, the nature of data compromised, and the nature of damages (including with respect to reputational, third party, share price, and business interruption) and all within the context of the Company's financial performance during the affected reporting period(s).

companyName: AMERICAN VANGUARD CORP

ticker: AVD


text: Furthermore, AVD has taken measures to prevent cybersecurity breaches, to minimize threats and, to the extent possible, to anticipate trends and identify vulnerabilities before arising to the level of an incident. In short, AVD is pro-active in its approach and has formulated a specific plan to investigate, respond and minimize loss of functionality or other damage from an incident. There are no cybersecurity threats, including as a result of prior incidents, that have materially affected the Company, including our business strategy, results of operations or financial condition as of the date hereof to our knowledge.


text: Governance. The REIS Policy has been drafted in collaboration with one of the largest IT solutions providers in the field and was modeled after NIST standards relating to governance, documentation and processes. The Company is implementing the REIS Policy through its Cyber and Privacy Risk Steering Committee (the "CPRSC"), which is chaired by the Chief Administrative Officer (who is also AVD's Risk Manager) and includes cross functional business process owners from operations, sales, marketing, finance and Human Resources, as well as our Director of Information Technology, who alone has over 30 years' experience in IT-related security and whose staff collectively has over 50 years' experience in this area. In addition, the committee is advised by a virtual Corporate Information Security Officer who works with the third-party solutions provider.


text: AVD's Board of Directors maintains oversight of cybersecurity planning, response and reporting as follows. The Lead Director, Scott Baskin, who also serves as Chair of the Risk Committee and member of the Audit Committee, is Cybersecurity Liaison to AVD's management team. The Chair of the CPRSC reports on cybersecurity preparedness, issues and incidents to the Cybersecurity Liaison regularly. Through this reporting structure, the cybersecurity team has direct interaction with the highest level of the Board and with both the Risk and Audit Committees. Cyber risk has been a subject of regular review and discussion at the Risk Committee for several years. With the advent of the CPRSC, the delineation of governance and responsibility has become that much more focused.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing the risks from foreseeable cybersecurity threats and for detecting and responding to any cybersecurity incidents. These policies and processes are built into our information technology ("IT") function and are designed to align with the NIST Cybersecurity Framework, published by the U.S. National Institute of Standards and Technology.

companyName: Invivyd, Inc.

ticker: IVVD


text: We have adopted an IT Security Management Policy ("IT Policy") to establish the requirements for securing and managing our IT assets and data, as well as an Incident Response Policy designed to coordinate the activities for preparing for, identifying, responding to, and recovering from cybersecurity threats. Our Head of IT is primarily responsible for implementing and overseeing the IT Policy, which is applicable to all our employees and contractors, as well as any third parties with access to our IT assets and data. Our Head of IT is also primarily responsible for leading incident response services under the Incident Response Policy. Our Head of IT leverages over 20 years of experience in various cybersecurity functions. As part of our overall risk mitigation strategy, we maintain an Enterprise Risk Register to identify, prioritize and track system risks, including cybersecurity risks. Additionally, we maintain cybersecurity insurance; however, such insurance may not be sufficient in type or amount to cover the total losses or damages related to a cybersecurity incident.


text: We implement technical, physical, and organizational measures designed to manage and mitigate risks from cybersecurity threats. For example, we employ multifactor authentication, single sign-on, and email filtering services across our systems. Additionally, we conduct monthly video-based cybersecurity awareness trainings across our workforce, which cover relevant topics such as social engineering, phishing, password protection, confidential data protection, and mobile security. We regularly perform company-wide phishing tests. We currently leverage multiple third-party service providers to assist in monitoring, managing, and detecting cybersecurity threats and conducting periodic vulnerability assessments of our critical assets.


text: As of the date of this report, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents.


text: While our Board of Directors has overall responsibility for risk oversight, the Audit Committee of our Board of Directors (the "Audit Committee") is responsible for overseeing our cybersecurity risk management and strategy. The Audit Committee reviews and discusses with management and the Company's auditors, as appropriate, our risks relating to data privacy, technology, and information security, including cybersecurity and back-up of information systems. The Audit Committee also confers with management and our auditors, as appropriate, regarding the adequacy and effectiveness of our policies and the internal controls regarding information security.


text: Our Head of IT meets regularly with our Chief Operating Officer to discuss our cybersecurity threat landscape, address open gaps and issues, and evaluate solutions to cover any identified gaps. Our Head of IT, in collaboration with members of senior management, reports relevant cybersecurity matters to our Audit Committee. For discussion of cybersecurity risks, please see Item 1A, "Risk Factors."


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Galera Therapeutics, Inc.

ticker: GRTX


text: We design and assess our program based on guidance from the National Institute of Standards and Technology (NIST) and other industry sources. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use NIST publications and other sources as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Operating Officer (COO) or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our COO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity technologies, and controls and processes to aid in our efforts to assess, identify, and manage such risks.

companyName: Acrivon Therapeutics, Inc.

ticker: ACRV


text: We are subject to cybersecurity threat risks associated with our use of third-party service providers, including independent clinical investigators, contracted laboratories and contract research organizations. Cybersecurity considerations affect the selection and oversight of these third-party service providers.


text: We engage certain external parties, including cybersecurity and privacy firms and consultants, to provide IT support and cybersecurity oversight, and enhance our risk reduction abilities, including the engagement of a third-party to review our cybersecurity program to help identify areas for continued focus and improvement. We also use automated tools designed to monitor, identify, and address cybersecurity risks.


text: As of the date of this report, we have not identified cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. We are in the process of formalizing an incident response plan. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," of this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Head of Information Technology, who reports directly to the Chief Operating Officer, has day-to-day responsibility for preventing, mitigating and remediating cybersecurity threats and incidents. The individual currently serving in this role has two decades of experience in information technology and cybersecurity. Our Disclosure Committee evaluates the materiality of any threats and/or incidents to determine if there is any required disclosure. Our external SEC counsel is also apprised of certain threats and/or incidents that may occur and is available to advise management on any disclosure obligations.


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Periodically, the Audit Committee receives an overview from our Head of Information Technology of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.


text: Cybersecurity Risk Management and Strategy Candel has implemented cybersecurity risk management processes that are informed by industry standards in accordance with the scale of our business. Our cybersecurity risk management processes are designed to assess, identify and mitigate risks from current and emerging cybersecurity threats.

companyName: Candel Therapeutics, Inc.

ticker: CADL


text: We use various tools and processes to accomplish these objectives, including policies and procedures, risk assessments, and testing. Further, we require our employees to participate in cybersecurity risk awareness trainings and phishing exercises.


text: Our cybersecurity risk management processes are supported by third-party service providers, including a managed services provider that assists the Company with, among other things, threat monitoring and cybersecurity incident response and escalation services. We rely on a third-party service provider to assist us with our cybersecurity practices, including for vulnerability assessments, penetration testing, and managing IT environments. Our process for onboarding new vendors with access to critical systems or data includes vendor questionnaires, contractual obligations, and if deemed appropriate, review of vendor audit reports.


text: Our incident management processes include reporting to senior management, including the Chief Financial Officer (CFO), Vice President of Regulatory and Quality Assurance, Chief Executive Officer, and GxP Systems Director, and, where appropriate, to the board of directors. To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats that could affect our information or systems. For more information, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Cybersecurity Governance The board of directors has delegated oversight of the Company's cybersecurity risk management program to the Audit Committee, including responsibilities for reviewing and discussing cybersecurity risks, implementing risk management programs, controls and procedures, and performing high level reviews of the threat landscape.


text: Our Senior Director, Information Technology (Senior Director, IT) is responsible for the strategic leadership and day-to-day management of our cybersecurity risk management program. The individual occupying this role has over thirty years of experience with information technology management and over five years of cybersecurity risk management.


text: Our Senior Director, IT engages in regular meetings with our third-party managed IT service provider and the Director, IT to review and assess our cybersecurity risk management processes. The Senior Director, IT reports such findings to our CFO who annually presents updates on cybersecurity risks, mitigation strategies, and, if necessary, incident response activities to our Audit Committee. Further, our Audit Committee updates the full board on matters relating to cybersecurity risk management, as necessary.


text: Risk Management and Strategy We have established policies and processes designed to assess, identify, and manage material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes.

companyName: Atara Biotherapeutics, Inc.

ticker: ATRA


text: We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We monitor our environments to identify cybersecurity threats, as well as assess our environments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following our monitoring, we adjust, implement and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Information Officer, who reports to our Chief Financial Officer, to manage any identified risks and mitigation process. As part of our overall cyber security framework, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our information technology (IT) department and management. Personnel at all levels and departments are made aware of our cybersecurity policies through ongoing training.


text: We engage third-party vendors in connection with our cybersecurity risk monitoring and processes. These service providers assist in our design and implementation of our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. We also maintain insurance coverage that is intended to address certain aspects of cybersecurity risks.


text: Notwithstanding any of these measures, our systems and networks remain potentially vulnerable to known or unknown cybersecurity attacks and other threats, any of which could have a material adverse effect on our consolidated results of operations, financial condition and cash flows. We have experienced, and will continue to experience, cyber incidents in the normal course of our business. As of the date of this report, we have not identified any risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on us will not occur in the future. For additional information on the risks we face from cybersecurity threats, please see the risk factor titled, "If our security measures are compromised, or our information technology systems or those of our vendors, and other relevant third parties fail or suffer security breaches, loss or leakage of data, and other disruptions, this could result in a material disruption of our services, compromise sensitive information related to our business, harm our reputation, trigger our breach notification obligations, prevent us from accessing critical information, and expose us to liability or other adverse effects to our business." in Item 1A. "Risk Factors."


text: The Audit Committee of the Board of Directors is responsible for the primary oversight of our information security programs, including relating to cybersecurity. The Audit Committee receives status updates on at least a semi-annual basis from our Chief Information Officer on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our security program, and our views of the emerging threat landscape. The Chair of the Audit Committee regularly reports to the Board on cybersecurity risks and other matters reviewed by the Audit Committee. In addition, all Board members have access to the materials for each Audit Committee meeting.


text: Our Chief Information Officer is responsible for the oversight of our cybersecurity risks. We have implemented a security incident response plan and use this incident response framework as part of the process we employ to keep the Audit Committee and our executive management informed about cybersecurity risks and to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. The plan is a set of procedures and tasks that our incident response team, under the direction of the Chief Information Officer, executes with the goal of ensuring timely identification and appropriate resolution of cybersecurity incidents. In addition, we validate compliance with our internal data security controls through the use of security monitoring tools.


text: Our Chief Information Officer has over 25 years of IT experience and has a thorough understanding of enterprise level cyber security framework. Our Chief Information Officer has also participated in cybersecurity reviews and implementations including various tools and platforms for over 10 years and drives strategic cyber security implementations based on industry best practices that helps us strengthen our security posture on a continuous basis.


text: Cybersecurity Risk Management and Strategy The Company maintains a cybersecurity program designed to detect, identify, classify and mitigate cyber security and other data security threats, as part of its efforts to protect and maintain the confidentiality and security of customer, employee and vendor information, and non-public information about the Company. Our cyber security program is led by the Company's SVP, Head of Legal and Compliance.

companyName: Talis Biomedical Corp

ticker: TLIS


text: The Company and its third-party service providers conduct periodic risk assessments to identify significant cybersecurity threats that may affect information systems that are vulnerable to such cyber security threats and regularly review these risk assessments for changes in our business practices and the external cybersecurity landscape as well as the impact of our security processes. These risk assessments include physical, administrative and technical safeguards and involves identification of reasonably foreseeable internal and external risks and evaluation of the likelihood and potential damage that could result from the realization of such risks.


text: Following our risk assessments, we evaluate when and how to design, implement, and maintain reasonable safeguards to minimize the identified risks and address any identified gaps in existing safeguards, and proceed with such design, implementation, and maintenance as deemed appropriate. We also engage third-party service providers in connection with our risk assessment process and certain risk management processes. Our collaboration with these third-party service providers includes threat assessments and consultation on security enhancements, 24/7 monitoring and incident response support.


text: Based on the information we have as of the date of this Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" for further information about these risks.


text: Cybersecurity Governance Our Board of Directors is focused on cyber security. Specific responsibility for cybersecurity oversight is managed by the Audit Committee. The SVP, Head of Legal and Compliance is responsible for the management and mitigation of identified risks and the presentation of any changes in risk factors, identified risks, overall cybersecurity efforts and upcoming improvements to the Audit Committee. The SVP, Head of Legal and Compliance is also responsible for the response to and the remediation and resolution of a security incident involving a potential or actual compromise of our proprietary information and/or personal information. The SVP, Head of Legal and Compliance reports to the Audit Committee quarterly with respect to the Company's cybersecurity infrastructure and risk assessment and reports any security incidents to the Audit Committee. The Audit Committee will report the Company's cybersecurity infrastructure and risk assessment and any findings and recommendations to the full Board of Directors for consideration if and when the Audit Committee deems it necessary or appropriate.


text: In the event of a cybersecurity incident, the Company's SVP, Head of Legal and Compliance is equipped with a well-defined Incident Response and Reporting Policy (IRRP) to guide response, reporting, and recovery actions. This IRRP includes immediate actions to mitigate the impact of the incident, long-term strategies for remediation and prevention of future incidents, and provides for internal notification of the incident to functional areas as well as senior leadership and the Board of Directors, as appropriate.


text: Risk Identification and Management The Company has a cybersecurity Risk Management Policy in place that governs the life cycle in which cybersecurity risks, including: • Risk Identification: through various initiatives performed, including, annual assessments, penetration tests, Incident Response tabletop exercises, vulnerability scans, and cybersecurity reviews of critical third-party vendor engagements, etc. • Risk Evaluation & Treatment: Identified issues, vulnerabilities, and exposures are captured within the Company's Risk Register, which is updated periodically to reflect the most up to date treatment option selected by the Risk Owners. • Risk Reporting and Ongoing Management: Potentially material risks are shared as part of a monthly Cybersecurity Governance Forum, that's attended by leadership. Risk Mitigations are tracked to completion through various project updates.

companyName: Drilling Tools International Corp

ticker: DTI


text: The foundation of the Company's cybersecurity framework is based on written policies that govern different process areas. Risks are identified through various processes that employees perform through their daily operations and are mitigated, managed and/or governed through these established processes.


text: The Company is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial condition. However, the Company cannot provide assurance that the Company will not be materially affected in the future by such risks or any future material incidents.


text: Leveraging the Company's Cybersecurity Risk Management & Governance process, it has identified cybersecurity risk factors that are inherent to the Company's business and industry. The risk factors discussed in this section should be considered together with information included elsewhere in this Annual Report on Form 10-K and should not be considered the only risks to which the Company is exposed. Additionally, mitigation of these risk factors is tracked by management as part of the Cybersecurity Maturity Roadmap.


text: • Disruptions in the Company's supply chain could result in an adverse impact on results of operations. • Network compromise or equipment sabotage could impact the operations of the manufacturing or distribution sites which could impact the revenue. • Cybersecurity incidents, including breaches of confidential information, sensitive data, personal information, or intellectual property could damage the Company's reputation, disrupt operations, increase costs, and impact revenues. • Nation state attacks due to current geopolitical and economic climate could impact oil and gas industry.


text: Engagement of Third Parties The Company uses an IT Managed Service Provider in conjunction with a Cybersecurity Advisory firm to perform various functions, guiding the Company's cybersecurity posture, and providing ongoing support to the Company's cybersecurity program. The Company has Incident Response retainer services that can be leveraged, when needed.


text: The Company uses a third-party external auditor to perform annual audits, which include cybersecurity components, and a cybersecurity advisory firm to conduct annual risk assessments and penetration tests.


text: To manage third-party risks, the Company has a Third-Party Risk Management Policy and procedures in place. The process involves performing reviews of the cybersecurity controls of third-party vendors that have access to the Company's confidential or sensitive information, or those who may have access to the Company's systems. Since the process was established, key critical vendors who may have material impact on the Company's confidentiality, integrity or availability of data were prioritized and reviews were completed. The review of other relevant third-party vendors upon onboarding began in January 2024.


text: Board Oversight of Cybersecurity Matters The cybersecurity dashboard with roadmap progress is shared with the board of directors regularly, which includes actions completed and any topics that need board awareness / sponsorship such as approval of budgets which include cyber security project initiatives.


text: An in-depth update regarding cyber security is discussed during quarterly meetings with the Audit Committee. The Audit Committee is ultimately responsible for overseeing management's execution of the Company's cybersecurity risk management program.


text: The Chief Financial Officer (CFO) and designees are responsible for reviewing and approving the Cybersecurity Risk Management processes, or exceptions to such processes. External Counsel is consulted on legal matters related to Cybersecurity Risk or Incident Management as deemed necessary by leadership.


text: Additionally, the Cybersecurity Risk Committee holds periodic Cybersecurity Governance Forums, in which detailed cybersecurity program updates and metrics are reported.


text: The Company's Chief Financial Officer and VP of Finance are responsible for the oversight and communication of cybersecurity threats and risks to the Company's Board of Directors. They meet regularly with the Board of Directors where a Cybersecurity roadmap progress is shared with the board.


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program, and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Adviser's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and are fully integrated into the Adviser's overall risk management processes. In general, the Adviser seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Adviser's information systems or the information that the Adviser collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: TCW Direct Lending LLC


text: Cybersecurity Risk Management and Strategy The Adviser's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Adviser has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Adviser's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: The Adviser implements technical safeguards that are designed to protect the Adviser's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as assistance from third party experts where necessary. • Incident Response and Recovery Planning: The Adviser has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Adviser's response to a cybersecurity incident. The Adviser conducts occasional tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Adviser maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Adviser's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside consultants who advise on the Adviser's cybersecurity systems. • Education and Awareness: The Adviser provides regular, mandatory training for all levels of personnel regarding cybersecurity threats as a means to equip the Adviser's personnel with effective tools to address cybersecurity threats, and to communicate the Adviser's evolving information security policies, standards, processes, and practices.


text: The Adviser conducts periodic assessment and testing of its policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. This includes penetration testing of network infrastructure and phishing tests targeting the Adviser's employees. The results of such assessments and reviews are evaluated by management and reported to the Board, and the Adviser adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments and reviews.


text: The Board, in coordination with the Adviser, oversees the Company's risk management program, including the management of cybersecurity threats. The Board receives regular updates and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by the Company'. The Board also receives prompt and timely information regarding any material cybersecurity risk, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Adviser discuss the Company's approach to overseeing cybersecurity threats.


text: The Adviser has established an internal working group that includes relevant representation from senior management including the CCO, COO and CISO who work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through ongoing communication with these teams, the CISO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate.


text: The CISO has served in various roles in information technology and information security for many years and holds relevant professional certifications. The Adviser's COO and CCO each hold educational and professional degrees in their respective fields, and each has numerous years of experience managing risk at the Company and at similar companies, including assessing cybersecurity threats.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management and Strategy As a corporation committed to maintaining the integrity, confidentiality, and availability of our digital assets and sensitive information, the Company recognizes the critical importance of cybersecurity in today's interconnected business landscape. The Company's cybersecurity measures are designed to safeguard our systems, networks, data, and information from unauthorized access, disruption, or misuse.

companyName: Virginia National Bankshares Corp

ticker: VABK


text: The Company recognizes that cybersecurity is fundamental to maintaining trust with shareholders, customers, and other stakeholders. By prioritizing cybersecurity as a strategic imperative, the Company strives to safeguard business operations, sensitive information, and integrity which preserves the value delivered to all our constituents.


text: Key components of the Company's cybersecurity program: • Risk Management: The Company continuously assesses and mitigates cybersecurity risks across the organization by leveraging industry best practices and frameworks such as NIST Cybersecurity Framework. • Governance and Oversight: The Company's Board of Directors (the Board) regularly reviews cybersecurity matters, ensuring alignment with business objectives and regulatory requirements. A designated Information Technology Strategic Committee, which includes many subject matter experts from the Board and Executive Management, meets quarterly to provide additional focus and expertise in this area. • Security Controls: The Company has implemented robust technical and procedural controls to protect information assets, including firewalls, intrusion detection systems, encryption, access controls, and multifactor authentication. These controls are tested periodically by external technology audit firms with penetration tests and security audits. • Policy Controls: Annually all employees sign off on the Company's data and device controls. The Company ensures that all information access points are the Company's assets and all data passing through these access points are accessible by the Company and can be deleted whenever the Company deems necessary. • Employee Training and Awareness: Ongoing cybersecurity training and awareness programs are implemented to educate employees about potential threats, phishing attacks, social engineering tactics, and best practices for safeguarding company information. • Incident Response: The Company maintains a comprehensive incident response plan to promptly detect, contain, and recover from cybersecurity incidents. Regular testing and simulation exercises ensure readiness and effectiveness of response capabilities. • Third-Party Risk Management: The Company regularly evaluates and monitors the cybersecurity posture of third-party vendors and partners with whom data is shared or relied upon for critical services, to ensure they meet the Company's security standards. • Continuous Improvement: The Company regularly reviews and makes enhancements to the cybersecurity program to adapt to emerging threats, technological advancements, and changes in regulatory requirements. Implementation of new technologies, practices, and infrastructures to target security vulnerabilities is ongoing. • Compliance and Reporting: The Company adheres to relevant cybersecurity regulations and standards applicable to our industry and maintains transparency by disclosing material cybersecurity incidents or risks in accordance with regulatory obligations. The Company had no material cybersecurity incidents in 2023.


text: Risk Management and Strategy Our information security program is still in its early developmental stages and an ongoing process. As a smaller organization, we are actively refining our information security program to more effectively address cybersecurity risks and threats. Our primary objective is to improve our ability to effectively identify, protect against, detect, and respond to potential cyber threats across all aspects of our operations.

companyName: META MATERIALS INC.


text: To strengthen the defenses of our information systems, we have already implemented foundational controls that secure our customers' and employees' data and data relating to our intellectual property, We are also currently developing and deploying other various security tools and measures. These include internal reporting mechanisms and frameworks, monitoring systems, and certain third-party programs and solutions, including penetration testing with third-party security firms.


text: Furthermore, we are in the initial stages of developing our policies and processes for managing third-party risks. While we expect our partners to maintain appropriate security measures, we are actively working with our partners to improve alignment of their security protocols with our expectations and policies. We plan to introduce a risk assessment process to continuously monitor and remain vigilant against potential vulnerabilities. In preparation, we have completed the first draft of our IT risk management framework. This sets the stage for adopting a widely accepted risk quantification model, which will be done in alignment with our business readiness. The model will help us to prioritize cybersecurity risks and guide the development of our security controls.


text: As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Overseeing our cybersecurity efforts and guiding our security initiatives is our Chief Information Officer, who brings over 25 years of experience in leadership roles managing cybersecurity and large-scale IT environments across both private and public sectors. Additionally, our team members involved in the security program are acquiring the necessary skills and knowledge to address emerging cybersecurity challenges.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to participants in preclinical studies and clinical trials involving certain of our product candidates. (Information Systems and Data).

companyName: Climb Bio, Inc.

ticker: CLYM


text: Members of our management team, with the assistance of third-party technical advisors, help identify, assess and manage our cybersecurity threats and risks. Our third-party technical advisors include consultants with over 20 years of experience in IT leadership as well as subject matter experts in cybersecurity that have extensive experience managing cybersecurity programs.


text: We manage, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: through the use of automated tools, including but not limited to tools for monitoring, remote wiping, threat detection, intrusion detection and prevention; conducting (through third parties) regular audits and threat assessments for internal and external threats; subscribing to reports and services that identify cybersecurity threats; analyzing reports of threats and actors; conducting vulnerability assessments to identify vulnerabilities; evaluating our and our industry's risk profile; and evaluating threats reported to us.


text: Depending on the environment, we implement and maintain various processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: risk assessments, implementation of security standards and certifications, encryption of data in transit and at rest, network security controls, data segregation, access controls, systems monitoring, vendor risk management program, employee training and penetration testing.


text: As part of our cybersecurity risk management program, we maintain processes to assess and review the cybersecurity practices of third-party vendors and suppliers. Prior to engaging key third-party vendors and suppliers, we conduct a security assessment and, as appropriate, include security requirements in contracts.


text: We, like other companies in our industry, face cybersecurity risks in connection with our business. However, our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats. For more information on our cybersecurity related risks, see "Risk Factors" under Part I, Item 1A of this Annual Report.


text: Our board of directors considers cybersecurity risk management as part of its general oversight function. The audit committee of our board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our management team provides periodic updates to the audit committee regarding our cybersecurity program, including information about cyber risk management governance and status updates on various projects intended to enhance the overall cybersecurity posture of the Company.


text: We maintain a data security plan designed to provide a documented and formalized information security policy to detect, identify, classify and mitigate internal and external cybersecurity and other data security threats. This cybersecurity program is based in-part on, and its effectiveness is measured using applicable industry standards, and is included into our overall enterprise risk management program.

companyName: Shimmick Corp

ticker: SHIM


text: In furtherance of detecting, identifying, classifying and mitigating cybersecurity and other data security threats, we also: • assess and analyze baseline configuration standards to ensure that they meet the intent and effectiveness required for the overall safety and security (both logically and physically) of critical system components; • ensure the asset inventory for relevant system components is kept current and accurate; • ensure that network connection arrangement documents are kept current and accurate; • limit access rights to system components to authorized personnel only, with all end-users being properly granted access in accordance with stated access rights policies and procedures; • deploy anti-virus solutions on all applicable system components, with the respective anti-virus solutions being the most current versions available from applicable vendors, enabled for automatic updates and configured for conducting periodic scans as necessary; • provision, hardens, secures and locks down critical system resources; • use internal and external vulnerability scanning procedures, along with network layer and anti-hacking tests; • facilitate requests for validation of baseline configurations for purposes of regulatory compliance assessments and audits; and • provide mandatory training and optional certification accreditation for purposes of maintaining an acceptable level of information security expertise necessary for configuration management.


text: Conducting our businesses involves the collection, storage, use, disclosure, processing, transfer, and other handling of a wide variety of information, including personally identifiable information, for various purposes in our businesses. Like other comparable-sized companies that process a wide variety of information, our information technology systems, networks and infrastructure and technology have been, and may in the future be, vulnerable to cybersecurity attacks and other data security threats. These types of attacks are constantly evolving, may be difficult to detect quickly, and often are not recognized until after they have been launched against a target. For more information about these and other cybersecurity risks faced by us, see "Risk Factors – Risks Related to Our Business and Industry – We rely on IT systems to conduct our business, and disruption, failure or security breaches of these systems could adversely affect our business and results of operations" and "– Cybersecurity attacks on or breaches of our information technology environment could result in business interruptions, remediation costs and/or legal claims".


text: Our board of directors has ultimate oversight for risks relating to our data security plan. In addition, the board of directors has delegated primary responsibility to the Audit Committee for assessing and managing data privacy and cybersecurity risks, reviewing data security and cybersecurity policies and processes with respect to data privacy and cybersecurity risk assessment and management, reviewing steps management has taken to monitor and control such risks, and regularly inquires with our management team, internal auditors and independent auditors in connection therewith. The Audit Committee is also responsible for overseeing our investigation of, and response to, any cybersecurity attacks or threats.


text: We also have a dedicated team of employees overseeing its data security plan and initiatives, led by our Director of IT, and works directly in consultation with internal and external advisors in connection with these efforts. With over fifteen years of experience in the field of cybersecurity, our Director of IT brings a wealth of expertise to his role. His background includes extensive experience in all facets of information technology and information security. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies.


text: We have developed a procedure by which the board of directors and management are informed about relevant cybersecurity risks, allowing for effective cybersecurity oversight and the ability of the Company to monitor, prevent, detect, mitigate and remediate cybersecurity incidents. The results of the our evaluations and the feedback from its engagements are used to drive alignment on, and prioritization of, initiatives to enhance our cybersecurity strategies, policies, and processes and make recommendations to improve processes.


text: In the event of a potential or actual cybersecurity event, the Director of IT immediately notifies general counsel at which point the information security incident response plan is activated if warranted. The information security incident response plan provides the procedures for responding, including personnel required to be informed and updated. The board of directors is informed promptly in the event such incident is, or is reasonably expected to have, a material impact on operations or financial condition.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, hardware, software, and our high value data, including intellectual property, trade secrets, confidential and sensitive information (collectively, "Information Systems and Data").

companyName: Kodiak Sciences Inc.

ticker: KOD


text: Our Chief Information Officer ("CIO") helps identify, assess and manage the Company's cybersecurity threats and risks. Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage, mitigate and remediate material risk from cybersecurity threats to our Information Systems and Data. Our Information Security and Privacy Policy includes standards for incident response, vulnerability management, data protection and logical access controls.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our Company's overall risk management process, which, in part, establishes intended uses of our computerized systems and identifies critical and/or material risks. After a system reaches operation, the risk management approach continues following standard processes for change control, system maintenance, logical access control, discrepancy management and periodic review.


text: We use independent service providers to assist us from time to time in an effort to identify, assess, and manage material risks from cybersecurity threats.


text: We have a vendor management process to manage cybersecurity risks associated with our use of independent service providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve varying methods of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our security measures, or those maintained on our behalf by CROs, service providers or other third parties, are compromised now, or in the future, or the security, confidentiality, integrity or availability of our or others' information technology, software, services, networks, communications or data is compromised, limited or fails, this could result in significant fines or other liability, interrupt our development programs, harm our reputation, or otherwise adversely affect our business."


text: The Nominating and Corporate Governance Committee of our Board of Directors is responsible for overseeing cybersecurity risk management processes, including oversight and mitigation of risk from cybersecurity threats. The Nominating and Corporate Governance Committee receives reports from the CIO, Chief Financial Officer ("CFO") or their designee concerning the Company's material cybersecurity risks and the processes the Company has implemented in an effort to mitigate them.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by the CIO. The CIO and the CFO are responsible for overall cybersecurity risk management strategy and communicating material cybersecurity priorities to the responsible board committee. The CIO has relevant cybersecurity expertise such as: leading the enterprise IT Security program for 7 years and Supply Chain Cybersecurity efforts for 6 years at a large commercial stage biopharmaceutical company. The CIO and CFO undertake efforts to learn about the Company's cybersecurity threats by reviewing security assessments and other security-related reports.