text: The Innovation and Technology Committee of our Board of Directors is responsible for overseeing our cybersecurity program, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our CISO and our CIO provide quarterly reports to the Innovation and Technology Committee regarding our cybersecurity program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Innovation and Technology Committee reviews and approves our cybersecurity and technology budgets and strategies annually. Additionally, the Risk Committee of our Board of Directors reviews key metrics summarizing our cybersecurity risk profile on a quarterly basis. The Innovation and Technology Committee and Risk Committee each provide a report of their activities to our full Board of Directors at each Board meeting.


text: Lastly, at least annually, the CISO reports directly to our Board of Directors the overall status of the cybersecurity program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, system failures, interruptions or cybersecurity breaches are discussed as are management's responses and any recommendations for program changes.

companyName: Northwest Bancshares, Inc.

ticker: NWBI

secItem: Item 1C


text: Since the closing of the Transfer Agreement, we have been a shell company with nominal operations and assets and our sole business activity has been to seek, investigate, and, if warranted, acquire an interest in a business opportunity. Therefore, we do not believe that we face significant cybersecurity risk.

companyName: Agassi Sports Entertainment Corp.

ticker: AASP


text: have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. However, because we depend on the digital technologies of third-party IT service providers, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our management is generally responsible for assessing and managing any cybersecurity threats. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to our Board of Directors for further actions, including regarding the appropriate disclosure, mitigation, or other response or actions that the Board of Directors deems have not encountered any cybersecurity incidents since the closing of the Transfer Agreement."


text: The Company's cyber risk management strategy has consisted of a focus on minimizing our attach surface and leveraging industry standard cyber threat prevention, detection, and remediation tools. The Company assesses cyber security risk as follows:

companyName: REGENEREX PHARMA, INC.

ticker: RGPX


text: We have executed on this strategy with a cloud-first approach, awareness training, and deliberate use of well-established vendors for software and hardware solutions.


text: The Company's IT manager is engaging an independent service with its expertise specifically in cybersecurity and risk mitigation to review our IT as a risk service consultant. To date, no cybersecurity threats have materially affected our business strategy, operations, or financial condition.


text: The Company's cyber risk management strategy has consisted of a focus on minimizing our attach surface and leveraging industry standard cyber threat prevention, detection, and remediation tools.


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our Company, including financial, operational, regulatory, reputational, and legal. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes and practices are integrated into the Company's ERM program and are based on recognized frameworks established by the Federal Financial Institutions Examination Council and other industry recognized standards. Our Chief Information Security Officer ("CISO"), who reports directly to the Bank's Chief Risk Officer ("CRO"), along with key members of his team, regularly collaborates with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues to identify best practices. The information security program is periodically reviewed by the Bank's CISO with the goal of addressing changing threats and conditions. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Stellar Bancorp, Inc.

ticker: STEL


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity risk management program and strategy is focused on the following key areas: • Governance—As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Risk Committee of the Board (the "Risk Committee") and by the Technology Committee of the Board (the "Technology Committee"), which regularly interacts with the Company's ERM function, CRO, Chief Information Officer ("CIO"), CISO and other members of management and relevant management committees. In recognition of the evolving landscape of cyber threats and the critical importance of safeguarding our digital assets and customer information, the Bank has taken proactive steps to enhance our cybersecurity framework and risk management practices. Central to these efforts is the expertise and oversight provided by the Board, particularly through the involvement of its Technology Committee. This committee is composed of directors with significant experience in technology and cybersecurity, working to align our cyber risk management strategies with best practices and industry standards. • Technical Safeguards—The Company deploys layered technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through penetration testing, vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning—The Company has implemented a robust, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents. To that end, the Company has established and maintains a comprehensive cybersecurity incident response plan that establishes a structured approach for the Company's response to a cybersecurity incident, such plan is tested and evaluated on a regular basis. The Company has implemented controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Outside Experts—The Company routinely works with outside experts, consultants, auditors and other third parties in connection with managing its cybersecurity risks and for advice regarding best practices and technical expertise. • Third-Party Risk Management—The Company maintains a robust, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness—The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee of the Board, the Risk Committee, the Technology Committee and the Board. The Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: During the fiscal year of this Report, the Company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents that individually or in the aggregate have materially affected or are reasonably anticipated to materially affect the organization. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving, and we continue to remain vigilant. For more information on the Company's cybersecurity-related risks, see "Item 1A. Risk Factors – Risks Related to Cybersecurity, Third-Parties and Technology." The prior incidents enabled us to enhance our operational and cybersecurity risk management practices. The lessons learned have also informed our approach to conducting tabletop exercises simulating potential cyber threats, allowing the Bank to assess and improve our response protocols.


text: The Board, in coordination with the Risk Committee and Technology Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Technology Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews. The CRO reports to the Technology Committee and management committees information regarding cybersecurity incidents that meet established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board, Technology Committee and appropriate management committees review the Company's approach to cybersecurity risk management through reporting by the CISO. The Technology Committee and the Board approve the Information Security Program and all supporting Policies.


text: The CISO, in coordination with the Bank's CRO, CIO and General Counsel, works across the Company to implement and monitor a program designed to protect the Company's information systems from cybersecurity threats and promptly respond to any cybersecurity incidents in accordance with the Company's cybersecurity incident response plan. The Company has recently bolstered cybersecurity leadership, with the addition of a Director of Information Security Officer ("DISO"). The DISO possesses a wealth of experience in the field of information security, notably having served as a regulator in charge of information security for over seven years. This background provides the DISO with a deep understanding of cybersecurity challenges and regulatory requirements faced by financial institutions. This expertise is invaluable in enhancing our cyber defenses and ensuring our compliance with stringent regulatory standards.


text: The Company's CISO has served in various roles in information technology and information security for over twenty years, including serving as a Cyberspace Operations Officer in the United States Air Force Reserves and instructing for the SANS Technology Institute. The Company's CISO holds an undergraduate degree in Business Administration and has attained the professional certification of Certified Information Systems Security Professional ("CISSP") and numerous GIAC certifications. The Company's CRO has over a 25-year career in the banking industry and is currently serving as Senior Executive Vice President and Chief Risk Officer of Stellar Bank and Chief Risk Officer of Stellar Bancorp, Inc. Previously, the CRO has held the positions of President and Chief Risk Officer at Allegiance Bank and Executive Vice President and Chief Risk Officer at Allegiance. The Company's CRO's banking career as an executive started at Independence Bank in 2002 as Senior Credit Officer and eventually was promoted to President in 2009. Between 2010 and 2013, the CRO also served as CEO of Independence Bank until joining Allegiance Bank following a merger. The Company's CRO has since assumed the roles of Regional President, Deputy Chief Credit Officer, and Chief Administration Officer at Allegiance Bank. The CRO holds an MBA from the University of Houston and a Bachelor of Arts in Finance & Marketing from the same institution.


text: The Company's CEO, CFO and GC each hold undergraduate and/or graduate degrees in their respective fields, and each have significant experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats. The members of the Boards of Directors of the Company and the Bank have hundreds of combined years of experience running successful companies and managing enterprise risk. Specific cybersecurity expertise is brought to the Board from independent directors who lead or have led technology firms and, as such, have direct managerial oversight of cybersecurity risks.


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity risk management program and strategy is focused on the following key areas: • Governance—As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Risk Committee of the Board (the "Risk Committee") and by the Technology Committee of the Board (the "Technology Committee"), which regularly interacts with the Company's ERM function, CRO, Chief Information Officer ("CIO"), CISO and other members of management and relevant management committees. In recognition of the evolving landscape of cyber threats and the critical importance of safeguarding our digital assets and customer information, the Bank has taken proactive steps to enhance our cybersecurity framework and risk management practices. Central to these efforts is the expertise and oversight provided by the Board, particularly through the involvement of its Technology Committee. This committee is composed of directors with significant experience in technology and cybersecurity, working to align our cyber risk management strategies with best practices and industry standards. • Technical Safeguards—The Company deploys layered technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through penetration testing, vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning—The Company has implemented a robust, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents. To that end, the Company has established and maintains a comprehensive cybersecurity incident response plan that establishes a structured approach for the Company's response to a cybersecurity incident, such plan is tested and evaluated on a regular basis. The Company has implemented controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Outside Experts —The Company routinely works with outside experts, consultants, auditors and other third parties in connection with managing its cybersecurity risks and for advice regarding best practices and technical expertise. • Third-Party Risk Management —The Company maintains a robust, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness—The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats.


text: During the fiscal year of this Report, the Company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents that individually or in the aggregate have materially affected or are reasonably anticipated to materially affect the organization. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving, and we continue to remain vigilant. For more information on the Company's cybersecurity-related risks, see "Item 1A. Risk Factors – Risks Related to Cybersecurity, Third-Parties and Technology." Any prior incidents enabled us to enhance our operational and cybersecurity risk management practices. The lessons learned have also informed the Company's approach to conducting tabletop exercises simulating potential cyber threats, allowing the Company to assess and improve its response protocols.


text: The Board, in coordination with the Risk Committee and Technology Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Technology Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews. The CISO reports to the Board Risk Committee, Technology Committee and management committees information regarding cybersecurity incidents that meet established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board, Technology Committee and appropriate management committees review the Company's approach to cybersecurity risk management through reporting by the CISO. The Technology Committee and the Board approve the Information Security Program and all supporting policies.


text: The CISO, in coordination with the CRO, CIO and General Counsel, works across the Company to implement and monitor a program designed to protect the Company's information systems from cybersecurity threats and promptly respond to any cybersecurity incidents in accordance with the Company's cybersecurity incident response plan. The Company's CISO has served in various roles in information technology and information security for over twenty years, including serving as a Cyberspace Operations Officer in the United States Air Force Reserves and instructing for the SANS Technology Institute. The Company's CISO holds an undergraduate degree in Business Administration and has attained the professional certification of Certified Information Systems Security Professional ("CISSP") and multiple GIAC certifications. The Company's CRO has over a 25-year career in the banking industry and is currently serving as Senior Executive Vice President and Chief Risk Officer of Stellar Bank and Chief Risk Officer of Stellar Bancorp, Inc. Previously, the CRO has held the positions of President and Chief Risk Officer at Allegiance Bank and Executive Vice President and Chief Risk Officer at Allegiance. The Company's CRO's banking career as an executive started at Independence Bank in 2002 as Senior Credit Officer and eventually was promoted to President in 2009. Between 2010 and 2013, the CRO also served as CEO of Independence Bank until joining Allegiance Bank following a merger. The Company's CRO has since assumed the roles of Regional President, Deputy Chief Credit Officer, and Chief Administration Officer at Allegiance Bank. The CRO holds an MBA from the University of Houston and a Bachelor of Arts in Finance & Marketing from the same institution.


text: The Company's CEO, CFO and General Counsel each hold undergraduate and/or graduate degrees in their respective fields, and each have significant experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats. The members of the Boards of Directors of the Company and the Bank have hundreds of combined years of experience running successful companies and managing enterprise risk. Specific cybersecurity expertise is brought to the Board from independent directors who lead or have led technology firms and, as such, have direct managerial oversight of cybersecurity risks.


text: We have identified cybersecurity risk as one of our key enterprise risks. One of our Co-Presidents is responsible for managing cybersecurity risk. They develop mitigation strategies and implement controls to reduce the likelihood of a cybersecurity incident occurring and to reduce the impact of such an incident should it occur. At least annually, they report on this risk and their mitigation work to the Audit Committee of our Board of Trustees, which is the committee that has primary responsibility for overseeing our enterprise risk management program and is composed solely of independent trustees. The Audit Committee reviews and discusses all of our key enterprise risks, including cybersecurity risk, and the enterprise risk management program itself. The chair of the Audit Committee may, at their discretion, report to the Chairman of the Board or the full Board of Trustees regarding any aspect of the program or risks.

companyName: Pebblebrook Hotel Trust

ticker: PEB


text: As of December 31, 2023, no risk from cybersecurity threats, including as a result of any previous cybersecurity incident, has materially affected our business, results of operations or financial condition. Although we have invested in the protection of our data and information systems and the monitoring of our systems on an ongoing basis, such efforts may not in the future prevent material compromises to our information systems, including those that could have a material adverse effect on our business. We maintain cybersecurity insurance coverage to mitigate our financial exposure to certain incidents, and we consult with external advisors regarding opportunities and enhancements to strengthen our policies and practices.


text: We have elected to outsource our information technology function to a third-party managed service provider, or the MSP, that specializes in fully managed information technology services and fully managed cybersecurity. The MSP is responsible for managing all of our hosted services, all of the computer and computer-related hardware and software we use, and all onsite and offsite backups. The MSP also provides managed security services designed to prevent cybersecurity threats, to identify and remediate vulnerabilities, to monitor systems 24/7, to protect data and systems, to detect potential intrusions and cybersecurity incidents, to quarantine systems should they be compromised, and to recover from business interruptions or other disasters. The MSP follows the NIST Cybersecurity Framework, developed by the National Institute of Standards and Technology of the U.S. Department of Commerce, to measure the maturity of the services it provides to us and its other clients.


text: The MSP and we developed a cybersecurity incident response plan that sets forth roles and responsibilities for the identification, assessment, triage, communication and resolution of cybersecurity incidents.


text: In addition, the MSP performs facility and system penetration tests, compromise assessments and security maturity assessments of our corporate and operational networks. In collaboration with the MSP, we maintain a comprehensive cybersecurity training program to help our personnel identify and assist in mitigating cybersecurity risks. Our executive officers and employees participate in annual training with additional issue-specific training as needed.


text: While we have control, through our contract with the MSP, over our information systems, we do not have control over the information systems of our hotel managers, which are the third-party operators of our hotels and resorts, or of our franchisors. Although we set clear expectations of our hotel managers and franchisors, we rely on our hotel managers and franchisors for managing their cybersecurity risk. We conduct surveys of our hotel managers and franchisors to assess their cybersecurity risk management programs and procedures, to identify gaps and request remediation and to understand our risk exposure. Many of our hotel managers and franchisors carry cyber insurance policies to protect and offset a portion of potential costs incurred from a security breach. Additionally, we currently have cyber insurance policies to provide supplemental coverage above the coverage carried by our hotel managers and franchisors.


text: For additional information about cybersecurity risk, see "Item 1A. Risk Factors—Our hotel managers and we rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could harm our business."


text: We have identified cybersecurity risk as one of our key enterprise risks. One of our Co-Presidents is responsible for managing cybersecurity risk. He develops mitigation strategies and implements controls to reduce the likelihood of a cybersecurity incident occurring and to reduce the impact of such an incident should it occur. At least annually, he reports on this risk and related mitigation work to the Audit Committee of our board of trustees, which is the committee that has primary responsibility for overseeing our enterprise risk management program and is composed solely of independent trustees. The Audit Committee reviews and discusses all of our key enterprise risks, including cybersecurity risk, and the enterprise risk management program itself. The chair of the Audit Committee may, at his discretion, report to the Chairman of the Board or the full board of trustees regarding any aspect of the program or risks.


text: As of December 31, 2024, no risk from cybersecurity threats, including as a result of any previous cybersecurity incident, has materially affected our business, results of operations or financial condition. Although we have invested in the protection of our data and information systems and the monitoring of our systems on an ongoing basis, such efforts may not in the future prevent material compromises to our information systems, including those that could have a material adverse effect on our business. We maintain cybersecurity insurance coverage to mitigate our financial exposure to certain incidents, and we consult with external advisors regarding opportunities and enhancements to strengthen our policies and practices.


text: We have elected to outsource our information technology function to a third-party managed service provider, ("MSP") that specializes in fully managed information technology services and fully managed cybersecurity. The MSP is responsible for managing all of our hosted services, all of the computer and computer-related hardware and software we use, and all onsite and offsite backups. The MSP also provides managed security services designed to prevent cybersecurity threats, to identify and remediate vulnerabilities, to monitor systems 24/7, to protect data and systems, to detect potential intrusions and cybersecurity incidents, to quarantine systems should they be compromised, and to recover from business interruptions or other disasters. The MSP follows the NIST Cybersecurity Framework, developed by the National Institute of Standards and Technology of the U.S. Department of Commerce, to measure the maturity of the services it provides to us and its other clients.


text: While we have control, through our contract with the MSP, over our information systems, we do not have control over the information systems of our hotel managers, which are the third-party operators of our hotels and resorts, or of our franchisors. We set clear expectations of our hotel managers and franchisors regarding cybersecurity, but we rely on our hotel managers and franchisors for managing their cybersecurity risk. We conduct surveys of our hotel managers and franchisors to assess their cybersecurity risk management programs and procedures, to identify gaps and request remediation and to understand our risk exposure. Many of our hotel managers and franchisors carry cyber insurance policies to protect and offset a portion of potential costs incurred from a security breach. Additionally, we currently have cyber insurance policies to provide supplemental coverage above the coverage carried by our hotel managers and franchisors.


text: Our broader information security program aims to secure our systems, keep our business running, and protect our client partners, field talent, team members, and shareholders from vulnerabilities and threats by protecting against, detecting, and recovering from cybersecurity incidents. With oversight from our Board, the Audit Committee, and management, we have put proactive measures and systems in place in an effort to protect our information assets from unauthorized use or access. Our cybersecurity framework is based on the National Institute of Standards and Technology ("NIST").

companyName: BGSF, INC.

ticker: BGSF


text: Management Oversight Our CIO and key members of senior management are accountable for our cybersecurity and data privacy programs and is supported by the Board of the Directors (the "Board"). Our CIO has extensive information technology and program management experience and has served many years in our corporate information security organization. Under the guidance of the Board, the CIO manages day-to-day operations of the security and data privacy functions and proposes changes to our cybersecurity strategy, which is part of our overall information technology strategy. The CIO and the Board meet frequently to discuss cyber and data operations, privacy programs and risks.


text: Our IT department monitors and manages system infrastructure in an effort to protect us against threats. Our cybersecurity process considers risks from many sources including, but not limited to, alerts, threat intelligence sources, risk assessments, and vulnerability management. Our cybersecurity process includes a risk assessment procedure, a risk evaluation procedure, and a third-party partner to strengthen our cybersecurity controls. These controls are designed to block and/or provide alerts on suspicious activities. Our security team responds as appropriate to risks identified.


text: The Board is actively engaged in the oversight of cybersecurity and data privacy. On a quarterly basis, the Board receives updates on (a) our progress on security improvement objectives, (b) relevant reported cybersecurity internal incidents and the global evolving risks, and (c) results of work performed by our third-party information security partner. We engage subject matter experts in conducting independent assessments of our cybersecurity program maturity, penetration tests, and other tests and assessments.


text: Third-Party Vendor Management Many of our information technology systems and networks are cloud-based or managed by third parties, whose future performance and reliability we cannot control. The risk of a cyberattack or security breach on a third party carries the same risks to us as those associated with our internal systems. We seek to reduce these risks by performing significant vendor due diligence procedures prior to engaging with any third-party vendor who will have access to sensitive data. Additionally, we require annual audits of certain third parties' information technology processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business strategy. See "Risks Related to Our Information Technology, Cybersecurity and Data Protection" in Part 1, Item 1A. Risk Factors of this report for a discussion of these risks. With respect to our cybersecurity process, we are not aware of any material breach to date.


text: Management Oversight Key members of senior management, including our Chief Information Officer ("CIO"), are accountable for our cybersecurity and data privacy programs and is supported by the Board of the Directors (the "Board"). Under the guidance of the Board, our IT department, under the direction of our CIO, manages day-to-day operations of the security and data privacy functions and proposes changes to our cybersecurity strategy, which is part of our overall information technology strategy. The senior management, including our CIO, and the Board meet frequently to discuss cyber and data operations, privacy programs and risks. Our CIO has extensive information technology and program management experience and has served many years in our corporate information security organization.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Eventbrite, Inc.

ticker: EB


text: We design and assess our program using several industry-leading frameworks including the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), Payment Card Industry Data Security Standard ("PCI-DSS''), and SOC2. With regards to the NIST CSF, this does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT infrastructure; • security controls intended to protect against, detect, and respond to cybersecurity threats, and a security team principally responsible for managing our (1) security controls, (2) cybersecurity risk assessment processes, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives occasional briefings from management on our cyber risk management program. Our board of directors receives presentations on cybersecurity topics from our Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the board of directors' continuing education on topics that impact public companies.


text: Our management team, including our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 40 years of combined cybersecurity experience across architecture, engineering, operations and compliance.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We design and assess our program using several industry-leading frameworks including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), Payment Card Industry Data Security Standard (PCI-DSS'), and SOC2. With regards to the NIST CSF, this does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: We have not identified risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, or our operations, business strategy, results of operations, or financial condition, including as a result of any prior cybersecurity incidents.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives occasional briefings from management on our cyber risk management program. Our board of directors receives presentations on cybersecurity topics from our Chief Information Security Officer (CISO), internal security staff or external experts as part of the board of directors' continuing education on topics that impact public companies.


text: Our management team, including our CISO, is responsible for assessing and managing any potential material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 40 years of combined cybersecurity experience across architecture, engineering, operations and compliance.


text: Our management and Board recognize the critical importance of addressing cybersecurity threats and risks to our business and operations. Therefore, we have established a comprehensive framework to assess, respond to, and manage material risks arising from cybersecurity threats.

companyName: Chatham Lodging Trust

ticker: CLDT


text: Assessment, Identification and Management of Material Risks from Cybersecurity We rely on the cybersecurity strategy and policies implemented by IHM, the manager of all the Company's properties, with whom we share corporate office space. IHM's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. IHM's enterprise-wide cybersecurity program is aligned to the National Institute of Standards and Technology Cybersecurity Framework. IHM's cybersecurity risk management processes include technical security controls, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. IHM has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors and other third parties who entrust us with their sensitive information.


text: IHM's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help IHM prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us. IHM's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us, is integrated into IHM's information technology program. In addition, both IHM and the Company periodically engage with third-party consultants and key vendors to assist them in assessing, enhancing, implementing and monitoring its cybersecurity risk management programs and responding to incidents.


text: IHM undertakes periodic internal security reviews of our information systems and related controls, including systems affecting personal data and the cybersecurity risks of IHM's and our critical third-party vendors and other partners. IHM also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.


text: In addition, much of the sensitive information relating to hotel guests are controlled by the respective franchisor companies, affiliates of Marriott International, Inc., Hilton Worldwide Holdings, Inc., and Hyatt Hotels Corporation, each of which is a public company with enhanced cybersecurity protection policies in place which each publicly discloses.


text: In addition, to aid its own security, the Company has adopted a number of cybersecurity policies including an Incident Response Plan, an Acceptable Use Policy for employees and a Service Provide Cybersecurity Management Policy (the "Cybersecurity Policies"), through which the Company ensures that key vendors with access to sensitive information have contractual terms obligating their compliance with the Company processes, policies and procedures.


text: IHM, in coordination with the General Counsel, is responsible for testing the Incident Response Plan on a periodic basis. In addition, the Audit Committee and the General Counsel will review on at least an annual basis the Incident Response Plan and update the Incident Response Plan, as appropriate, to address applicable legal requirements and the Company's policies, procedures and information security and business objectives. Periodically, the Audit Committee will review (i) the Cybersecurity Policies and (ii) the Company's cybersecurity risk exposure and discusses steps management has taken to monitor or mitigate such risk exposure.


text: Material Impact of Cybersecurity Risks In the last three fiscal years, we have not experienced a material information security breach incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors— General Risk Factors— Cybersecurity failures and data security incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential, personal or other sensitive information and/or damage to our business relationships or reputation, any of which could negatively impact our business, financial condition and operating results."


text: Governance of Cybersecurity Risks The Audit Committee of the Board has the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. IHM and the Company's Chief Executive Officer, Chief Financial Officer, Chief Operating Officer and General Counsel (the "Executive Leadership Team") are responsible for assessing and managing cybersecurity risks. Certain members of IHM periodically report to the Company's management on cybersecurity issues and management presents information to our Audit Committee as well as our full Board, as appropriate, on cybersecurity matters.


text: Upon verifying that a cybersecurity incident has occurred or is occurring, the Executive Leadership Team or their designees, in cooperation with IHM, will promptly conduct a preliminary assessment of the severity level of the cybersecurity incident. Following this assessment, IHM will report the cybersecurity incident to the Chief Executive Officer, who in consultation with the General Counsel, will inform the chair of the Audit Committee, who will then report such cybersecurity incident to the Board as the chair deems appropriate. All Level 1 (High Severity) cybersecurity incidents will be reported to the Board.


text: In addition, much of the sensitive information relating to hotel guests is controlled by the respective franchisor companies, affiliates of Marriott International, Inc., Hilton Worldwide Holdings, Inc., and Hyatt Hotels Corporation, each of which is a public company with cybersecurity protection policies in place which each publicly discloses.


text: In addition, to aid its own security, the Company has adopted a number of cybersecurity policies including an Incident Response Plan, an Acceptable Use Policy for employees and a Service Provider Cybersecurity Management Policy (collectively, the "Cybersecurity Policies"), through which the Company ensures that key vendors with access to sensitive information have contractual terms obligating their compliance with the Company's processes, policies and procedures.


text: IHM, in coordination with our General Counsel, is responsible for testing the Incident Response Plan on a periodic basis. In addition, our Audit Committee and General Counsel will review on at least an annual basis the Incident Response Plan and update the Incident Response Plan, as appropriate, to address applicable legal requirements and the Company's policies, procedures and information security and business objectives. Periodically, the Audit Committee will review (i) the Cybersecurity Policies and (ii) the Company's cybersecurity risk exposure and discusses steps management has taken to monitor or mitigate such risk exposure.


text: Governance of Cybersecurity Risks The Audit Committee of the Board has the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. IHM and the Company's Chief Executive Officer, Chief Financial Officer, Chief Operating Officer and General Counsel (collectively, the "Executive Leadership Team") are responsible for assessing and managing cybersecurity risks. Certain members of IHM periodically report to the Company's management on cybersecurity issues and management presents information to our Audit Committee as well as our full Board, as appropriate, on cybersecurity matters.


text: Cyber Risk Management and Strategy We rely on information technology in our operations, and any material failures, inadequacies, interruptions, security failures, social engineering attacks or cyber-attacks could harm our business. Management of cybersecurity risks is a component of our overall risk management strategy, which is overseen by our senior management team and our board of directors. We rely on a managed IT service provider with a longstanding relationship with the Company to help manage cybersecurity risks. Our managed IT service provider conducts testing of our controls and environment, including penetration testing, to identify and remediate cybersecurity risks.

companyName: Terreno Realty Corp

ticker: TRNO


text: We have an employee education program that is designed to raise awareness of cybersecurity threats to reduce our vulnerability as well as to encourage consideration of cybersecurity risks across functions. Before contracting with certain third parties, such as our local property managers, or purchasing third party technology or other solutions that involve exposure to sensitive company or tenant information, we conduct diligence on those third parties, which includes a security review. We maintain back-ups and disaster recovery plans to restore our information in the event of an incident.


text: Additionally, as a public company, we are subject to Sarbanes-Oxley Act ("SOX") requirements and must undergo independent audits of information technology general controls in support of internal control over financial reporting.


text: Governance Related to Cybersecurity Risks Our third-party managed IT service provider reports to our Chief Financial Officer, Chief Accounting Officer, and Chief Operating Officer on cybersecurity matters, including cybersecurity risks. These senior executives are involved in management of information security procedures and periodically brief the board of directors on information security matters.


text: Our board of directors plays an important role in our risk oversight and discharges its duties both as a full board and through its committees. Our board is involved in risk oversight through its direct decision-making authority with respect to certain significant matters and review of our overall business strategy, as well as indirectly through the further oversight of management delegated to each of the board's committees. Our board of directors relies on management to bring significant matters impacting our company to its attention but has processes for receiving information regarding such matters and providing oversight.


text: As reflected in the audit committee charter, the audit committee oversees our processes and policies relating to certain risk assessment and risk management matters, including with respect to cybersecurity risks. The audit committee administers its risk oversight function by receiving periodic reports from members of senior management on areas of material risk to our company. Our audit committee discusses our cybersecurity program at least annually, receives updates on relevant developments and considers steps that our management has taken to monitor and seek to mitigate any risk exposures.


text: PECO's cybersecurity program is generally based on the National Institute of Standards and Technology cybersecurity framework ("NIST CSF") with the intention of preventing, identifying, detecting, and mitigating cybersecurity risks. This does not imply that we meet or comply with any particular technical standards, specifications, frameworks, or requirements including the NIST CSF, only that we use the NIST CSF as a guide. Our program focuses on people, processes, and technologies and includes training of associates, periodic workforce testing, and the deployment and monitoring of technical security solutions and controls.

companyName: Phillips Edison & Company, Inc.

ticker: PECO


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our management team, including the Chief Information Officer ("CIO"), is responsible for identifying and managing our material risks from cybersecurity threats. The CIO has primary responsibility for leading our overall cybersecurity risk management program and supervises both the PECO cybersecurity team and our retained external cybersecurity consultants. The management team, led by the CIO and cybersecurity team, stay informed about cybersecurity risk including prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the PECO environment. The CIO works closely with members of PECO's cybersecurity team, who have years of experience working in cybersecurity, possessing industry certifications such as Certified Information Systems Security Professional ("CISSP") and Security+, and pursuing advanced degrees and studies in the field. Cybersecurity team members participate in recurring cybersecurity team meetings with the CIO and provide monthly executive leadership updates. The Board oversees our cybersecurity program and is periodically briefed by management, including the CIO, on cybersecurity risks and initiatives. In addition, management updates the Board as necessary regarding any significant cybersecurity incidents.


text: The cybersecurity team delivers cybersecurity training to associates, including security videos and informational tips, new hire training, out-of-band cybersecurity alerts, and simulated phishing campaigns with teachable moments and focused training, all designed to provide security specific knowledge to our associates. Positive reinforcement is utilized and encourages associates' participation, in addition to required periodic training. The PECO cybersecurity team participates in cybersecurity training, activities, and events to stay current with the evolution of security threats, security solutions, best practices, and the risks facing PECO.


text: At PECO, we are committed to protecting the confidentiality and integrity of our data and systems. Among other things, our key contracts contain requirements that counterparties maintain standards of data security and privacy compliance.


text: PECO maintains, internally publishes, and annually reviews its cybersecurity policies and procedures, which includes an incident response plan. Additionally, PECO engages with external cybersecurity experts to conduct annual penetration testing, provide monitoring of the environment, conduct tabletop exercises, and for dedicated incident response and advanced forensics capabilities. In addition to internal audits and external reviews, assessments have included the NIST CSF, cybersecurity maturity assessment, and Center for Internet Security Benchmarks to identify opportunities for enhancement.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our financial results and business operations. See "Item 1A. Risk Factors – Risks Related to Business Continuity".


text: Our management team, including the Chief Information Officer ("CIO"), is responsible for identifying and managing our material risks from cybersecurity threats. The CIO has primary responsibility for leading our overall cybersecurity risk management program and supervises both the PECO cybersecurity team and our retained external cybersecurity consultants. The management team, led by the CIO and cybersecurity team, stay informed about cybersecurity risk including prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the PECO environment. The CIO works closely with members of PECO's cybersecurity team, who have years of experience working in cybersecurity, possessing industry certifications such as Certified Information Systems Security Professional ("CISSP") and Security+, and pursuing advanced degrees and studies in the field. Cybersecurity team members participate in recurring cybersecurity team meetings with the CIO and provide periodic executive leadership updates. The Audit Committee oversees our cybersecurity program and is periodically briefed by management, including the CIO, on cybersecurity risks and initiatives. In addition, management updates the Board, through the Audit Committee, as necessary regarding any significant cybersecurity incidents.


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of GC Advisors and other third-party service providers. GC Advisors manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: GOLUB CAPITAL BDC, Inc.

ticker: GBDC


text: Cybersecurity Program Overview GC Advisors has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. GC Advisors' cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. GC Advisors actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on GC Advisors to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on GC Advisors' risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of GC Advisors when identifying and overseeing risks from cybersecurity threats associated with the Company's use of such entities.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Financial Officer ("CFO") and Chief Compliance Officer ("CCO") regarding the overall state of GC Advisors' cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management GC Advisors' internal cybersecurity team, headed by GC Advisors' Chief Information Officer ("CIO"), are responsible for the cybersecurity program applicable to the Company (including enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture, and processes), and along with the Company's CCO and a Disclosure Committee that is headed by the Company's CFO (the "Disclosure Committee"), are responsible for assessing and managing material risks from cybersecurity threats that impact the Company.


text: The CFO and CCO of the Company oversee the Company's oversight function generally and rely on GC Advisors' CIO and cybersecurity team to assist with assessing and managing material risks from cybersecurity threats. The Company's CFO has been responsible for this oversight function as CFO to the Company for over three years and has worked in the financial services industry for more than eighteen years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The Company's CCO has been responsible for this oversight function as CCO to the Company for thirteen years and has worked in the financial services industry for more than twenty years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company. The Advisors' CIO has been responsible for her function for over four years and has worked in the financial services industry for more than fifteen years, during which time the CIO has gained expertise in assessing and managing risk applicable to the Company.


text: Management of the Company, including the CCO and the Company's Disclosure Committee, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of GC Advisors.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on a regular basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: The CFO and CCO of the Company oversee the Company's oversight function generally and rely on GC Advisors' CIO and cybersecurity team to assist with assessing and managing material risks from cybersecurity threats. The Company's CFO has been responsible for this oversight function as CFO to the Company for over four years and has worked in the financial services industry for more than nineteen years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. "The Company's CCO has been responsible for this oversight function since assuming her role as CCO to the Company and has worked in the financial services industry for more than 15 years, during which time the CCO has gained expertise in assessing and managing risk, including those applicable to the Company. The Advisors' CIO has been responsible for her function for over five years and has worked in the financial services industry for more than sixteen years, during which time the CIO has gained expertise in assessing and managing risk applicable to the Company.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Expensify, Inc.

ticker: EXFY


text: We design and assess our program based on applicable laws and regulations, and informed by industry standards and industry-recognized practices. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use such laws and regulations and industry standards and practices as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Risk Factor If we or our third party providers fail to protect our IT Systems against security incidents, or otherwise to protect our Confidential Information, there may be damage to our reputation and brand, material financial penalties, and legal liability, which could substantially harm our business, financial condition, and results of operations.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function, including oversight of cybersecurity and other information technology risks. The Board oversees management's implementation of our cybersecurity risk management program.


text: The Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team, including our Chief Compliance Officer and Director of Engineering, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and external cybersecurity consultants. Our management team's experience includes a combined two decades of experience in various software development, cybersecurity, product management, and other technology-related roles. Our Chief Compliance Officer and Director of Engineering have each served in a number of significant leadership roles at our company since 2017 and 2013, respectively, including oversight of security, safety, and integrity initiatives Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We design and assess our program based on applicable laws and regulations, and informed by industry standards and industry-recognized practices including but not limited to following the latest NIST and CISA guidance and SOC 2 Principles and Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use such laws and regulations and industry standards and practices as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: The Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant.


text: Our management team, including our Chief Compliance Officer and Director of Engineering, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and external cybersecurity consultants. Our Chief Compliance Officer and Director of Engineering have over 8 and 12 years of experience, respectively, in various software development, cybersecurity, product management, and other technology-related roles. Our Chief Compliance Officer and Director of Engineering have each served in a number of significant leadership roles at our company since 2017 and 2013, respectively, including oversight of security, safety, and integrity initiatives.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Cyber criminals are becoming more sophisticated and effective every day. All companies utilizing technology are subject to threats or attempts of cybersecurity attacks. Maintaining data privacy and cybersecurity to protect our employees, customers, and business is an integral aspect of our operations. Our approach to data privacy and cybersecurity is defined by our commitment to preserving the trust our employees and customers place in us and focuses on driving continuous improvement as the threat landscape evolves.

companyName: Sensata Technologies Holding plc

ticker: ST


text: Our Audit Committee and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant financial and personnel resources to implement and maintain security programs to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and infrastructure.


text: However, there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our risk factors identified in Item 1A: Risk Factors included elsewhere in this Report provide further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.


text: Risk Management Strategy We are guided by our Cybersecurity Charter, which includes our philosophy of information security, identifies the motivation for security, describes information security principles and terms, and defines the scope of information security policies and responsibilities for various functions. We continue to improve the maturity of our cybersecurity program, aligning with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.


text: Our Director of Cybersecurity leads our information security operations, with a focus on identifying, evaluating, mitigating, and reporting on IT and cybersecurity risks that have the potential to threaten Sensata's enterprise information assets and systems. Our cybersecurity and global IT strategy is regularly aligned with business leaders across Sensata through our IT Excellence Committee meetings, conducted 10 times a year, to ensure cyber, IT, and business priorities are communicated and understood throughout the organization.


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the NIST, the International Organization for Standardization, and other applicable industry standards. Our cybersecurity program in particular focuses on the following key areas: • Incident Response: We have an Incident Response Plan ("IRP") to address cybersecurity incidents as defined by Item 106 of Regulation S-K. The IRP includes as a core component an Incident Response Team ("IRT") that utilizes guidelines identified in the IRP to identify, assess, and disclose cybersecurity incidents as applicable. The IRT consists of a core team, which includes representation from IT, Legal, and Human Resources, and an extended team, which includes representation from Enterprise Risk Management, Communications, Investor Relations, Internal Audit, Legal, Accounting, and External Reporting. The core team is involved in all incidents that are classified as significant, requiring a response from the IRT, and it involves components of the extended team as applicable. The IRT allows for broad representation of various areas of expertise for use in executing the IRP. The IRT meets monthly to evaluate the effectiveness of our cybersecurity risk management processes and procedures, including the IRP. The IRP is designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner. • Defense and Monitoring: We work to protect our computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks. We utilize data analytics to detect anomalies and search for cyber threats. Our Cybersecurity Operations Center provides comprehensive cyber threat detection and response capabilities and maintains a 24x7 monitoring system which complements the technology, process, and threat detection techniques we use to monitor, manage, and mitigate cybersecurity threats. From time to time, we engage third party consultants or other advisors to assist in assessing, identifying, and/or managing cybersecurity threats. We also periodically use our Internal Audit function to conduct additional reviews and assessments. • Insider Threats: We maintain an insider threat program designed to identify, assess, and address potential risks from within our Company. Our program evaluates potential risks consistent with industry practices, customer requirements, and applicable law, including privacy and other considerations. • Third Party Risk Assessments: We conduct information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties, and our standard terms and conditions contain contractual provisions requiring certain security protections.


text: • Training and Awareness: We have robust cybersecurity training programs with frequent touch points for all employees to empower them to act responsibly and keep cybersecurity top of mind. We use monthly activities to keep employees engaged with cybersecurity, including newsletters, articles on the Sensata intranet, and mock phishing campaigns. We regularly update our comprehensive training program, which covers a wide variety of topics, from protecting work machines and personal information to social innovation and how employees can protect their digital lives at home. • Supplier Engagement: We require our suppliers to comply with our standard information security terms and conditions, in addition to any requirements from our customers, as a condition of doing business with us, and require them to complete information security questionnaires to review and assess any potential cyber-related risks depending on the nature of the services being provided. • Risk Assessment: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, our risk register, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee, and members of management. • Technical Safeguards: We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence, and incident response experience.


text: Our Board of Directors, in coordination with each of our Board Committees, is responsible for oversight of our enterprise risk management activities. The Nominating and Governance committee receives an update on the Company's risk management process at least annually, including interaction of cybersecurity with our overall risks. The Board of Directors oversees risks from cybersecurity threats through report out from the Audit Committee, which monitors cybersecurity incidents and management's response to such incidents.


text: Our Audit Committee directly oversees our cybersecurity program. Quarterly reports are delivered to the Audit Committee by the Chief Information & Digital Officer ("CIDO") and/or the Director of Cybersecurity at least four times per year. These reports include information about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. These reports also include updates on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.


text: Our CIDO has served in various roles in IT and information security for over 20. She holds an undergraduate degree in information management and technology. Our Director of Cybersecurity has served in various roles in IT and information security for over 18 years, including in the military and the healthcare and retail industries.


text: Cybersecurity Incidents In the event of a cybersecurity incident, our response and mitigation efforts are guided by the IRP, which provides guidance on how to respond to, and recover from, a significant cyber incident requiring an organized response. We continue to conduct tabletop exercises testing the principles and procedures set forth in our IRP based on lessons learned.


text: While we have experienced cybersecurity incidents in the past, to date none have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information about cybersecurity risks relating to our business, refer to Item 1A: Risk Factors included elsewhere in this Report.


text: Our Director of Cybersecurity leads our information security operations, with a focus on identifying, evaluating, mitigating, and reporting on IT and cybersecurity risks that have the potential to threaten Sensata's enterprise information assets and systems. Our cybersecurity and global IT strategy is regularly aligned with business leaders across Sensata through our IT Excellence Committee meetings, conducted 8 times a year, to ensure cyber, IT, and business priorities are communicated and understood throughout the organization.


text: Our Board of Directors, in coordination with each of our Board Committees, is responsible for oversight of our enterprise risk management activities. The Nominating and Governance committee receives an update on the Company's risk management process quarterly, including interaction of cybersecurity with our overall risks. The Board of Directors oversees risks from cybersecurity threats through report out from the Audit Committee, which monitors cybersecurity incidents and management's response to such incidents.


text: Our CIDO has served in various roles in IT and information security for more than 20 years. She holds an undergraduate degree in information management and technology. Our Director of Cybersecurity has served in various roles in IT and information security for more than 18 years, including in the military and the healthcare and retail industries.


text: Risk Management and Strategy We regularly face cybersecurity threats from malicious third parties that could obtain unauthorized access to our internal systems, networks, and data, including the equipment at our network and core co-location facilities. It is virtually impossible for us to entirely mitigate the risk of these and other security threats we face, and the security, performance, and reliability of our network and products has been in the past, and may be in the future, disrupted by third parties, including nation-states, competitors, hackers, disgruntled employees, former employees, or contractors. While we have implemented security measures internally and have integrated security measures into our systems, network, and products, these measures have not always functioned as expected and have not always detected or prevented all unauthorized activity, prevented all security breaches or incidents, mitigated all security breaches or incidents, or protected against all attacks or incidents. We have experienced breaches of, and unauthorized access to, our internal systems in the past and we believe such breaches and unauthorized access and other incidents may happen again in the future. As of the date of the filing of this Annual Report on Form 10-K, we do not believe these risks from cybersecurity threats, including the results of prior cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, but there can be no guarantee that we will not experience such a security breach or incident in the future. Refer to Part 1, Item 1A "Risk Factors" of this Annual Report on Form 10-K for additional information regarding cybersecurity risks related to our systems, products, and network.

companyName: Cloudflare, Inc.

ticker: NET


text: Particularly in light of the extensive cybersecurity risks facing our company and the fact that we provide cybersecurity products to our customers, we recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to protect our internal systems, our global network, and our customers' data. We have established a multi-layered approach to manage our cybersecurity risks with preventative and detective capabilities enabled in our network and internal systems that are designed to protect against cyber threats. This approach to cybersecurity includes, among other things, annual and periodic enterprise-wide risk assessments; ongoing collaboration with our product and engineering teams for the purpose of securing our products, systems, data, and global network; a vulnerability management program focused on proactively identifying, triaging and mitigating security vulnerabilities within our systems, network and data through ongoing testing, penetration tests and other simulations; regularly required security training for all employees; and a comprehensive incident response process to identify, contain, and remediate cybersecurity incidents. We also engage with external cybersecurity assessors and consultants in evaluating and testing our risk management systems. These processes are integrated into our overall risk management systems and processes to promote a company-wide culture of cybersecurity risk management.


text: We are aware of the risks associated with engaging third-party service providers, so we have implemented processes to oversee and manage these risks. We conduct security assessments of third-party providers who may have access to sensitive information before engagement and maintain ongoing monitoring of their compliance with our cybersecurity standards. The monitoring includes periodic reviews conducted by our security team. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Our Board of Directors, including through its audit committee, oversees our enterprise risk management processes, including our cybersecurity risk exposure and the steps management has taken to monitor, control, and address such exposure. The audit committee regularly reviews and discusses with our senior management, our internal audit team, and our independent auditor, our policies and processes designed to identify, monitor, and address enterprise risks, including risks from cybersecurity threats and incidents. This oversight and review of our risks from cybersecurity threats includes, among other things, our SVP, Chief Security Officer (CSO) providing regular quarterly briefings to our Board of Directors regarding cybersecurity threats, processes for preventing and/or addressing current threats, ongoing cybersecurity initiatives and strategy and regulatory compliance; our internal audit team reporting on a quarterly basis to the audit committee regarding cybersecurity and other enterprise risk management efforts and related audits and management action plans to mitigate risks by internal audits; and periodic other updates to our Board of Directors by our CEO and CSO in the event of specific critical cybersecurity threats.


text: Our CSO, who reports regularly and directly to our CEO, has primary responsibility for assessing, monitoring and managing our cybersecurity risks, including the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CSO, who joined us in 2023, has over 20 years of experience assessing and managing cybersecurity programs and cybersecurity risk at a number of different companies. Our internal security leadership team that reports to our CSO regularly communicates and meets to discuss cybersecurity threats and risk management, the effectiveness of our internal security programs, and cybersecurity emerging trends, risks, and incidents that may require increased focus. In addition, our internal audit team regularly reviews cybersecurity risks with our security team as part of our ongoing enterprise risk management program and conducts internal audits on various areas of cybersecurity risk. In addition, our CEO chairs an internal compliance committee that includes our CSO and other members of our security team and meets at least quarterly to review compliance with various laws, rules, and regulations applicable to our company, including with respect to cybersecurity matters.


text: Risk Management and Strategy We recognize the increasing significance that cybersecurity has to our operations and the success of our business, as well as the need to continually assess cybersecurity risk and evolve our response in the face of a rapidly and ever-changing environment. We process and maintain sensitive data on our Clients and members, including in the form of PHI and PII. In addition, we maintain intellectual property for our solutions and personal information of our employees. Because of the data we manage, we are subject to various cybersecurity threats that, if they materialized, could adversely affect our business, employees, Clients, and members through impacts to the confidentiality, integrity, and/or availability of our systems. We maintain a cybersecurity program and controls as part of our enterprise risk management program in an effort to reduce the risk of exposure of our information and systems.

companyName: Teladoc Health, Inc.

ticker: TDOC


text: To assess, identify, and manage the risks of cybersecurity threats to our information system, we maintain a cybersecurity program, including policies and controls, which are regularly reviewed through internal and external assessments. We leverage several industry frameworks for adopting and assessing controls, such as HIPAA, the National Institute of Standards and Technology Cybersecurity Framework, and HITRUST. We have an active HITRUST certification and Service Organization Control ("SOC") 2 Type II security compliance that are issued by external entities.


text: We have controls in place intended to assess our cybersecurity posture and prevent successful access to our critical systems, including, but not limited to: vulnerability scanning on systems and applications; endpoint detection capabilities to identify malware and other indicators of threat activity; multifactor authentication; and blocking of malicious e-mail. In addition, we also provide annual cybersecurity awareness training for our employees. Further, we engage with an external security firm to perform regular penetration testing. We subject our critical third-party service providers to risk assessment prior to engagement, and periodically thereafter, to identify material risks. Additionally, we have a process to engage with these third parties to understand potential impacts of, and remediation efforts associated with, critical vulnerabilities.


text: To stay abreast of the evolving threat landscape, we actively engage with key vendors, industry information sharing, and intelligence and law enforcement communities. These engagements serve as inputs into understanding techniques and tactics being used by threat actors and in expanding the countermeasures we use to protect Teladoc Health.


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have a documented security incident response plan that provides a consistent approach to identifying and classifying the incident as well as a defined escalation process to management to assess the materiality.


text: Despite the efforts outlined above, we cannot ensure that we will not be subject to any cybersecurity incidents or threats. See "Risk Factors Risks Related to Information Technology" for additional information. To date, management has not determined that any cybersecurity incidents the Company has experienced would have resulted in, or are reasonably likely to result in, a material impact to its financial condition, results of operations, or business strategy.


text: Cybersecurity risk oversight continues to remain a top priority for our Board. The audit committee of our Board maintains primary responsibility related to overseeing our cybersecurity risk as part of its program of regular risk management oversight. This includes, but is not limited to, the overall maturity and strategy of our cybersecurity program.


text: We have a rigorous and comprehensive cybersecurity program managed by a dedicated team of subject matter experts and is led by our Chief Information Security Officer ("CISO"), who has extensive cybersecurity experience. We have implemented telehealth industry standard processes, policies, and tools, including regularly scheduled vulnerability scanning and third-party penetration testing to reduce the risk of vulnerabilities in our system.


text: Our CISO regularly engages with other members of our executive management team to discuss cyber risk, including the Chief Technology Officer, the Chief Information Officer, Deputy Chief Legal Officer, and Chief Compliance Officer, among others, as well as the audit committee of our Board. Our executive management team has the appropriate expertise, background, and depth of experience to manage risk arising from cybersecurity threats. Executive management has also participated in cybersecurity tabletop exercises to test our cyber response playbooks.


text: Our CISO regularly engages with other members of our executive management team to discuss cyber risk, including the Chief Technology Officer, the Chief Information Officer, and Chief Compliance Officer, among others, as well as the audit committee of our Board. Our executive management team has the appropriate expertise, background, and depth of experience to manage risk arising from cybersecurity threats. Executive management has also participated in cybersecurity tabletop exercises to test our cyber response playbooks.


text: Risk Management and Strategy We have implemented and maintain a formal information security management program designed to identify, assess, and manage material risks from cybersecurity threats to our critical networks, services, and data. Our information security management program includes a dedicated security team led by our Head of Security that is responsible for implementing security controls and monitoring for suspicious activity. Our information security management program also includes a cybersecurity risk management process which aims to identify and assess material risks from cybersecurity threats, including from vulnerabilities within Asana systems and new and emerging threats to Company operations by using automated and manual tools, subscribing to and analyzing reports and services that identify certain cybersecurity threats, conducting scans of certain environments, evaluating our and our industry's risk profile, evaluating threats reported to us, and conducting audits and threat assessments.

companyName: Asana, Inc.

ticker: ASAN


text: We consider our information security management program and the cybersecurity governance structure described below to be part of our overall enterprise risk management program.


text: Depending on the nature of the environment, system and/or data, we implement and maintain various technical and organizational measures, processes, standards and/or policies designed to manage and mitigate cybersecurity risks, including, for example, as may be appropriate: employee training, software design review, static code analysis, coordinated vulnerability disclosure and bug bounty program, penetration testing performed by an outside assessment firm, vulnerability scanning and management, endpoint and network security monitoring, access controls, vendor risk management, asset management, and software updates and patching.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including as applicable to our environments, systems, and data. These third-party service providers may include, but are not limited to, cybersecurity consultants, cybersecurity software providers, cybersecurity assessment firms, and forensic investigators.


text: To operate our business, we also use third-party vendors to perform a variety of functions, including but not limited to, developing aspects of our platform, hosting and delivering our platform and related services, supporting the sale and marketing of our products and services, and providing technical and customer support. Depending on the nature of the services provided, the sensitivity of the systems and data at issue, and the identity of the vendor, our vendor management process may involve different measures designed to help identify, assess, and manage cybersecurity risks associated with the vendor, such as conducting risk assessments and re-assessments, reviewing of the vendor's security program, and imposing contractual cybersecurity-related obligations on the vendor. For example, our security, privacy, and IT teams may review the vendor's security protocols, data retention policies and privacy policies, privacy practices, and security track record, and advise on implementation best practices.