text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For instance, we have engaged an independent cybersecurity advisor to lead a cybersecurity crisis simulation exercise that has been used by our senior leaders to prepare for a possible cyber crisis. In addition, we have engaged a security auditor and advisor in systems administration and penetration testing, a systems auditor and advisor for cybersecurity and compliance, an IT Systems auditor and assurance vendor and an email security and cybersecurity training partner. We also purchase insurance to protect us against the risk of cybersecurity breaches.


text: To date, risks from cybersecurity threats have not previously materially affected us, and we currently are not aware of risks from cybersecurity threats that are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition. However, as discussed more fully under "Item 1A – Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: IZEA Worldwide, Inc.

ticker: IZEA

secItem: Item 1C


text: Role of Management IZEA's CEO, our Director, Systems & Security, and our Senior Development Operations (DevOps) leader jointly manage of our cybersecurity risks. We have established a Security Council, which includes our CEO, Director, Systems & Security, Senior Manager, Systems & Security, Chief Financial Officer, General Counsel, and other senior officers, that meets quarterly to review cybersecurity and information security matters. The Security Council has primary management oversight responsibility for assessing and managing information security, fraud, vendor, data protection and privacy, and cybersecurity risks.


text: We have a security incident response framework in place. We use this incident response framework as part of our process to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The framework is a set of coordinated procedures and tasks that our incident response team, under our CEO's direction, executes to ensure timely and accurate resolution of cybersecurity incidents. Our cybersecurity framework includes regular compliance assessments with our policies, standards, and applicable state and federal statutes and regulations. In addition, we validate compliance with our internal data security controls through security monitoring utilities and internal and external audits.


text: Our CEO and Director, Systems & Security, have extensive experience in the information technology area. In particular, our Director, Systems & Security has over twenty years of professional experience in the information security area, including as a result of his roles as a director of security, a security architect, and a software security engineer at various companies.


text: Role of the Board of Directors The Board of Directors Audit Committee is responsible for the primary oversight of our information security and cybersecurity programs. The Audit Committee receives periodic reports from our CEO on cyber risks and threats, the status of initiatives to enhance our information security systems, assessments of our security posture, and insights into emerging threats. Additionally, the CEO reports to the Audit Committee on our Company-wide enterprise risk assessment, including evaluating cyber risks and threats. The Chair of the Audit Committee subsequently informs the full Board of these cybersecurity matters and key discussion topics and meeting materials and recommends updates to our information security policies and programs for Board approval.


text: Risk Management and Strategy We have implemented ongoing processes that are designed to continually identify, assess, manage, and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our cybersecurity threat risks are identified, assessed, managed, and monitored by our Adviser's and Administrator's resource management and compliance departments, which work in conjunction with an independent third-party information technology service provider ("ISP") engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assists in maintaining our cyber and information security programs. The ISP proposes recommendations to our Adviser's resource management and compliance departments, which are then considered by other officers and employees of our Adviser and Administrator working on our behalf before improvements are implemented to our information technology strategy, cybersecurity, and incident response policies, processes, and procedures.

companyName: GLADSTONE LAND Corp

ticker: LAND


text: In addition, regular ongoing cybersecurity threat risk assessments are performed throughout the year and reported to our officers and Board of Directors by our Chief Compliance Officer ("CCO") no less than quarterly. Cybersecurity risks are assessed in general as a part of the overall enterprise risk management for us, but also specifically between the ISP and our Adviser and Administrator in monitoring and determining not only the risks but also assessing corresponding processes and procedures to mitigate those risks appropriately. Third-party business applications are also incorporated into these risk assessments.


text: As an international service provider, our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected, we, through our Adviser and Administrator, consult with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we then, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: implementation of industry-leading Cloud solutions and business applications which possess integrated cybersecurity safeguards, anti-malware, antivirus, and threat detection software, mobile device management of business applications, regular vulnerability scans and penetration testing.


text: Contractually, we require the ISP to provide us with annually a third-party report on its systems and on the suitability of the design and operating effectiveness of its controls relevant to information and cyber security. In addition to the ongoing dialogue and technology interaction between our Adviser and Administrator and our ISP, any significant findings in these reports are shared with us, including our Board of Directors and other officers, to enhance ongoing monitoring and assessment of our information technology and cybersecurity risk management.


text: While our ISP works to create a hardened information technology systems environment, our Adviser and Administrator also regularly trains employees working on our behalf on the evolving threats and educates them on cybersecurity risks. Whether it is communicating information about the latest cybersecurity threats, assessing employees' awareness through mock fraud exercises, social engineering and phishing campaigns, or providing access to a library of educational material about past and newly-evolving cybersecurity attacks, our Adviser and Administrator work in concert with the ISP on our behalf to keep employees servicing us informed so as to provide an additional protection barrier through end-user knowledge.


text: Notwithstanding our risk management and strategy described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Part I, Item 1A, "Risk Factors—Risks Relating to Our Business and Operations—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations or the operations of businesses in which we invest, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our business, financial condition, and operating results."


text: Our Board of Directors is actively engaged in overseeing our cybersecurity and information security program. Our Board of Directors receives regular reports during board meetings from our CCO on our and our Adviser's and Administrator's efforts concerning information security and addressing information technology and cybersecurity risks no less than quarterly. The reports are distributed to our Board of Directors, and our CCO engages in detailed discussions with the independent board members during the independent members' session. The reports cover all potentially material cybersecurity threats facing us, as well as key risks and mitigation efforts undertaken by us and our Adviser and Administrator. As significant threats or events are identified by management or the ISP between regular reporting periods, our CCO will inform our Board of Directors immediately and keep it informed as to the developments of assessing the risks, mitigating efforts, and potential disclosure. Appropriate members of management and third-party providers will be involved as deemed necessary based on the potential impact.


text: Management personnel most involved with assessing and managing the cybersecurity risks and program with our ISP include our Head of Resources Management, who is also a member of our Board of Directors, and our CCO. Our Head of Resources Management has more than 30 years of overall experience and more than 20 years directly assessing and managing our cyber information technology and human resources systems and the associated security concerns. Our CCO has more than 30 years of overall experience as a CPA, with more than 15 years managing information technology systems and databases, and 15-plus years supporting our Adviser's and Administrator's resource management department. This includes identifying, assessing, mitigating, and monitoring cyber information security risks. These managers, as well as other management personnel, attend various professional continuing education programs that include cybersecurity matters. Certain members of our Board of Directors have, or previously held, positions with other companies, including other public companies, that involved managing risks associated with their cyber and information technology systems. Our Board of Directors regularly receives updates from third parties on various business risks, which include cybersecurity matters.


text: Risk Management and Strategy We have implemented ongoing processes that are designed to continually identify, assess, manage, monitor, and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our Adviser's and Administrator's resource management, information technology ("IT"), and compliance departments work in conjunction with an independent third-party information technology service provider ("ISP") engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assists us in maintaining our cyber and information security programs. The ISP proposes recommendations for improvements to our Adviser's Head of Resource Management, Director of IT, and Chief Compliance Officer ("CCO"), which are then considered by other officers and employees of our Adviser and Administrator working on our behalf before improvements are implemented to our information technology strategy, cybersecurity, and incident response policies, processes, and procedures.


text: In addition, regular ongoing cybersecurity threat risk assessments, which also cover third-party business applications, are performed throughout the year and reported to our officers and Board of Directors by our CCO no less than quarterly. Cybersecurity risks are assessed in general as a part of the overall enterprise risk management for us, but also specifically between the ISP and our Adviser and Administrator in monitoring and determining not only the risks but also assessing corresponding processes and procedures to mitigate those risks appropriately. Third-party business applications are also incorporated into these risk assessments.


text: As an international service provider, our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected, the Director of IT, Head of Resource Management, and CCO consult with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we then, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: implementation of industry-leading Cloud solutions and business applications which possess integrated cybersecurity safeguards; anti-malware, antivirus, and threat detection software; ransomware containment and isolation software; enhanced password requirements and multifactor authentication requirements; endpoint encryption; intrusion detection and response system conduct file integrity monitoring; email archiving, firewalls, and quarantine capabilities; mobile device management of business applications; frequent systems backups with recovery capabilities; and regular vulnerability scans and penetration testing.


text: Contractually, we require the ISP to annually provide us with a third-party report on its systems and on the suitability of the design and operating effectiveness of its controls relevant to information and cyber security. In addition to the ongoing dialogue and technology interaction between the Director of IT, our Adviser and Administrator, and the ISP, any significant findings in these reports are shared with us, including our Board of Directors and other officers, to enhance ongoing monitoring and assessment of our information technology and cybersecurity risk management.


text: While our ISP works to create a hardened information technology systems environment, our Adviser and Administrator also regularly trains employees working on our behalf on the evolving threats and educates them on cybersecurity risks to provide an additional protection barrier through end-user knowledge. Whether it is communicating information about the latest cybersecurity threats, assessing employees' awareness through mock fraud exercises, social engineering and phishing campaigns, or providing access to a library of educational material about past and newly-evolving cybersecurity attacks, our Adviser and Administrator work in concert with the ISP on our behalf to keep employees servicing us informed so as to provide an additional protection barrier through end-user knowledge.


text: Notwithstanding our risk management and strategy described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. We are not currently aware of any known cybersecurity risks that may materially impact our operations, though we may not be able to determine the likelihood of such risks. See Part I, Item 1A, "Risk Factors—Risks Relating to Our Business and Operations—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations or the operations of businesses in which we invest, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our business, financial condition, and operating results," for a discussion of risks related to cybersecurity and cyber incidents.


text: Our Board of Directors is actively engaged in overseeing our cybersecurity and information security program. Our Board of Directors receives regular reports during board meetings from our CCO on our and our Adviser's and Administrator's efforts concerning information security and addressing information technology and cybersecurity risks no less than quarterly and regularly receives updates from third parties on various business risks, which include cybersecurity matters. The reports are distributed to our Board of Directors, and our CCO engages in detailed discussions with the independent board members during the independent members' session. The reports cover all potentially material cybersecurity threats facing us, as well as key risks and mitigation efforts undertaken by us and our Adviser and Administrator. As significant threats or events are identified by management or the ISP between regular reporting periods, our CCO will inform our Board of Directors immediately and keep it informed as to the developments of assessing the risks, mitigating efforts, and potential disclosure. Appropriate members of management and third-party providers will be involved as deemed necessary based on the potential impact.


text: Management personnel most involved with assessing and managing the cybersecurity risks and program with our ISP include our Head of Resources Management, who is also a member of our Board of Directors, and our CCO. Our Head of Resources Management has more than 30 years of overall experience and more than 20 years directly assessing and managing our cyber information technology and human resources systems and the associated security concerns. Our CCO has more than 30 years of overall experience as a CPA, with more than 15 years managing information technology systems and databases, and 15-plus years supporting our Adviser's and Administrator's resource management department. This includes identifying, assessing, mitigating, and monitoring cyber information security risks. Our Director of IT has over 20 years of experience in IT, with a focus in the implementation of information security projects to enhance organizations' resilience against emerging threats, and has collaborated closely with security vendors and partners to contain and address cybersecurity incidents. These managers, as well as other management personnel, attend various professional continuing education programs that include cybersecurity matters. Certain members of our Board of Directors have, or previously held, positions with other companies, including other public companies, that involved managing risks associated with their cyber and information technology systems. Our Board of Directors regularly receives updates from third parties on various business risks, which include cybersecurity matters.


text: Cyber Risk Management and Strategy We have an enterprise risk assessment process which specifically addresses risks associated with cybersecurity. Additionally, we have a cyber security incident response plan that outlines the structure, roles, responsibilities and operating procedures to utilize during potentially significant events that could negatively impact the Company. Our cybersecurity incident response plan provides a documented framework for handling high severity security incidents and includes facilitated coordination across multiple functions of the Company. Our incident response plan also includes identifying and responding to material risks from cybersecurity threats associated with our use of third-party service providers. We invest in threat intelligence and are active participants in industry and government forums to strive to improve our overall capabilities with respect to cybersecurity. We routinely perform reviews of threat intelligence and vulnerability management capabilities, while performing simulations and drills at both technical and management levels. Our formal cybersecurity program is modeled after industry best practice global standards and best practices. We incorporate external expertise in all aspects of our program utilizing best practice guidance from third-party cybersecurity advisors to provide objective assessments of our capabilities. We maintain a cyber liability insurance program, although the coverage may not be sufficient in some circumstances. We also have policies and practices in place to address data privacy regulations. Our cybersecurity program is reviewed and assessed by external information security specialists or by our internal audit group at least annually. Further, we conduct annual cybersecurity awareness training for employees and targeted training for high-risk functions of the Company. We also conduct phishing exercises and correlated education with our employees.

companyName: Vera Bradley, Inc.

ticker: VRA


text: Governance Related to Cybersecurity Risks Our Vice President of Enterprise Technology Solutions is responsible for the strategic leadership and direction of the Company's information technology organization and possesses 25 years of tenure and experience with the Company in matters of privacy assurance, cyber, digital, and data security. As part of its risk oversight role, our Audit Committee of the Board of Directors oversees cyber risk, information security and technology risk, including management's actions to identify, assess, mitigate and remediate material cybersecurity issues and risks. The Audit Committee receives regular reporting from our Vice President of Enterprise Technology Solutions on our technology and cyber risk profile, enterprise cybersecurity program and key enterprise cybersecurity activities. We experienced no material cybersecurity incidents in fiscal 2024.


text: Governance Related to Cybersecurity Risks Our Vice President of Enterprise Technology Solutions is responsible for the strategic leadership and direction of the Company's information technology organization and possesses over 25 years of tenure and experience with the Company in matters of privacy assurance, cyber, digital, and data security. As part of its risk oversight role, our Audit Committee of the Board of Directors oversees cyber risk, information security and technology risk, including management's actions to identify, assess, mitigate and remediate material cybersecurity issues and risks. The Audit Committee receives regular reporting from our Vice President of Enterprise Technology Solutions on our technology and cyber risk profile, enterprise cybersecurity program and key enterprise cybersecurity activities. We experienced no material cybersecurity incidents in fiscal 2025.


text: Risk Management and Strategy We rely on the cybersecurity policies and procedures implemented by New Mountain Capital. New Mountain Capital has processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of controls, processes, systems, and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our data. Pursuant to New Mountain Capital's Information Security Program, the New Mountain Capital Information Technology Steering Committee ("ITSC") is responsible for the development, evolution, and implementation of policies and technical measures to reasonably prevent security incidents. At times New Mountain Capital may also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: New Mountain Finance Corp

ticker: NMFC


text: New Mountain Capital uses processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, New Mountain Capital uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, New Mountain Capital also maintains an incident response plan that is utilized when cybersecurity incidents impacting us, our Investment Adviser, or our Administrator are detected. New Mountain Capital also requires that all employees, including employees of the Investment Adviser and Administrator, complete interactive security awareness training on an annual basis.


text: Material Impact of Cybersecurity Risks As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "The failure of cybersecurity protection systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively," which should be read in conjunction with the information above.


text: Our cybersecurity risks and associated mitigations are evaluated by our management and the ITSC as needed, but no less frequently than annually. Management and representatives of the ITSC periodically report to our board of directors on developments to the information security and cybersecurity risks we face. Reports include, among other things, an overview of New Mountain Capital's controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to us.


text: Cybersecurity Risk Management and Strategy We have no employees and are externally managed by our Advisor, an affiliate of our Sponsor. Our Advisor has responsibility for our day-to-day operations, serving as a consultant in connection with policy decisions to be made by the board of directors.

companyName: CNL Healthcare Properties, Inc.

ticker: CHTH


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to customers, reputational damage adversely affecting customer or investor confidence and violation of data privacy or security laws. Our Sponsor maintains an enterprise-wide cybersecurity program to protect and defend against and manage foreseeable cybersecurity risks and threats, including for the Company. The cybersecurity program is administered by the Sponsor's Chief Technology Officer ("CTO"), who has adopted the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Based on the NIST standards, our cybersecurity program breaks down its efforts to manage cybersecurity risk into five (5) pillars: identify, protect, detect, respond and recover.


text: Identifying and assessing cybersecurity risk as well as protecting us from such risk is integrated into our overall risk management systems and processes as well as specifically addressed in our enterprise-wide cybersecurity program. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including threat intelligence collaboration and advisory mediums, third-party due diligence and risk assessments when determining the selection, oversight and engagement of third-party service providers, application security evaluations and annual penetration tests as well as management risk and compliance reviews. The foregoing combines with periodic review and analysis of third-party service provider system and organizational controls, internal network intrusion prevention systems, vulnerability assessments, access management, data loss prevention, remote access control, mandatory cybersecurity awareness training and random phishing campaigns with additional requisite training, if applicable, to identify and protect against cybersecurity risk.


text: Any potential cybersecurity compromise, whether direct or indirect, is analyzed and documented by the securities operations team (the "SO Team") and escalated to the cybersecurity incident response team ("CSIRT") as necessary. The SO Team is comprised of cybersecurity professionals and the CSIRT is comprised of certain of the Sponsor's and Company's executives from legal, corporate communications, IT, compliance, finance, and risk management.


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact. Materiality is determined by considering qualitative and quantitative factors. The CSIRT team also conducts tabletop exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation and remediation strategies.


text: Recovery and restoration from a cybersecurity incident can vary depending on type of attack and materiality of assets and information affected.


text: As of the date of this filing, we do not believe that our business strategy, results of operations or financial conditions have been materially affected by any risks from cybersecurity threats for the reporting period covered by this report. However, institutions like us, and our service providers, have experienced cybersecurity events and data incidents in the past and will likely continue to be the target of cyberattacks and intrusions. For additional information on the cybersecurity risks we face, see "Part 1, Item 1A. Risk Factors–Cyber security risks and cyber incidents could adversely affect the Company's business and disrupt operations."


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates at least annually from senior management, including leaders from the CTO, internal audit and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our board of directors also engages in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: The cybersecurity risk management and strategy processes are overseen by the Sponsor's cybersecurity committee which consists of the Company's chief financial officer and general counsel, and the CTO, legal, risk management, and compliance teams Such individuals have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, and compliance. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: As of the date of this filing, we do not believe that our business strategy, results of operations or financial conditions have been materially affected by any risks from cybersecurity threats for the reporting period covered by this report. However, institutions like us, and our service providers, have experienced cybersecurity events and data incidents in the past and will likely continue to be the target of cyberattacks and intrusions. For additional information on the cybersecurity risks we face, see "Part 1, Item 1A. Risk Factors–Cybersecurity risks and cyber incidents could adversely affect the Company's business and disrupt operations."


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Summit Hotel Properties, Inc.

ticker: INN


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology ("IT") environment; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes and internal IT and risk management professionals principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan to respond to cybersecurity incidents; and • a third-party risk management process for service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, consolidated financial position, or results of operations. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, consolidated financial position, or results of operations. See "Risk Factors – Risks Related to Our Business."


text: Cybersecurity Governance Our Board of Directors (the "Board") considers cybersecurity risk as critical to the enterprise and manages the cybersecurity risk oversight function through the Audit Committee. The Audit Committee oversees management's design, implementation and enforcement of our cybersecurity risk management program.


text: Our Chief Risk Officer ("CRO") periodically reports to the Audit Committee and leads the Company's overall cybersecurity function. The Audit Committee receives regular reports from our CRO on our cybersecurity risks, including briefings on our cyber risk management program. A potentially material cybersecurity incident would be immediately reported to the Audit Committee and management would continue to brief the Audit Committee on management's response to the cybersecurity incident. Audit Committee members also receive periodic presentations on cybersecurity topics from our CRO, supported by our information technology staff, or external experts as part of the Board's continuing education on topics that may affect public companies.


text: Our CRO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in our IT environment.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. We engage third-party cybersecurity and information technology ("IT") experts who work with our Chief Risk Officer and Chief Accounting Officer to review and test our IT environment, and to identify potential risks from cybersecurity threats and proactively mitigate their potential effect; the results of which are presented to management and the audit committee of our board of directors. Our team of IT experts hold various relevant certifications and have extensive experience in assessing, detecting, responding to and mitigating cybersecurity risks.


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes and internal IT and risk management professionals principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan to respond to cybersecurity incidents; and • a third-party risk management process for service providers.


text: Cybersecurity Governance Our board of directors (the "Board") considers cybersecurity risk as critical to the enterprise and manages the cybersecurity risk oversight function through the Audit Committee. The Audit Committee oversees management's design, implementation and enforcement of our cybersecurity risk management program.


text: Our Chief Risk Officer ("CRO") periodically reports to the Audit Committee and leads the Company's overall cybersecurity function. The Audit Committee receives regular reports from our CRO on our cybersecurity risks, including briefings on our cyber risk management program. A potentially material cybersecurity incident would be immediately reported to the Audit Committee and management would continue to brief the Audit Committee on management's response to the cybersecurity incident. Audit Committee members also receive periodic presentations on cybersecurity topics from our CRO, supported by our information technology staff, or external experts as part of the Board 's continuing education on topics that may affect public companies.


text: The Company's Cybersecurity Risk Management Approach The Company utilizes and relies on CIM Group for its IT and IT administration. CIM Group's cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. CIM Group's cybersecurity risk management policies and procedures include, among other things: enterprise-wide hardware and software management and security controls; employee training; security assessments;

companyName: CIM REAL ESTATE FINANCE TRUST, INC.

ticker: CMRF


text: penetration testing; security audits and ongoing risk assessments; due diligence on, and monitoring and oversight of, key third-party providers; vulnerability management; and management oversight to assess, identify and manage material risks from cybersecurity threats. CIM Group's controls leverage the National Institute of Standards and Technology Cyber Security Framework. CIM Group also utilizes industry and government associations, the results from regular internal and third-party audits and other similar resources to inform its cybersecurity processes and to allocate resources.


text: In addition, all CIM Group employees receive mandatory training on cybersecurity matters at such employee's new hire and annually thereafter, periodic training and information updates that address new cybersecurity threats and trends, and quarterly "phishing" and social engineering testing to evaluate the effectiveness of the cybersecurity training program and raise employee awareness of cybersecurity threats.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: For further discussion of cybersecurity risks, see "Item 1A. Risk Factors—Risk Related to Our Company - Cybersecurity risks and cyber incidents may adversely affect our business in the event we or our manager, our transfer agent or any other party that provides us with essential services experiences cyber incidents."


text: Management Oversight of Cybersecurity Risk Management CIM Group's internal processes require escalation of material cybersecurity risks to its management and its Cybersecurity Committee (the "Committee") for evaluation. The Committee consists of CIM Group's Chief Technology Officer (the "CTO"), CIM Group's Chief Compliance Officer (the "CCO") as well as representatives from CIM Group's operations, compliance and accounting departments. The Committee is responsible for CIM Group's cybersecurity policy and overseeing the activities of CIM Group's cybersecurity practices, including assessing CIM Group's risks and controls. The Committee is chaired by the CTO who has more than 30 years' experience in the fields of information technology, cybersecurity and adjacent roles, including serving on cybersecurity advisory councils. In addition, members of the Committee have relevant industry experience in enterprise risk management and compliance. The team responsible for developing and implementing our cybersecurity program collectively holds an MS in Cybersecurity and Information Assurance and has multiple cybersecurity certifications, including CRISC, CISM, CISA, NCSP-NIST, CISSP, CASP+, CySA+ and Security+.


text: The Committee has established a Cybersecurity Subcommittee (the "Subcommittee"). The Subcommittee consists of, among others, the CCO, the CTO, the chief financial officers of public companies that are subject to the SEC's cybersecurity rule adopted in 2023 and are managed by CIM Group, including our Chief Financial Officer. The Subcommittee is tasked with assisting CIM Group-managed public companies (that are subject to the SEC's cybersecurity rule adopted in 2023), including us, in complying with such cybersecurity rule.


text: The Committee and Subcommittee each conduct both regular quarterly and as-needed meetings throughout the year during which members of the CIM Group's IT department provide updates and report on meaningful cybersecurity risks, threats, incidents and vulnerabilities in accordance with the Committee's and the Subcommittee's respective reporting frameworks, as well as related priorities, mitigation and remediation activities, financial and employee resource levels, regulatory compliance, technology trends and third-party provider risks. To help inform this reporting framework, CIM Group maintains incident response plans and other policies and procedures designed to respond to, mitigate and remediate cybersecurity incidents based on the potential impact to CIM Group's business, IT systems, network or data, including data held by third parties, or to the IT or other critical services provided by third-party vendors and service providers.


text: CIM Group's personnel responsible for cybersecurity policy is comprised of individuals with either formal education and degrees in IT or cybersecurity, or with experience working in IT and cybersecurity, including relevant industry experience in security related industries.


text: We believe that the processes, policies and procedures established by the Committee and the Subcommittee provide guidance for consistent and effective incident handling and response and set standards for internal notifications and escalations, as well as external notification considerations with respect to a cybersecurity event or incident requiring disclosure or notification in accordance with applicable laws.


text: Board of Directors Oversight of Cybersecurity Risk Management The Audit Committee of our Board has oversight of our cybersecurity risks. The Audit Committee receives quarterly updates from CIM Group with respect to the effectiveness of its cyber readiness and cybersecurity program. This oversight includes briefing and a report by the CTO or CIM Group's Head of Operations, as well as a discussion of any cybersecurity breaches detected by CIM Group and a summary of, among other things, the current cybersecurity threat landscape, defensibility measures implemented by CIM Group, the health of CIM Group's information security system, effectiveness of CIM Group's cybersecurity controls and recoverability and business continuity testing. Pursuant to the Company's cybersecurity policy, the Audit Committee will be promptly notified of any material cybersecurity incident required to be disclosed under Item 105 of Regulation S-K and shall oversee the Company's response to such matter.


text: The Company's Cybersecurity Risk Management Approach The Company utilizes and relies on CIM Group for its IT and IT administration. CIM Group's cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. CIM Group's cybersecurity risk management policies and procedures include, among other things: enterprise-wide hardware and software management and security controls; employee training; security assessments; penetration testing; security audits and ongoing risk assessments; due diligence on, and monitoring and oversight of, key third-party providers; vulnerability management; and management oversight to assess, identify and manage material risks from cybersecurity threats. CIM Group's controls leverage the National Institute of Standards and Technology Cyber Security Framework. CIM Group also utilizes industry and government associations, the results from regular internal and third-party audits and other similar resources to inform its cybersecurity processes and to allocate resources.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: Board of Directors Oversight of Cybersecurity Risk Management The a udit committee of our Board has oversight of our cybersecurity risks. The audit committee receives quarterly updates from CIM Group, including one or more representatives from the Cybersecurity Committee and Subcommittee, with respect to the effectiveness of its cyber readiness and cybersecurity program. This oversight includes briefing and a report by the CTO or CIM Group's Head of Operations, as well as a discussion of any cybersecurity breaches detected by CIM Group and a summary of, among other things, the current cybersecurity threat landscape, defensibility measures implemented by CIM Group, the health of CIM Group's information security system, effectiveness of CIM Group's cybersecurity controls and recoverability and business continuity testing. Pursuant to the Company's cybersecurity policy, the audit committee will be promptly notified of any material cybersecurity incident required to be disclosed under Item 1.05 of Form 8-K and shall oversee the Company's response to such matter.


text: The Company's cybersecurity program is designed to secure the continuity of operations and protect the privacy of company, guest and team member data. The Company uses multiple layers of security controls and unique threat intelligence within the "Center for Internet Security v8 Cybersecurity Framework" across five core security functions: Identify risks and threats, Protect, Detect, Respond and Recover. In addition, the Company requires that its employees complete annual compliance training on cybersecurity and online habits.

companyName: Spirit Aviation Holdings, Inc.

ticker: FLYYQ


text: The Company's cybersecurity program is managed by a dedicated cybersecurity function reporting to the Chief Information Security Officer ("CISO") who reports to the Chief Information Officer ("CIO") and is responsible for the Company's cybersecurity strategy, policies, standards, architecture and process. The CISO has over 20 years of executive experience in IT operations and security, primarily in the airline industry, and maintains several active certifications in Risk and Information Security including CIPPUS, CISSP-ISSMP, CISM, CRISC, and CISSP. The program includes periodic and ad hoc reporting on relevant developments, including monitoring, prevention, detection, mitigation and remediation of the current cybersecurity landscape as well as reporting on any cybersecurity incidents to the Company's CEO and the Safety, Security and Operations Committee of the Board of Directors, which has oversight of management's cybersecurity function. The CISO also engages external government and commercial expertise to continuously evaluate, test and adapt the program. External vendors participate in in-depth security assessments based on the Company's vendor management security policy.


text: Currently, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's operations. However, the nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches could have a material adverse effect on the Company's business strategy, results of operations or financial condition.


text: Currently, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's operations. In addition, the Company successfully completed the first annual cybersecurity audit conducted by TSA under Joint EA 23-01 Cybersecurity-Performance-Based Measures for Airport and Aircraft Operators. However, the nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches could have a material adverse effect on the Company's business strategy, results of operations or financial condition.


text: Cyberattacks represent a potentially significant risk to the Company and our industry. We rely on subsidiaries of Cheniere, through our service agreements with them, as further discussed in Note 12—Related Party Transactions of our Notes to Financial Statements, and the board of directors of CQP's general partner (the "Board"), which has oversight of our operations, to implement policies and procedures that are intended to manage and reduce this risk.

companyName: Sabine Pass Liquefaction, LLC


text: Risk Management and Strategy As part of its broader approach to risk management, Cheniere's cybersecurity program is designed to follow an "identify, protect, detect, respond and recover" approach to cybersecurity that is based off of the National Institute of Standards and Technology Cybersecurity Framework ("CSF"). Cheniere's strategy also includes segmentation of corporate and operations networks, defense in depth and the least privileged access principle. Operational networks have fundamentally distinct safety and reliability standards and pose unique threats in comparison to information technology networks. Realizing these differences, Cheniere routinely evaluates opportunities to refine its cybersecurity program in order to mitigate operational network risks. Cheniere includes business continuity planning as a component of its strategy to help ensure critical systems are available to support the Company in the instance of a disruptive event. Cheniere also participates in various industry organizations to stay abreast of recent trends and developments.


text: On an ongoing basis, Cheniere assesses its people, processes and technology and, when necessary, adjusts the overall program in an effort to adapt to the ever-evolving cyber and geopolitical landscapes. Cheniere conducts regular assessments and audits, cross-functional risk mitigation exercises and risk strategy sessions to identify cybersecurity risks, applicable regulatory requirements and industry standards. These engagements are also designed to exercise, assess the maturity of and enhance Cheniere's Cyber Incident Response Plan. To support these efforts, Cheniere has contracted with third parties to perform facility and system penetration tests, compromise assessments of IT systems, and security maturity assessments of its corporate and operational networks. Cheniere maintains a training program to help its personnel identify and assist in mitigating cybersecurity and data security risks. Cheniere's employees and the members of the Board participate in annual training, user awareness campaigns and additional issue-specific training as needed. Cheniere also provides annual training for certain contractors who have access to its information technology networks.


text: With respect to third party service providers, Cheniere's information security program includes conducting risk-based due diligence of certain service providers' information security programs prior to onboarding. Cheniere strives to contractually require third party service providers with access to its information technology systems, sensitive business data or personal information to maintain reasonable security controls and restrict their ability to use Cheniere's data, including personal information, for purposes other than to provide services to them, except as required by applicable law. Cheniere also strives to negotiate contractual requirements which compel its service providers to notify them of information security incidents occurring on their systems which may affect Cheniere's systems or data, including personal information.


text: During the year ended December 31, 2023, cybersecurity incidents and threats did not materially affect our business, results of operations or financial condition.


text: We rely on Cheniere's cybersecurity leadership team, which consists of its Director and Chief Information Security Officer ("CISO"), Vice President and Chief Information Officer and Senior Vice President of Shared Services. These individuals collectively provide the strategic oversight of Cheniere's cybersecurity governance, cyber risk management and security operations and are responsible for maintaining Cheniere's technology defense posture and program. They have decades of experience managing strategic technology operations, including the identification of cybersecurity risk and the defense of information technology assets from global threats. Cheniere's CISO's experience includes assessing risks, implementing governance programs, and responding to threats in oil and gas, electric and natural gas utilities and nuclear power generation companies. He maintains a Certified Information Security Manager certification from ISACA, secret clearance from the Department of Homeland Security and has played an active role in the development of various cybersecurity standards including the CSF.


text: Risks that could affect us are an integral part of Board and Audit Committee deliberations throughout the year. The Board has oversight responsibility for assessing the primary risks facing us (including cybersecurity risks), the relative magnitude of these risks and management's plan for mitigating these risks, while the Audit Committee of the Board has been delegated the authority to oversee and periodically review the security of CQP's information technology systems and controls, including programs and defenses against cybersecurity threats. The Audit Committee discusses with the management of CQP's general partner its cybersecurity risk exposures and the steps management has taken to mitigate such exposures, including risk assessment and risk management policies. On a quarterly basis, Cheniere's cybersecurity leadership team updates the Audit Committee on the overall status of its cybersecurity program, key operational metrics, current assessments, cybersecurity issues or events and pertinent events related to cybersecurity.


text: For additional information about cybersecurity risks, see the risk A cyber attack involving our business, operational control systems or related infrastructure, or that of third party pipelines which supply the Liquefaction Project, could negatively impact our operations, result in data security breaches, impede the processing of transactions or delay financial or compliance reporting under Risks Relating to Our Operations and Industry in Item 1A.Risk Factors.


text: Cyberattacks represent a potentially significant risk to the Company and our industry. We rely on subsidiaries of Cheniere, through our service agreements with them, as further discussed in Note 11—Related Party Transactions of our Notes to Financial Statements, and the board of directors of CQP's general partner (the "Board"), which has oversight of our operations, to implement policies and procedures that are intended to manage and reduce this risk.


text: On an ongoing basis, Cheniere assesses its people, processes and technology and, when necessary, adjusts the overall program in an effort to adapt to the ever-evolving cyber and geopolitical landscapes. Cheniere conducts regular assessments and audits, cross-functional risk mitigation exercises and risk strategy sessions to identify cybersecurity risks, applicable regulatory requirements and industry standards. These engagements are also designed to exercise, assess the maturity of and enhance Cheniere's Cyber Incident Response Plan. To support these efforts, Cheniere has contracted with third parties to perform facility and system penetration tests, compromise assessments of IT systems and security maturity assessments of its corporate and operational networks. Cheniere maintains a training program to help its personnel identify and assist in mitigating cybersecurity and data security risks. Cheniere's employees and the members of the Board participate in annual training, user awareness campaigns and additional issue-specific training as needed. Cheniere also provides annual training for certain contractors who have access to its information technology networks.


text: With respect to third party service providers, Cheniere's information security program includes conducting risk-based due diligence of certain service providers' information security programs prior to onboarding. Cheniere strives to contractually require third party service providers with access to its information technology systems, sensitive business data or personal information to maintain reasonable security controls and restrict their ability to use Cheniere's data, including personal information, for purposes other than to provide services to them, except as required by applicable law. Cheniere also seeks to negotiate contractual requirements which compel its service providers to notify them of information security incidents occurring on their systems which may affect Cheniere's systems or data, including personal information.


text: During the year ended December 31, 2024, cybersecurity incidents and threats did not materially affect our business, results of operations or financial condition.


text: We rely on Cheniere's cybersecurity leadership team, which consists of its Director and Chief Information Security Officer, Vice President and Chief Information Officer and Senior Vice President of Shared Services. These individuals collectively provide the strategic oversight of Cheniere's cybersecurity governance, cyber risk management and security operations and are responsible for maintaining Cheniere's technology defense posture and program. As part of their governance and risk management responsibilities, these individuals oversee the efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents, including the systems deployed in our technology infrastructure to monitor for threats, perform security control testing and assessments, and incorporate threat intelligence into our day-to-day cybersecurity operations and strategic initiatives. They have decades of experience managing strategic technology operations, including the identification of cybersecurity risk and the defense of information technology assets from global threats.


text: For additional information about cybersecurity risks, see the risk A cyber attack involving our business, operational control systems or related infrastructure, or that of third parties with whom we do business, including pipelines which supply our Liquefaction Project, or an attack on our critical suppliers, could negatively impact our business or operations, result in data security breaches, impede the processing of transactions, delay financial or compliance reporting and potentially harm our reputation under Risks Relating to Our Operations and Industry in Item 1A.Risk Factors.


text: The Company's information security is managed by the Executive Vice President, Finance, Operations and Technology, whose team leads enterprise-wide cybersecurity strategy, policy, education and training, standards, architecture, processes, monitoring and implementation. The status of the Company's cyber risk and threat profile and any proposed plans to strengthen the Company's information security systems or assessments thereof are reported to senior management and the audit committee of our board of directors.

companyName: Townsquare Media, Inc.

ticker: TSQ


text: The Company has implemented and continues to enhance a comprehensive set of cybersecurity measures based on industry best practices that are meant to protect confidential information, minimize vulnerabilities and intrusions, and maximize detection and response and restoration capabilities. Key components of our strategy include employee training, identity management, multi-factor authentication, endpoint security, detection and response SOCs, privileged access and endpoint management, network traffic inspection, email security, local and cloud-based backups, and third party vulnerability testing and remediation.


text: Our strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors in this Annual Report.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the security, confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: American Assets Trust, Inc.

ticker: AAT


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology ("IT") environment; • a team of employees (as further described below), or our Response Team responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of reputable, recognized external service providers that assess, test and otherwise assist with aspects of our cybersecurity controls; • periodic cybersecurity awareness training of our employees, incident response personnel, and senior management; • an incident response plan that includes procedures for responding to cybersecurity incidents; and • a risk management process with respect to IT-related third-party service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other IT risks. The Audit Committee reviews and approves our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our President and Chief Operating Officer or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Response Team is responsible for assessing and managing our material risks from cybersecurity threats, has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Response Team includes our President and Chief Operating Officer, our Executive Vice President and Chief Financial Officer, our Director of IT, our Business Systems Manager, our Corporate Controller and our Director of Internal Audit. The Response Team members' relevant experience includes overseeing IT departments, reviewing existing security measures, and implementing solutions to mitigate security risks that may pose threats to a business.


text: Our Response Team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including third-party consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Director of IT and Legal Department or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Response Team is responsible for assessing and managing our material risks from cybersecurity threats, has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Response Team includes our President and Chief Operating Officer (and current President and Chief Executive Officer effective January 1, 2025), our Executive Vice President and Chief Financial Officer, our Director of IT, our Business Systems Manager, our Corporate Controller and our Director of Internal Audit. The Response Team members' relevant experience includes overseeing IT departments, reviewing existing security measures, and implementing solutions to mitigate security risks that may pose threats to a business.


text: The security of personal data is of the utmost importance to GoPro and our customers, vendors, suppliers, and employees. As such, we have implemented industry-standard administrative, technical, and physical security measures to protect against the unauthorized access, destruction, or alteration of our confidential and proprietary information and customer and employee information.

companyName: GoPro, Inc.

ticker: GPRO


text: Our Chief Information Security Officer (CISO) oversees our information security program and is responsible for leading and implementing, with a cross functional team, our cybersecurity strategy, policy, architecture, and risk management processes. Our CISO has over 30 years of experience in cybersecurity, serving as a Security Officer while in the United States Navy and CISO at Amgen and Warner Bros and in various other Cybersecurity roles at KPMG and Forrester.


text: The Audit Committee of our board of directors (Audit Committee) has oversight responsibility for our cybersecurity program and reviews with management the Company's policies and procedures for identifying, assessing, managing, and monitoring information security and cybersecurity risks.


text: The CISO provides regular updates to the Audit Committee on cybersecurity and other risks relevant to our information technology environment, including developments in the cybersecurity space and evolving standards, the results of periodic exercises and response readiness assessments and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews. Our cybersecurity program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Audit Committee.


text: Risk Management and Strategy Our periodic assessment and testing of policies, standards, processes and practices that are designed to address cybersecurity threats and incidents include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness.


text: We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. We regularly train all employees on cybersecurity risks, such as phishing attacks, and employees are required to acknowledge our cybersecurity policy annually through our Code of Conduct.


text: Risks from Cybersecurity Threats No previous cybersecurity incidents have materially affected us, including our business strategy, results of operations or financial condition. Future cybersecurity threats or incidents may materially affect our business strategy, results of operations or financial condition.


text: We rely on information technology to operate our business. We have endpoint and other protection systems, and incident response processes, both internally and through third-party experts designed to protect our information technology systems. These established processes assist us to continuously assess and identify threats to our systems and minimize impact to our business in the event of a breach or other security incident. Additionally, the Company has implemented numerous information technology policies and procedures concerning cybersecurity matters, which include policies that directly or indirectly relate to encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information and the use of the internet, social media, email and wireless and personal devices for both Company business and personal matters while utilizing Company resources. These policies go through an internal review process on a periodic basis and are, if needed, updated and re-approved by the appropriate members of management. With our third-party consultants, the processes protect our information systems and allow us to resolve any issue which may arise in the most timely and aggressive fashion.

companyName: enCore Energy Corp.

ticker: EU


text: As any new threat to security may be identified, our personnel are notified, with instruction to increase awareness of the threat and how to react if such a threat or actual breach appears to be encountered. Periodic educational notices are also disseminated to all personnel. Additionally, as our systems are modified and upgraded, all personnel are notified, with instruction as appropriate. Responsibility for the identification and assessment of risks and the recommendation of upgrades to our systems resides with our expert consultants who report to our Interim Chief Executive Officer.


text: Our Board oversees the risks involved in our operations as part of its general oversight function, integrating risk management into the Company's compliance policies and procedures. With respect to cybersecurity, the Audit Committee of the Board has the ultimate oversight responsibility relating to risk management of cybersecurity.


text: Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cyber security, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirements. In addition to its other responsibilities, the Board as a whole oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations. The full Board receives at least annual reports from management on information technology matters, including cybersecurity. The reports address upgrades to hardware, software, and IT systems throughout the Company, and include the identification of IT and cybersecurity risks. Security scores, risk management, and mitigation measures are routinely presented. As discussed above, we maintain endpoint and other protection systems, and incident response processes, both internally and through third-party experts. As these systems, processes, training, and upgrades are implemented, updates are provided to the Board.


text: from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and we do not believe are reasonably likely to materially affect us, including our business strategy, results of operations or financial statements. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and we do not believe are reasonably likely to materially affect us, including our business strategy, results of operations or financial statements. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," We are dependent on information technology systems, which are subject to certain risks, including cybersecurity risks and data leakage risks associated with implementation and integration" above.


text: Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. To mitigate these risks and protect sensitive customer data, financial transactions and our information systems, the Company has implemented a comprehensive cybersecurity risk management program, which is a component of its overarching enterprise risk management program. Key components of the cybersecurity risk management program include: • A risk assessment process that identifies and prioritizes material cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate these risks; and reports results to executive management and the Board; • A third-party MDR service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting; • A dedicated cybersecurity team covering critical cyber defense functions such as engineering, data protection, identity and access management, insider risk management, security operations, threat emulation and threat intelligence; • A training program that educates employees about cybersecurity risks and how to protect themselves from cyberattacks; • An awareness program that keeps employees informed about cybersecurity threats and how to stay safe online; • An incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident, which is tested on a periodic basis.

companyName: Veritex Holdings, Inc.


text: The Company engages reputable third-party assessors to conduct various independent risk assessments on a regular basis, including but not limited to maturity assessments and various testing. Following a defense-in-depth strategy, the Company leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.


text: Our third-party risk management program is designed to ensure that our vendors meet our cybersecurity requirements. This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls and monitoring vendor compliance with our cybersecurity requirements.


text: The Company's cybersecurity risk management program and strategy are designed to ensure the Company's information and information systems are appropriately protected from a variety of threats, both natural and man-made. Periodic risk assessments are performed to validate control requirements and ensure that the Company's information is protected at a level commensurate with its sensitivity, value, and criticality. Preventative and detective security controls are employed on media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Company information. These controls include, but are not limited to access control, data encryption, data loss prevention, incident response, security monitoring, third party risk management, and vulnerability management.


text: The Company's cybersecurity risk management program and strategy are regularly reviewed and updated to ensure that they are aligned with the Company's business objectives and are designed to address evolving cybersecurity threats and satisfy regulatory requirements and industry standards.


text: Material Effects of Cybersecurity Threats While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it may not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A Risk Factors.


text: The Board is charged with overseeing the establishment and execution of the Company's risk management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility the Board has delegated primary oversight responsibility over the Company's risk management framework, including oversight of cybersecurity risk and cybersecurity risk management, to the Risk Committee of the Board. The Risk Committee receives regular updates on cybersecurity risks and incidents and the cybersecurity program through direct interaction with the CISO and the Head of Information Risk and provides periodic updates regarding cybersecurity risks and the cybersecurity program to the full Board. Additionally, awareness and training on cybersecurity topics is provided to the Board on an annual basis.


text: Management's Role The Information Security department is responsible for implementing and maintaining the Company's cybersecurity risk management program. The Information Security department consists of cybersecurity and information risk professionals who assess, identify, and manage cybersecurity risks. Information Security is led by the CISO, who reports directly to the Chief Information Officer and the Board with a secondary reporting line to the Chief Risk Officer. The Company's CISO has over 20 years of experience in cybersecurity across the financial services industry, as well as experience working in a leading managed security services provider. Prior to joining the Company, the Company's CISO served as leader of the Global Threat Management Center for a major global financial institution. The Information Risk department, led by the Head of Information Risk, who reports directly to the Chief Risk Officer, is responsible for ensuring the protection of electronic and physical information through the identification and management of risk activities. As a governance and oversight function, the Information Risk department measures and reports on the quality of information and cyber risk management across all functions of the Company. Information security risk is reported by both the Information Security and Information Risk departments through monthly management metric reporting working groups and multiple layers of quarterly risk committees to achieve an appropriate flow of information risk reporting to the Board. The risk committees include the Operational Risk Management Committee, the Executive Risk Management Committee and the Risk Committee of the Board. These committees establish and oversee policies, programs, and other guidance to provide specific expectations for managing the cybersecurity risk.


text: Our cybersecurity program (the "Cybersecurity Program") includes processes to identify, assess, and manage material risks from cybersecurity threats. The Cybersecurity Program processes utilize a risk-based approach and include written cybersecurity and information technology policies and procedures, including a cybersecurity incident response plan.

companyName: HUNTINGTON INGALLS INDUSTRIES, INC.

ticker: HII


text: The Cybersecurity Program is informed, in part, by the guidelines of the National Institute of Standards and Technology Cybersecurity Framework to define material risks and establish controls designed to protect, detect, respond to, and recover from cybersecurity incidents. Controls are embedded within our processes and technology, and system activities are measured and monitored by our cybersecurity and information security subject matter specialists and applicable security operations centers at our different business units. We utilize an enterprise-wide "defense-in-depth" risk management strategy to effectively integrate people, processes, and technology.


text: When appropriate, we use external subject matter specialists to provide incident response services and to conduct independent assessments of internal response readiness. We conduct tabletop scenario planning, covering a range of potential cybersecurity threats, as part of our internal response readiness assessment. We also maintain a supply chain cybersecurity compliance and risk mitigation program to assess material cybersecurity risk from third parties.


text: In 2019, our board of directors established a standing Cybersecurity Committee, which is tasked with oversight of the Cybersecurity Program, including: (i) strategy and governance; (ii) operations; and (iii) risk management and regulatory compliance.


text: The Cybersecurity Committee responsibilities include: • reviewing our enterprise cybersecurity strategy and framework, including our assessment of cybersecurity threats and risk, data security programs, and our management and mitigation of cybersecurity and information technology risks and potential breach incidents; • reviewing any significant cybersecurity incident that has occurred, reports to or from regulators with respect thereto, and steps that have been taken to mitigate against reoccurrence; • evaluating the effectiveness of our cyber risk management and data security programs measured against our cybersecurity threat landscape; • assessing the effectiveness of our data breach incident response plan; • reviewing and assessing our information technology disaster recovery capabilities; and • reviewing our assessment of cybersecurity threats and risk associated with our supply chain and actions we are taking to address such threats and risks.


text: The Cybersecurity Committee receives reports and updates at committee meetings from our Chief Information Officer ("CIO"), Chief Information Security Officer ("CISO"), and other executives and cybersecurity specialists. Following each committee meeting, the chair of the Cybersecurity Committee briefs the full board of directors on matters covered at the prior Cybersecurity Committee meeting. The board also receives periodic briefings on emerging trends in order to enhance its literacy on cybersecurity issues. At least annually, the Cybersecurity Committee receives updates about the results of the Cybersecurity Program reviews. The Cybersecurity Committee participates with management periodically in "tabletop" exercises to evaluate our data breach incident response plan.


text: Management's Role and Expertise in Assessing and Managing Cybersecurity Our Cybersecurity and Information Technology organization is led by our CIO, who is responsible for cybersecurity risk management, with oversight by the Cybersecurity Committee of the board of directors. Our CIO has more than 25 years of experience in the IT industry. Since 2008, he has held senior-level and CIO positions for several companies, each of which included responsibilities or influence for cybersecurity implementation delivery and oversight.


text: Our CISO executes the Cybersecurity Program with the support of the Cybersecurity Management Team, which has extensive cybersecurity expertise to protect and defend our networks, physical systems, infrastructure, and data from cybersecurity risks. Our CISO has 30 years of experience in cybersecurity, IT networking and electronic security, and holds a degree in Information Systems (Cybersecurity concentration). He has specific experience in the following cybersecurity areas: global IT security policy & governance; information risk management; cybersecurity strategic planning and integration; enterprise infrastructure cybersecurity engineering; incident response and remediation; global supply chain cyber risk management; cybersecurity awareness training; M&A cyber risk management; Cloud security; identity management; disaster recovery; and cybersecurity damage assessment.


text: Our cybersecurity incident response framework is governed by a corporate Cybersecurity Incident Response Plan (the "IRP"), which sets out our approach for categorizing, responding to, and mitigating cybersecurity incidents. The IRP provides definitions of key terms, stakeholder roles and responsibilities, and a response governance and escalation process.


text: We have an incident response team comprised of our CISO, executive leaders, management, and internal and external legal counsel, whose primary responsibilities include: • evaluating and validating the impact of an incident; • approving certain incident response countermeasures and remediation actions; • escalating incidents and response countermeasures for approval; and • acting in an advisory capacity in support of cybersecurity incident remediation, as appropriate.


text: We also have an executive cybersecurity and information technology steering committee comprised of our Chief Executive Officer, CIO, and other members of our executive leadership team, whose primary responsibilities include: • approving containment and remediation procedures for escalated cyber incidents; • activating, when appropriate, a crisis management team response; and • approving certain incident response measures.


text: We maintain a Crisis Management Plan that addresses our preparation for, management, recovery from, and ultimate resumption of business after a crisis, including emergency response, continued recovery, and business resumption activities such as information systems recovery, when a cybersecurity incident may potentially have a significant impact on our business strategy, results of operations, or financial condition.


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors," specifically the risks titled "We could be negatively impacted by security threats, including cyber security threats, and related disruptions" and "Our earnings and profitability depend, in part, upon subcontractor performance and raw material and component availability and pricing," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Our cybersecurity program (the " Cybersecurity Program ") includes processes to identify, assess, and manage material risks from cybersecurity threats. The Cybersecurity Program processes utilize a risk-based approach and include written cybersecurity and information technology policies and procedures, including a cybersecurity incident response plan.


text: Our CISO executes the Cybersecurity Program with the support of the Cybersecurity Management Team, which has extensive cybersecurity expertise to protect and defend our networks, physical systems, infrastructure, and data from cybersecurity risks. Our CISO has 33 years of experience in cybersecurity and information technology, over 20 years working with NAVSEA 08Y, approval authority of HII's unclassified Naval Nuclear Propulsion Information networks, and holds a Master's degree in Cybersecurity. He has specific experience in the following cybersecurity areas: Cyber & IT security policy & governance; information risk management; cybersecurity strategic planning and integration; enterprise infrastructure; cybersecurity engineering; incident response and remediation; supply chain cyber risk management; cybersecurity awareness training; M&A cyber risk management; cloud security; identity management; disaster recovery; cybersecurity regulation compliance; and cybersecurity damage assessment.


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed under Item 1A. "Risk Factors," specifically the risks titled "We could be negatively impacted by security threats, including cyber security threats, and related disruptions" and "Our earnings and profitability depend, in part, upon subcontractor performance and raw material and component availability and pricing," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: We maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. Our cybersecurity program is overseen by our Chief Information Officer ("CIO "), who has more than 20 years of experience in information technology. This program incorporates policies, processes, and activities over domains such as access control; facility and data protection; IT systems and data transmission security; threat intelligence and incident response; third-party risk management; disaster recovery; and vulnerability management. We have a comprehensive cybersecurity policy in place that includes robust measures to protect our data and systems from cyber threats, ensuring the integrity and confidentiality of our information.

companyName: Quanterix Corp

ticker: QTRX


text: We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Thus, we base our program on multiple security frameworks including the National Institute of Standards and Technology ("NIST"), HIPAA, and privacy laws such as the E.U.'s GDPR. We also require that third-party service providers with access to personal or proprietary information implement and maintain cybersecurity practices consistent with applicable legal standards.


text: Cybersecurity is complex and subject to constantly evolving threats. Accordingly, we engage a range of external experts, including cybersecurity consultants and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights. Our collaboration with these third-party experts includes regular audits, threat assessments, and consultation on security enhancements.


text: Our CIO is tasked with ensuring that the highest levels of management and our Board of Directors are informed about the cybersecurity posture and potential risks facing the Company. Our CIO regularly briefs our CEO about cybersecurity risk management. The CIO's staff regularly informs the CIO about the latest developments in cybersecurity, including potential threats and risk management techniques. In the event of a cybersecurity incident, the CIO is informed promptly following its detection, and our response is governed by a detailed incident response plan that includes prompt actions to mitigate the impact of the incident and longer-term strategies for remediation and prevention of future incidents. The CIO has also chartered an Information Security Steering Committee made up of cross-functional executive leaders that meets quarterly on topics such as the current cybersecurity landscape and emerging threats; status of ongoing cybersecurity initiatives and strategies; incident reports and learnings from any cybersecurity events; and compliance with regulatory requirements and industry standards.


text: Cybersecurity risk management is integrated into our broader risk management framework. The Audit Committee of our Board of Directors, which has responsibility for oversight of risk management, also has responsibility for oversight of our program, policies and procedures related to information security and data protection. On a regular basis, the CIO reports to the Audit Committee of our Board of Directors on cybersecurity risks as well as mitigation strategies and the status of initiatives to strengthen our information security systems. The CIO also provides periodic updates to our full Board of Directors, as appropriate. We also mandate a rigorous cybersecurity training program for all employees, which includes regular updates and assessments to ensure they are equipped to recognize and respond to potential cyber threats.


text: For a discussion of our risks related to cybersecurity, see the section titled, "Item 1A. Risk Factors – Risks Related to our Operations – Cybersecurity breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."


text: Risk Management and Strategy We have developed and implemented a cybersecurity framework intended to assess, identify and manage risks from threats to the security of our information, systems, products and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology, or NIST, Cybersecurity Framework, NIST 800-53 and International Organization for Standardization 27001, or ISO 27001, Framework, although we do not comply with all technical standards, specifications or requirements under NIST or ISO 27001.

companyName: NorthStar Healthcare Income, Inc.