text: While we focus on prevention and detection, we have response and recovery plans in place, as well as service agreements and partner engagements should there be a need for us to respond to an attack. We have adopted a cybersecurity incident response plan that provides direction and a defined approach for preparing for, identifying and responding to cybersecurity incidents that may pose a potential threat to our information systems, networks and data. We review the overall incident response plan at least annually or as needed to determine what updates (if any) are necessary. The plan defines the roles and responsibilities of our IT and security teams and other functional teams that comprise the cybersecurity incident response team, as well as provides controls and procedures for timely and accurate reporting of material cybersecurity incidents. Significant cybersecurity incidents are reviewed by a cross-functional team to determine whether further escalation is appropriate. Any incident that potentially is, or may become, material is reported to senior management for materiality and disclosure determinations. We also maintain cyber liability insurance coverage.


text: Through our enterprise risk management ("ERM") program, we identify, assess and manage a broad range of risks across the organization. Through the ERM process, cybersecurity has been identified as an important risk facing our business. Accordingly, our cybersecurity risk management program is integrated into our overall ERM program and information about cybersecurity risks and our cybersecurity risk management program is reviewed as part of our ERM program.

companyName: WESCO INTERNATIONAL INC

ticker: WCC

secItem: Item 1C


text: As of the date of this report, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially impacted us, including our business strategy, results of operations, or financial condition. However, we cannot provide assurance that we will not experience such an event moving forward and if realized, that we, or our business strategy, results of operations, or financial condition, would not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: To more effectively prevent, detect and respond to information security threats, we have a dedicated Chief Information Security Officer ("CISO") whose team is responsible for leading enterprise-wide information security strategy, policy, standards, architecture and processes. Our CISO has over 30 years of technology experience, including over twelve years of experience dedicated to cybersecurity. He has been in this role with Wesco since 2020 and has a total of approximately nine years of experience serving in the role of Chief Information Security Officer. The CISO reports to our Executive Vice President, Chief Information and Digital Officer ("CIDO"), who reports directly to our Chief Executive Officer. The CISO and CIDO regularly review cybersecurity matters with our Chief Executive Officer and other members of our senior management, including cybersecurity risks and threats and the status of our cybersecurity incident response plan and related processes relating to the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: As part of its oversight responsibility of cybersecurity risk and the overall enterprise risk management process, the Audit Committee of our Board of Directors meets periodically with our CISO, CIDO, and other senior leaders to receive updates on cybersecurity risks and threats (and should they arise, any material incidents), the status of initiatives to strengthen our information security systems, third-party risk assessment outcomes, cybersecurity risk metrics, management's assessments of our security program, and compliance with disclosure requirements. The Audit Committee and senior management report any findings and recommendations, as appropriate to the full Board of Directors for consideration. Wesco's cybersecurity program is regularly evaluated by internal and external experts with the results of those reviews reported to senior leadership and the Board of Directors. We also actively engage with strategic partners, industry groups, and intelligence and law enforcement to better understand macro trends and significant risk concerns to better inform and enhance our cybersecurity policies and procedures.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and employee and other personal data ("Information Systems and Data").

companyName: STARZ ENTERTAINMENT CORP /CN/

ticker: STRZ


text: The Company's information security team, led by our Chief Information Security Officer ("CISO"), helps identify, assess and manage the Company's cybersecurity threats and risks. The information security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example with automated and manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of certain environments, evaluating threats reported to the Company, conducting cybersecurity audits, vulnerability assessments, and threat assessments, conducting response exercises, and coordinating with law enforcement.


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident detection and response processes, vulnerability management policy, disaster recovery and business continuity plans, risk assessments, encryption of certain data, data segregation for certain data, network security and access controls, physical security controls, asset management, tracking and disposal, monitoring for certain systems, vendor risks management processes, employee training, penetration testing, employee training, cybersecurity insurance, and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the CISO works with management, including the Chief Information Officer ("CIO"), to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit & Risk Committee of the Board of Directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, threat intelligence service providers, penetration testing providers, dark web monitoring services, forensic investigators, and professional services firms, including legal counsel.


text: We use third-party service providers to perform a variety of functions throughout our business, application providers, hosting providers, supply chain resources and data back-up service providers. We have a vendor management program designed to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. Components of the vendor risk management program include, for example, conducting risk assessments for certain vendors, reviewing certain vendors' written security programs, reviewing security assessments and responses to security questionnaires, auditing of certain vendors, vulnerability scans related to vendors, and the imposition of certain contractual information security obligations for certain vendors.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Service disruptions or failures of the Company's or the third parties' on which we rely information systems, data and networks may disrupt our businesses, damage our reputation, expose us to regulatory investigations, actions, litigation, fines and penalties or have a negative impact on our results of operations including but not limited to loss of revenue or profit, loss of customers or sales and other adverse consequences."


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit & Risk Committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CIO and CISO. Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CIO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing certain security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the CISO and CIO. Our CISO, CIO and other senior executives work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the Audit & Risk Committee for certain cybersecurity incidents.


text: The Audit & Risk Committee receives regular reports from our CIO concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit & Risk Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: The Company's information security team helps identify, assess and manage the Company's cybersecurity threats and risks. The information security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example with automated and manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of certain environments, evaluating threats reported to the Company, conducting cybersecurity audits, vulnerability assessments, and threat assessments, conducting response exercises, and coordinating with law enforcement.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the information security team lead by our Executive Vice President, Technology works with management and the legal department, to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit & Risk Committee of the Board of Directors, which evaluates our overall enterprise risk.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Protection of electronically stored data is costly and if Starz's data is compromised in spite of this protection, it may incur additional costs, lost opportunities and damage to its reputation."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Executive Vice President, Technology and our General Counsel. Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our Executive Vice President, Technology and our General Counsel and other senior executives work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. Our cybersecurity incident response team has over 32 years combined information technology and cybersecurity experience, and includes individuals with Certified Information Systems Security Professional (CISSP), Cyber Threat Intelligence Certification, Global Information Assurance Certifications, and other key information technology and cybersecurity certifications. In addition, the Company's incident response processes include reporting to the Audit & Risk Committee for certain cybersecurity incidents.


text: Our cybersecurity risk assessment and management processes provide for regular updates to the Audit & Risk Committee. The Audit & Risk Committee receives reports from our Executive Vice President, Technology and our General Counsel concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit & Risk Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Although we have not been the subject of any cybersecurity threats that have materially affected, or are reasonably likely to materially affect us to date, we have been and continue to be subject to cybersecurity risks in the normal course of our business, as discussed in Item 1A. Risk Factors, including in the risk factor entitled "Protection of electronically stored data is costly and if Starz's data is compromised in spite of this protection, it may incur additional costs, lost opportunities and damage to its reputation."


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical information technology ("IT") systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan and is one aspect of the overall set of policies, procedures and techniques that we employ at the Company to manage risk. Many of the mechanisms for identifying, managing and reporting on cybersecurity risk are integrated into the Company's broader policies and procedures relating to risk management; however, due to the unique nature of cybersecurity risk, key aspects of our cybersecurity risk management program are intended to function on a stand-alone basis, including to ensure rapid escalation and response to cybersecurity incidents.

companyName: REDWOOD TRUST INC

ticker: RWT


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, operations, and our Company's overall IT environment; • A team of IT professionals principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) together with our legal/compliance team, our response to cybersecurity incidents; • Use of third-party service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including, without limitation, periodic penetration testing, network vulnerability and web application scanning, and system monitoring via System Information and Event Management ("SIEM") or other monitoring tools; • Employee and contractor trainings on information security awareness, data privacy awareness, and phishing/social engineering mitigation, as well as periodic tabletop exercises involving IT professionals and executive management to review roles and responsibilities and walk through practical aspects of responding to cybersecurity incidents; • A cybersecurity incident response plan that sets forth guidelines, policies and procedures for identification, escalation, containment, investigation, remediation, recovery, notification, legal compliance and related processes and actions in response to a cybersecurity incident; and • A risk management process for third-party service providers, suppliers, and vendors, which includes criteria for risk-based categorization of these third parties and policies and procedures relating to assessing their cybersecurity practices prior to engagement and periodic monitoring during the course of engagement.


text: We design and assess our cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") – i.e., we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business, but our use of the NIST CSF as a guide does not mean that we meet the particular technical standards, specifications, or requirements of all of the NIST CSF.


text: We have not currently identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information about cybersecurity risk, refer to Part II, Item 7 of this Annual Report on Form 10-K generally and under the heading "Maintaining cybersecurity and complying with data privacy laws and regulations are important to our business and a breach of our cybersecurity or a violation of data privacy laws could result in serious harm to our reputation and have a material adverse impact on our business and financial results."


text: Cybersecurity Governance As part of its risk oversight function, our Board, including through delegation to its Audit Committee, regularly receives risk management reporting from various officers of the Company responsible for different risk disciplines, including with respect to cybersecurity and IT risk, and oversees management's administration of our cybersecurity risk management program. For example, officers within our IT department provide periodic (generally at least once per quarter) reports from management to the Audit Committee related to cybersecurity, our cybersecurity risk management program and related risks, with copies of these reports also provided to our full Board. These reports supplement materials and presentations from outside experts that are also provided to our Board members from time to time as part of the Board's and Audit Committee's continuing education on risk oversight topics such as cybersecurity that impact companies in our industry and, more generally, publicly-traded companies. In addition, management provides event-driven updates to the Audit Committee and Board regarding any material cybersecurity incidents and, as appropriate, any incidents with lesser impact potential. Under our cybersecurity incident response plan, our Chief Legal Officer is responsible for escalating to the Audit Committee and Board information regarding any material cybersecurity incident.


text: Our management team, including officers within our IT department, is responsible for assessing and managing our material risks from cybersecurity threats. Our IT department has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and the external cybersecurity consultants we retain. The officers and employees of the Company who manage our IT function and our cybersecurity risk management program have significant experience, individually and collectively, and key members of our IT department hold industry certifications, including multiple individuals who are Certified Information System Security Professionals ("CISSP") and Certified Information Systems Auditors ("CISA"). Overall, we believe we have a team of IT professionals skilled in a range of disciplines related to the design and implementation of our cybersecurity program, as well as in assessing security controls and processes and addressing or remediating emerging threats and findings that are identified.


text: Members of our senior management team supervise our IT function and its efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents. In addition to day-to-day management, our senior management team's supervision of these efforts includes receiving and responding to briefings from IT personnel, updates on cyberthreat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and notification of significant alerts and reports produced by third parties and security tools deployed in our IT environment.


text: We have not currently identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information about cybersecurity risk, refer to Part II, Item 7 of this Annual Report on Form 10-K generally and under the heading "Maintaining cybersecurity and complying with data privacy laws and regulations are important to our business and a breach of our cybersecurity or a violation of data privacy laws could result in serious harm to our reputation and have a material adverse impact on our business and financial results " in Part I, Item 1A of this Annual Report on Form 10-K.


text: The Trust has no employees or internal information systems and is managed by the Sponsor. Thus, the Trust relies on the Sponsor and VanEck, the parent company of the Sponsor, as well as the Bitcoin Custodian and other service providers to protect the Trust's information from cybersecurity threats. VanEck has policies, standards, and procedures on information security (the "Cybersecurity Documents"). The Cybersecurity Documents govern the procurement, use, storage, protection and permissions of data systems, applications and devices.

companyName: VanEck Bitcoin ETF

ticker: HODL


text: The Cybersecurity Documents outline the correct usage of elements and tasks on the networks/infrastructure to ensure safe operation, high availability, performance, and data accuracy.


text: VanEck has adopted the National Institute of Standards and Technology's ("NIST") cybersecurity framework as its security outline. The program is reviewed annually. Using the NIST framework as a guide, VanEck's cybersecurity program is organized around the following program domains: Identify critical assets, data, systems and capabilities, cybersecurity strategy and governing elements, threats and cybersecurity risks Protect


text: assets (data, systems, networks, personnel, etc.) from external or internal malicious actors and failed practices anomalies and security events through environments monitoring, analysis, remediation, and reporting. Engage outside vendors to periodically test the network infrastructure and software applications against known vulnerabilities and to ensure the use of a best practice security program incidents regardless of source or causality through planning, improvements and communications (external and internal)


text: after-action evaluation to identify what went well, what did not go well and improve VanEck systems on the back of an issue VanEck employs third-party firms to assess its cybersecurity posture, conduct penetration testing, and forensic analysis.


text: VanEck maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact VanEck's business in the event of a cybersecurity incident affecting those third-party systems. Third-party risks are included within VanEck's NIST framework, and risk identification and mitigation are supported by VanEck's cybersecurity program. VanEck also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.


text: Roles and Responsibilities Roles and responsibilities for cybersecurity have been established first by VanEck's cybersecurity policy and secondly by its connection to the governance structure of the firm and VanEck's risk management committee (the "Risk Management Committee"), which is comprised of senior-level employees. Cybersecurity is closely aligned with not only risk management, but also with business continuity planning and response.


text: In addition, the importance of cybersecurity protection and its practice at the manager and employee level is frequently communicated to the staff globally. Specifically, VanEck's Chief Information Security Officer, reporting to the co-chair of the Risk Management Committee, is responsible for conducting the firm's cybersecurity risk assessment, as well as providing regular staff educations with a special emphasis on proper desktop and email security and conduct. Special training is also given to recently on-boarded staff. VanEck's Chief Administrative Officer and Chief Technology Officer, together with VanEck's Chief Information Security Officer, are responsible for the day-to-day operations of the firm cybersecurity infrastructure including normal operations as well as any remedial work required in response to an incident. The communication responsibility in the event of an incident is shared by VanEck's CEO and the General Counsel.


text: Since our commencement of operations, we have not experienced a material information security breach incident and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors— Other Risks—Due to the increased use of technologies, intentional and unintentional cyber-attacks pose operational and information security risks."


text: Our ability to effectively manage our business, coordinate the production, distribution and sale of our products and ensure the timely and accurate recording and disclosure of financial information depends significantly on the reliability and capacity of our information technology systems. While we have taken what we believe are appropriate precautions to protect our systems, and to date, we have not experienced any material adverse events related to a security breach or cyber-attack, the failure of these systems to operate effectively, the failure of our personnel to follow established procedures, problems with transitioning to upgraded or replacement systems, or a breach in security of these systems through a cyber-attack or otherwise could cause delays and/or interruptions in plant operations, product sales, reduced efficiency of our operations and delays in reporting our financial results.

companyName: REX AMERICAN RESOURCES Corp

ticker: REX


text: As part of our routine and periodic overall risk management system or processes, we have incorporated various processes related to cybersecurity. Key cybersecurity controls, such as access controls, are included within our internal control framework that we assess annually as part of Management's Annual Report on Internal Control Over Financial Reporting. Additionally, periodic discussions are held with outsourced IT professionals for both corporate and consolidated plant environments to determine if appropriate actions are being taken to address potential risks. Through the assistance of our qualified third-party IT professionals, we have implemented numerous security measures, including, but not limited to, multi-factor authentication on critical systems, password requirements, access controls, and data encryption. Our IT policies and procedures include the expectations of all employees and all third parties who may be given access to our IT systems to maintain the security of our IT systems.


text: Our commitment to the overall security of our information technology systems starts at the highest levels of our Company, the Board of Directors and management. Management and the Board of Directors provide oversight surrounding cybersecurity. Management oversees internal controls and the company-wide risk assessment process. The Audit Committee is provided with regular updates by management regarding the control framework and whether any significant deficiencies or material weaknesses exist in the IT control environment. The Audit Committee is also tasked with determining the appropriate response to any submissions through the corporate whistleblower policy. The whistleblower policy includes the opportunity for employees of the Company to notify the Audit Committee confidentially and anonymously of any concerns regarding cybersecurity, in addition to any accounting, internal accounting controls or auditing matters. The audit committee will report any significant matters to the Board of Directors.


text: As of January 31, 2024, we had not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.


text: The Company has processes in place to identify, assess, and manage material risks from cybersecurity threats. The Adviser manages the Company's day-to-day operations and has implemented Lord Abbett's information security policy that applies to the Company and its operations.

companyName: Lord Abbett Private Credit Fund


text: With respect to cybersecurity, the Company and the Adviser rely on the systems of Lord Abbett, its third-party service providers, and the Company's service providers.


text: cybersecurity risk management processes are integrated into its overall enterprise risk management processes. Lord Abbett has established an Enterprise Risk Management Function, overseen by its Chief Legal Officer. The Chief Legal Officer relies on Lord Abbett's Chief Information Security Officer (" CISO "), who is responsible for implementing the Information/Cybersecurity Program. The CISO is assisted by a team of Information Security professionals, the Information Technology department, and digital leads with the support of Lord Abbett's Information Security Council and its Standards and Practices Committee.


text: Employees receive information security training annually on policies and procedures, recent cyber-attacks, the firm's defense-in-depth controls strategy, incident response reporting, and cybersecurity at home. Lord Abbett conducts e-mail phishing campaigns using a variety of templates geared around topical or seasonal themes to simulate phishing messages and reinforce training.


text: Lord Abbett has instituted an Information/Cybersecurity Program, based on the National Institute of Standards & Technology (NIST) Cybersecurity Framework of controls that is designed to identify, assess, and manage cyber risks applicable to the Company. The Information/Cybersecurity Program involves, inter alia, risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. Lord Abbett actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Adviser and Lord Abbett to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and enterprise risk management processes, including those applicable to the Company.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of enterprise risk management, legal, information technology, and compliance personnel of the Adviser and Lord Abbett, including the CISO, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: The Board provides oversight for the Information/Cybersecurity Program and related matters, including risks associated with cybersecurity threats. The Board receives periodic updates from Lord Abbett's CISO regarding the overall state of the Adviser's security program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management is responsible for assessing and managing material risks from cybersecurity threats. The Chief Legal Officer oversees the Company's enterprise risk management function generally and relies on Lord Abbett's CISO and the Information Security Council to assist with assessing and managing material risks from cybersecurity threats. Currently, the Head of Enterprise Risk Management is serving as the Acting CISO, who has over 10 years of experience in all aspects of risk management, including managing cybersecurity risks and improving information security programs for financial services companies with complex information systems. The Acting CISO is also supported by a third party "virtual CISO" provided by a premiere cybersecurity consulting firm. The Chief Legal Officer has been responsible for this oversight function as Chief Legal Officer to the Company since its inception in 2024 and has worked in the financial services industry for over 28 years, during which the Chief Legal Officer has gained expertise in assessing and managing risk applicable to the Company. The Information Security Council is chaired by the Acting CISO and includes representatives from senior management, including the Company's Chief Compliance Officer, and is responsible for administering the firm's Information/Cybersecurity Program including key cybersecurity risks.


text: Management is informed about the monitoring activities performed by the Information/Cybersecurity team for the detection, prevention, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with enterprise risk management, legal, information technology, and/or compliance personnel of the Adviser and Lord Abbett.


text: The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. An annual assessment of threats and effectiveness of security controls is conducted by an independent third party following the methodologies outlined by the (NIST) Cybersecurity Framework. Additionally, an annual SOC 1 Type II assessment is conducted and reported for the verification of IT and security controls that covers various aspects of the Information/Cybersecurity Program.


text: During the reporting period, the Company has not identified any impact from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Lastly, Lord Abbett maintains cyber insurance coverage to protect against material cybersecurity incidents and liability that arises out of the unauthorized use or access to electronic data or software within the firm's network or business. Types of incidents covered include data leakage, ransomware, computer theft, spreading a virus or malicious code, and electronic crime. The insurance policy and related coverages are reviewed and renewed on an annual basis.


text: Risk Management, Strategy and Governance The Trust has no employees or internal information systems and is managed by the Sponsor. Thus, the Trust relies on the Sponsor and VanEck, the parent company of the Sponsor, as well as the Bitcoin Custodian and Additional Bitcoin Custodian and other service providers to protect the Trust's information from cybersecurity threats. VanEck has policies, standards, and procedures on information security (the "Cybersecurity Documents"). The Cybersecurity Documents govern the procurement, use, storage, protection and permissions of data systems, applications and devices. The Cybersecurity Documents outline the correct usage of elements and tasks on the networks/infrastructure to ensure safe operation, high availability, performance, and data accuracy.


text: VanEck has adopted the National Institute of Standards and Technology's ("NIST") cybersecurity framework as its security outline. The program is reviewed annually.


text: Identify critical assets, data, systems and capabilities, cybersecurity strategy and governing elements, threats and cybersecurity risks Protect assets (data, systems, networks, personnel, etc.) from external or internal malicious actors and failed practices Detect anomalies and security events through environments monitoring, analysis, remediation, and reporting. Engage outside vendors to periodically test the network infrastructure and software applications against known vulnerabilities and to ensure the use of a best practice security program Respond to incidents regardless of source or causality Recover through planning, improvements and communications (external and internal)


text: Conduct after-action evaluation to identify what went well, what did not go well and improve VanEck systems on the back of an issue VanEck employs third-party firms to assess its cybersecurity posture, conduct penetration testing, and forensic analysis.


text: VanEck maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact VanEck's business in the event of a cybersecurity incident affecting those third-party systems. Third-party risks are included within VanEck's NIST framework, and risk identification and mitigation are supported by VanEck's cybersecurity program. VanEck also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.


text: Roles and Responsibilities Roles and responsibilities for cybersecurity have been established first by VanEck's cybersecurity policy and secondly by its connection to the governance structure of the firm and VanEck's risk management committee (the "Risk Management Committee"), which is comprised of senior-level employees.


text: Cybersecurity is closely aligned with not only risk management, but also with business continuity planning and response. In addition, the importance of cybersecurity protection and its practice at the manager and employee level is frequently communicated to the staff globally. Specifically, VanEck's Chief Information Security Officer, reporting to the co-chair of the Risk Management Committee, is responsible for conducting the firm's cybersecurity risk assessment, as well as providing regular staff educations with a special emphasis on proper desktop and email security and conduct. Special training is also given to recently on-boarded staff. VanEck's Chief Administrative Officer and Chief Technology Officer, together with VanEck's Chief Information Security Officer, are responsible for the day-to-day operations of the firm cybersecurity infrastructure including normal operations as well as any remedial work required in response to an incident. The communication responsibility in the event of an incident is shared by VanEck's CEO and the General Counsel.


text: Since our commencement of operations, we have not experienced a material information security breach incident and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors— Other Risks—Due to the increased use of technologies, intentional and unintentional cyber-attacks pose operational and information security risks."


text: Risk Management, Strategy and Governance The Trust has no employees or internal information systems and is managed by the Sponsor. Thus, the Trust relies on the Sponsor and VanEck, the parent company of the Sponsor, as well as the ETH Custodian and Additional ETH Custodian and other service providers to protect the Trust's information from cybersecurity threats. VanEck has policies, standards, and procedures on information security (the "Cybersecurity Documents"). The Cybersecurity Documents govern the procurement, use, storage, protection and permissions of data systems, applications and devices. The Cybersecurity Documents outline the correct usage of elements and tasks on the networks/infrastructure to ensure safe operation, high availability, performance, and data accuracy.

companyName: VanEck Ethereum ETF

ticker: ETHV


text: Our ability to effectively manage our business, coordinate the production, distribution and sale of our products and ensure the timely and accurate recording and disclosure of financial information depends significantly on the reliability and capacity of our information technology systems. While we have taken what we believe are appropriate precautions to protect our systems, and to date, we have not experienced any material adverse events related to a security breach or cyber-attack, the failure of these systems to operate effectively, the failure of our personnel to follow established procedures, problems with transitioning to upgraded or replacement systems, or a breach in security of these or otherwise could cause delays and/or interruptions in plant operations, product sales, reduced efficiency of our operations and delays in reporting our financial results.


text: As part of our routine and periodic overall risk management system or processes, we have incorporated various processes related to cybersecurity. Key cybersecurity controls, such as access controls, are included within our internal control framework that we assess annually as part of Management's Annual Report on Internal Control Over Financial Reporting. Additionally, periodic discussions are held with outsourced IT professionals for both corporate and consolidated plant environments to determine if appropriate actions are being taken to address potential risks. Through the assistance of our qualified third-party IT professionals, we have implemented numerous security measures, including, but not limited to, multi-factor authentication on critical systems, password requirements, access controls, and data encryption.


text: Our IT policies and procedures include the expectations of all employees and all third parties who may be given access to our IT systems to maintain the security of our IT systems.


text: Our commitment to the overall security of our information technology systems starts at the highest levels of our Company, the Board of Directors and management. Management and the Board of Directors provide oversight surrounding cybersecurity. Management oversees internal controls and the company-wide risk assessment process. The Audit Committee is provided with regular updates by management regarding the control framework and whether any significant deficiencies or material weaknesses exist in the IT control environment. The Audit Committee is also tasked with determining the appropriate response to any submissions through the corporate whistleblower policy. The whistleblower policy includes the opportunity for employees of the Company to notify the Audit Committee confidentially and anonymously of any concerns regarding cybersecurity, in addition to any accounting, internal accounting controls or auditing matters. The audit committee will report any significant matters to the Board of Directors.


text: As of January 31, 2025, we had not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.


text: Our cybersecurity program helps us secure our systems, keeps our business running around the clock and protects our clients, consultants, employees and shareholders from vulnerabilities and threats. With oversight from our Board, the Audit Committee and key leaders across Kforce, we have put proactive measures and systems in place to protect our information assets from unauthorized use or access. The Firm's cybersecurity framework is based on the National Institute of Standards and Technology ("NIST").

companyName: KFORCE INC

ticker: KFRC


text: Management Oversight Our Chief Information Security Officer ("CISO") leads our Information Security and Data Privacy Council, which meets quarterly, or more frequently if necessary, to assess, identify and manage cybersecurity threats, support advocacy programs and advise our Chief Information Officer ("CIO") and CISO on solutions. The council is made up of key members of senior management across the Firm, including enterprise security, human resources, legal, internal audit, finance, procurement, communications and field management.


text: Our Enterprise Security team monitors and manages system infrastructure to protect the Firm against threats. Our Cyber Risk Management program considers risks from many sources including, but not limited to, alerts, threat intelligence sources, risk assessments, and vulnerability management. Our Cyber Risk Management process includes risk assessment processes to identify risks, a risk evaluation process that includes risk acceptance or denial at all levels of the organization, and third-party vendor management where each vendor's security posture is assessed to understand how it strengthens Kforce's cyber supply chain. We have taken a defense in depth approach to the implementation of our cybersecurity controls. These controls are set to block and/or provide alerts on suspicious activities. Our around the clock security operation center responds as appropriate to risks identified, and performs the risk assessment and risk evaluation. Our risk register and risk remediation processes help us ensure we are tracking and addressing priority risks, as appropriate. Any potential risks or threats identified by the Enterprise Security team are communicated to the CISO and Information Security and Data Privacy Council.


text: Our Vice President of Internal Audit, in collaboration with our General Counsel, facilitates our enterprise risk management ("ERM") process. Cybersecurity related risks are included in our overall risk evaluation for our ERM process to determine top risks for the Firm on an annual basis. Our internal audit team, which reports directly to the Audit Committee, uses the ERM program to develop a risk-based audit plan, which is approved by the Audit Committee annually.


text: Our CIO is accountable for the Firm's cybersecurity and data privacy programs and is supported by the CISO. Our CIO and CISO have extensive information technology and program management experience, and have served many years in our corporate information security organization. Under the guidance of the CIO, the CISO manages day-to-day operations of the security and data privacy functions and proposes changes to the Firm's cybersecurity strategy, which is part of our overall information technology strategy. The CIO and CISO meet frequently to discuss cyber and data operations, privacy programs and risks. Each of these teams remain in close coordination to ensure risk mitigation strategies are designed and operating effectively.


text: The Board is actively engaged in the oversight of cybersecurity and data privacy. The Audit Committee assists the Board in meeting its responsibility to oversee cybersecurity and data privacy strategies and practices. On a quarterly basis, the Audit Committee receives updates on (a) our progress meeting objectives established in our cybersecurity maturity roadmap, (b) relevant reported cybersecurity events in the overall market and evolving risks, (c) results of work performed by our information security organization (ex. penetration tests, cybersecurity program maturity assessments) and (d) detailed reports of cybersecurity trends within the Firm. We engage subject matter experts in conducting independent assessments of our cybersecurity program maturity, penetration tests, and other tests and assessments.


text: Senior management, including our CIO and CISO, brief the Board on an annual basis on our cybersecurity and information security posture and cybersecurity incidents deemed to have a moderate or higher business impact, even if it is considered immaterial to us. Annually, the Board and management participate in a comprehensive strategy discussion on cybersecurity.


text: To further enhance the Board and Audit Committee's role in overseeing cybersecurity risks, the Board formed a special working group that is comprised of two members of the Audit Committee to have more frequent and detailed dialogue with executive management (including our COO, CFO, CIO, CISO and VP of Internal Audit) on all areas pertaining to cybersecurity. This working group provides updates on a quarterly basis, or more frequently if necessary, to the Audit Committee. As a result of the steps taken by the Firm with respect to our cybersecurity program, we have not experienced a material breach to date.


text: Management also provides the Audit Committee with an annual overview of Kforce's various lines of insurance that we maintain, including our cybersecurity insurance policy. The Audit Committee provides the Board with quarterly reports on the Firm's risks and ERM program findings, including cybersecurity risk and data privacy practices.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business strategy. See "Risk Factors Risks Related to Cybersecurity and Technology – Cybersecurity risks and cyber incidents could adversely affect our business and disrupt operations." in Part 1, Item 1A. Risk Factors of this report for a discussion of these risks. As a result, at least in part, of the steps taken by the Firm with respect to our cybersecurity program, we have not experienced a material breach to date.


text: Third-Party Vendor Management Many of our information technology systems and networks are cloud-based or managed by third parties, whose future performance and reliability we cannot control. The risk of a cyberattack or security breach on a third party carries the same risks to Kforce as those associated with our internal systems. We seek to reduce these risks by performing significant vendor due diligence procedures prior to engaging with any third-party vendor who will have access to sensitive data. Additionally, we require annual audits of certain third parties' information technology processes.


text: Risk Management and Strategy Our cybersecurity program helps us secure our systems, keeps our business running around the clock and protects our clients, consultants, employees and shareholders from vulnerabilities and threats. We acknowledge the importance of assessing, identifying, and managing material risks associated with cybersecurity threats including: operational disruptions; violation of data privacy laws and regulations; breach of confidentiality; and financial and reputational harm.


text: With oversight from our Board, the Audit Committee, a special working group comprised of two of our Board members, and key leaders across Kforce, we have put proactive measures and systems in place to protect our information assets from unauthorized use or access, including annual employee training. The Firm's cybersecurity framework is based on the National Institute of Standards and Technology ("NIST").


text: Our enterprise security team monitors and manages system infrastructure to protect the Firm against cyber threats. Our Cyber Risk Management program considers risks from many sources including, but not limited to, alerts, threat intelligence sources, risk assessments, and vulnerability management. Our Cyber Risk Management process includes risk assessment processes to identify risks, a risk evaluation process that includes risk acceptance or denial at all levels of the organization, and third-party vendor management where each vendor's security posture is assessed to understand how it strengthens Kforce's cyber supply chain. We have taken a comprehensive defense-in-depth approach to the implementation of our cybersecurity controls. These controls are set to block and/or provide alerts on suspicious activities. Our around-the-clock security operation center responds as appropriate to risks identified and performs the risk assessment and risk evaluation. Our risk register and risk remediation processes help us ensure we are tracking and addressing priority risks, as appropriate. Any potential risks or threats identified by the enterprise security team are communicated to the CISO, Information Security and Data Privacy Council and other senior leaders as appropriate.


text: Our Vice President of Internal Audit, in collaboration with our General Counsel, facilitates our enterprise risk management ("ERM") process. Cybersecurity-related risks are included in our overall risk evaluation for our ERM process to determine top risks for the Firm on an annual basis. Our internal audit team, which reports directly to the Audit Committee, uses the ERM program to develop a risk-based audit plan, which is approved by the Audit Committee annually.


text: Our CIO is accountable for the Firm's cybersecurity and data privacy programs and is supported by the CISO. Our CIO and CISO have over 35 and 25 years, respectively, of experience in information security and program management, and have both served over 10 years in our corporate information security organization. Under the guidance of the CIO, the CISO manages day-to-day operations of the security and data privacy functions and proposes changes to the Firm's cybersecurity strategy, which is part of our overall information technology strategy. The CIO and CISO meet frequently to discuss cyber and data operations, privacy programs and risks. Each of these teams remain in close coordination to ensure risk mitigation strategies are designed and operating effectively.


text: The Board is actively engaged in the oversight of cybersecurity and data privacy. The Audit Committee assists the Board in meeting its responsibility to oversee cybersecurity and data privacy strategies and practices. On a quarterly basis, the Audit Committee receives updates on (a) our progress meeting objectives established in our cybersecurity maturity roadmap, (b) relevant reported cybersecurity events in the overall market (and for Kforce, if any) and evolving risks, (c) results of work performed by our information security organization (ex. penetration tests, cybersecurity program maturity assessments) and (d) detailed reports of cybersecurity trends within the Firm. We engage subject matter experts in conducting independent assessments of our cybersecurity program maturity, penetration tests and other tests and assessments.


text: Senior management, including our CIO and CISO, brief the Board on an annual basis on our cybersecurity and information security posture and cybersecurity incidents deemed to have a moderate business impact (even if the incidents do not rise to the level of being material). Annually, the Board and management participate in a strategy discussion on cybersecurity.


text: To further enhance the Board and Audit Committee's role in overseeing cybersecurity risks, the Board formed a special working group that is comprised of two members of the Audit Committee to have more frequent and detailed dialogue with executive management (including our COO, CFO, CIO, CISO and VP of Internal Audit) on all areas pertaining to cybersecurity. This working group provides updates on a quarterly basis, or more frequently if necessary, to the Audit Committee.


text: As a result, at least in part, of the steps taken by the Firm with respect to our cybersecurity program, to our knowledge, we have not experienced a material breach to date. While all organizations are inherently at risk of cybersecurity threats, we do not believe that cybersecurity threats have affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial condition. However, we routinely face risks of cybersecurity incidents, wholly or partially beyond our control, and there can be no assurance that the security efforts and measures of the Firm and third-party providers will prevent incidents that could adversely affect the Firm's business. Refer to "Risk Factors Risks Related to Cybersecurity and Technology" in Item 1A. Risk Factors of this report for a discussion of risks from cybersecurity threats that could have a material adverse effect on our business, financial condition and results of operations.


text: Risk Management and Strategy We have an overarching cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats that includes documented policies and procedures and incorporates a layered cybersecurity defense. We utilize a variety of technologies that target detection of malicious attempts to infiltrate our information systems. We also maintain an endpoint threat detection and response tool which uses artificial intelligence to alert our managed security service provider. On a regular basis, we hire a third-party cybersecurity service provider that performs a penetration test on our information systems. The Company seeks to address vulnerabilities that are found. We also utilize a third-party cybersecurity training company to educate our employees about cybersecurity threats. On a regular basis, we send out test phishing emails with a follow up email explaining to end users the "red flags" in these emails. Where appropriate, we utilize dual-factor authentication on our information systems. On an annual basis we receive system and organization control reports from many of our key external IT vendors as these will reveal any sort of potential security issues these companies have had in the past year.

companyName: GRAFTECH INTERNATIONAL LTD

ticker: EAF


text: We have experienced cybersecurity threats to our information technology infrastructure and have experienced non-material cybersecurity attacks, attempts to breach our systems, fraudulent activity and other similar incidents. As of the filing of this Annual Report, we are not aware of any such incidents that have occurred that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, future security and/or privacy breaches, acts of vandalism or terror, computer viruses, misplaced or lost data, programming, and/or human error or other similar events with respect to our information technology systems or processes or the information technology systems or processes of third-parties that have been entrusted with our information expose us to a risk of loss or misuse of this information, litigation and potential liability, which could have a material adverse effect on our business, financial condition, results of operations or cash flows. Risks related to cybersecurity events are detailed in the section of this Annual Report titled "Risk Factors—Risks related to our business and industry—We may be subject to information technology systems failures, cybersecurity attacks, network disruptions and breaches of data security, which could compromise our information and expose us to liability."


text: The Board oversees risks from cybersecurity threats through the same framework it uses to oversee the management of our risk exposure in general. Cybersecurity risks, including operations disruptions, outdated enterprise software and damage reputation, have been specifically incorporated into our enterprise risk management processes. These risks are scored based on impact, likelihood and established controls. Action plans are then established for each of the risks and are incorporated into objectives. Risks are then tracked and integrated into reporting and disclosure processes. Risks are reviewed at least bi-annually by a committee made up of representatives from finance, internal audit, treasury, operations, legal and others. Management at least annually provides to the Board updated information concerning cybersecurity threats as well as management's efforts to mitigate such threats. The Board then is responsible for overseeing that management responds appropriately. The Audit Committee, which is made up solely of independent directors, is responsible for overseeing Company policies and practices with respect to cybersecurity issues.


text: Our Vice President, Information Technology leads our information security program and team, which is comprised of several members devoted to infrastructure and information systems security and management. Our Vice President, Information Technology has over 20 years of industry experience, including over 15 years at our Company, serving in roles throughout his career such as engineer, infrastructure manager, Director of Information Technology Infrastructure, and Global Director of IT.


text: Risk Management and Strategy We have an overarching cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats that includes documented policies and procedures and incorporates a layered cybersecurity defense. We utilize a variety of technologies that are designed to target detection of malicious attempts to infiltrate our information systems. We also maintain an endpoint threat detection and response tool which uses artificial intelligence to alert our managed security service provider. On a regular basis, we hire a third-party cybersecurity service provider that performs a penetration test on our information systems and the Company seeks to address vulnerabilities that are found. We also utilize a third-party cybersecurity training company to educate our employees about cybersecurity threats. On a regular basis, we send out test phishing emails with a follow up email explaining to end users the "red flags" in these emails. Where appropriate, we utilize dual-factor authentication on our information systems. On an annual basis, we receive system and organization control reports from many of our key external IT vendors as these will reveal any sort of potential security issues these companies have had in the past year.


text: We have experienced cybersecurity threats to our information technology infrastructure and have experienced non-material cybersecurity incidents, attempts to breach our systems, fraudulent activity and other similar incidents. As of the filing of this Annual Report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, future security and/or privacy breaches, cybersecurity incidents, acts of vandalism or terror, misplaced, corrupted, altered or lost data, programming, and/or human error or other similar events with respect to our information technology systems or processes or the information technology systems or, processes of third-parties that have been entrusted with our information, could have a material adverse effect on our business strategy, financial condition, results of operations or cash flows. Risks related to cybersecurity events are detailed in the section of this Annual Report titled "Risk Factors—Risks related to our business and industry—We may be subject to information technology systems failures, cybersecurity incidents, network disruptions and breaches of data security, which could compromise our information and expose us to liability."


text: The Board oversees risks from cybersecurity threats through the same framework it uses to oversee the management of our risk exposure in general. Cybersecurity risks, including operations disruptions, outdated enterprise software and damage reputation, have been specifically incorporated into our enterprise risk management processes. These risks are scored based on impact, likelihood and established controls. Action plans are then established for each of the risks and are incorporated into objectives. Risks are then tracked and integrated into reporting and disclosure processes. Risks are reviewed at least bi-annually by a committee made up of representatives from finance, internal audit, treasury, operations, legal and others. Management at least annually provides to the Board updated information concerning cybersecurity threats, as well as management's efforts to mitigate such threats. The Board then is responsible for overseeing that management responds appropriately. The Audit Committee, which is made up solely of independent directors, is responsible for overseeing Company policies and practices with respect to cybersecurity issues.


text: Our Vice President, Information Technology is responsible for managing and assessing material risks from cybersecurity threats and leads our information security program and team, which is comprised of several members devoted to infrastructure and information systems security and management. Our Vice President, Information Technology has over 20 years of industry experience, including over 15 years at our Company, serving in roles throughout his career such as engineer, infrastructure manager, Director of Information Technology Infrastructure, and Global Director of IT.


text: In the past two years and with the guidance of a qualified third-party, the Management Company has made improvements in the cybersecurity program across the Entity, and has developed processes for deterring, detecting, evaluating, and responding to potential cybersecurity incidents. In doing so, the Management Company focuses on its employees, networks, applications and data with a cybersecurity plan, informed by nationally recognized frameworks.

companyName: AEI INCOME & GROWTH FUND XXI LTD PARTNERSHIP

ticker: XXAAU


text: The Management Company's third-party advisor has performed cybersecurity risk assessments of its information technology security processes and implemented technologies to lessen risk. Using third party services, the Management Company monitors, scans, assesses, audits, and remediates identified vulnerabilities across its networks, as appropriate. Furthermore, recognizing that the Management Company's employees are an essential line of defense in cybersecurity, it requires employees to participate in training and testing programs through which it provides education on the risk of potential cybersecurity incidents, methods for identification of such incidents and appropriate responses. The Management Company's policies and processes are informed by industry standard practices regarding application security, access management, device protection, network management, and data loss prevention and recovery.


text: The Management Company's cybersecurity incident response plan includes retention of external experts for prompt assistance following discovery of any material incident. This cybersecurity incident response plan is part of its ongoing cybersecurity vulnerability management, and it endeavors to maintain appropriate controls to identify, monitor, analyze and address potential cybersecurity incidents, including potential unauthorized access to its networks and applications, along with detection of potential unusual activity within its networks or applications. Any potential cybersecurity incident is immediately reported to the President and Chief Financial Officer, and the Audit Committee or the full Board, as appropriate.


text: The Audit Committee of the Board of Directors oversees the Management Company's cybersecurity posture and the steps taken by management to monitor, identify, and mitigate cybersecurity risks. The Information Technology team briefs the Audit Committee on the effectiveness of the Entity's cyber risk management program, typically on an annual basis.


text: There have been no cybersecurity incidents which have materially affected the Management Company to date, including its business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect the Management Company, including its execution of business strategy, reputation, results of operations and/or financial condition.


text: In the past three years and with the guidance of a qualified third-party, the Management Company has made improvements in the cybersecurity program across the Entity, and has developed processes for deterring, detecting, evaluating, and responding to potential cybersecurity incidents. In doing so, the Management Company focuses on its employees, networks, applications and data with a cybersecurity plan, informed by nationally recognized frameworks.


text: We rely heavily on information systems to meet the operational and financial needs of our business. Therefore, we seek to continuously improve our approach to cybersecurity with the goal of ensuring the confidentiality, integrity and availability of our information resources and to reduce the risk of information loss by accidental or intentional modification, disclosure or destruction. We believe we devote appropriate resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner.

companyName: UPBOUND GROUP, INC.

ticker: UPBD


text: The Cybersecurity and Privacy team, which maintains our cybersecurity function, reports to our Chief Technology and Digital Officer, who reports directly to our Chief Executive Officer. The Cybersecurity and Privacy team is led by our Chief Information Security Officer ("CISO"), who is responsible for developing and implementing our cybersecurity program and reporting on cybersecurity matters. The CISO and Chief Technology and Digital Officer report to the Audit and Risk Committee on a quarterly basis. Our CISO has been a cybersecurity leader for 20 years, maintains appropriate security certifications, and has extensive experience in building and maintaining cybersecurity risk and compliance programs. The cybersecurity team includes members who also have various levels of cybersecurity experience and maintain relevant cybersecurity certifications. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security controls and technologies and ongoing scanning and testing of Company information systems by internal teams as well as third-party organizations to identify potential vulnerabilities. To maintain knowledge of the latest developments in cybersecurity, evolving threat landscape, and cyber defense techniques, our CISO regularly attends cybersecurity related conferences and events hosted by cybersecurity experts, subscribes to cybersecurity threat intelligence communications and newsletters, and meets with cybersecurity vendors.


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. We regularly assess the cybersecurity landscape to holistically evaluate the threat of cybersecurity risks and seek to mitigate such risks through a layered cybersecurity strategy based on identification, protection, detection and recovery. Our Enterprise Cybersecurity Policy includes guidance related to encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information and the use of the internet, social media, email and wireless devices. This policy is reviewed for updates annually and approved by appropriate members of management. All coworkers are required to acknowledge review of the policy and complete cybersecurity and privacy awareness training annually. We also provide coworkers with additional cybersecurity training through online offerings, company broadcasts and security awareness events. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. The cybersecurity program is being enhanced to ensure that critical vendors and other third-parties are risk assessed prior to being given access to the Company's information assets and networks. Additionally, processes are currently in place to review existing third-party access to systems that have a material impact on the financial statements of the Company.


text: The Audit and Risk Committee, a committee of the Company's Board of Directors, actively participates in discussions with management regarding cybersecurity risks and receives quarterly reports regarding the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, remedy audit findings, and review enhancements to the Company's defenses and management's progress on implementing its cybersecurity strategy. In addition, the Audit and Risk Committee reviews key cybersecurity risks, on a quarterly basis, to help ensure such risks are incorporated into the Company's Enterprise Risk Management framework. The Audit and Risk Committee also meets quarterly in executive session with the Company's Chief Information Security Officer. To assist with their oversight of the Company's cybersecurity programs and mitigation efforts as they relate to the broader cybersecurity landscape, our Audit and Risk Committee has previously and will continue to attend cybersecurity awareness training events hosted by third-party cybersecurity experts.


text: In the event of a cybersecurity incident, we have developed and implemented a communication and disclosure framework, which includes processes for escalating communication of the event to members of our internal disclosure committee for assessment of materiality and disclosure, executive management team members, internal and external legal counsel, internal and external audit teams, and other internal stakeholders. Significant cybersecurity events and strategic risk management decisions would be directed to the Audit and Risk Committee for additional comprehensive oversight of the Company's response measures and public disclosure of the event as appropriate. While we have experienced cybersecurity incidents in the past, none have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Despite our cybersecurity governance program, we cannot assure you that we will be able to effectively prevent, detect or respond to all cybersecurity incidents, which may have a material adverse impact on our reputation and our results of operations.


text: The Cybersecurity and Privacy team, which maintains our cybersecurity function, reports to our Chief Technology and Digital Officer, who reports directly to our Chief Executive Officer. The Cybersecurity and Privacy team is led by our Chief Information Security Officer ("CISO"), who is responsible for developing and implementing our cybersecurity program and reporting on cybersecurity matters. The CISO and Chief Technology and Digital Officer report to the Cybersecurity, Technology and Innovation Committee (the "Committee") at least three times per year. Our CISO has been a cybersecurity leader for 20 years, maintains appropriate security certifications, and has extensive experience in building and maintaining cybersecurity risk and compliance programs. The cybersecurity team includes members who also have various levels of cybersecurity experience and maintain relevant cybersecurity certifications. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security controls and technologies and ongoing scanning and testing of Company information systems by internal teams as well as third-party organizations to identify potential vulnerabilities. To maintain knowledge of the latest developments in cybersecurity, evolving threat landscape, and cyber defense techniques, our CISO regularly attends cybersecurity related conferences and events hosted by cybersecurity experts, subscribes to cybersecurity threat intelligence communications and newsletters, and meets with cybersecurity vendors.


text: The Committee was formed in December 2024 and is responsible for cybersecurity, technology and innovation oversight previously performed by the Audit and Risk Committee. It is a committee of the Company's Board of Directors that actively participates in discussions with management regarding cybersecurity risks and receives periodic reports regarding the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, remedy audit findings, and review enhancements to the Company's defenses and management's progress on implementing its cybersecurity strategy. In addition, the Committee reviews key cybersecurity risks at least three times per year to help ensure such risks are incorporated into the Company's Enterprise Risk Management framework. The Committee also meets at least three times per year in executive session with the Company's Chief Information Security Officer. To assist with their oversight of the Company's cybersecurity programs and mitigation efforts as they relate to the broader cybersecurity landscape, our Committee will attend cybersecurity awareness training or other educational events presented by third-party cybersecurity experts.


text: In the event of a cybersecurity incident, we have developed and implemented a communication and disclosure framework, which includes processes for escalating communication of the event to members of our internal disclosure committee for assessment of materiality and disclosure, executive management team members, internal and external legal counsel, internal and external audit teams, and other internal stakeholders. Significant cybersecurity events and strategic risk management decisions would be directed to the Committee for additional comprehensive oversight of the Company's response measures and public disclosure of the event as appropriate. While we have experienced cybersecurity incidents in the past, none have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Cyber Risk Management and Strategy Our cyber risk management and strategy has been incorporated into our compliance and risk management program across a number of verticals. For example, information security risk assessments are performed across our business processes, including, but not limited to, third-party services, vendors and systems that process sensitive data. We undergo external annual penetration assessments to evaluate susceptibility to attack, for example, through social engineering, application websites and system/network vulnerabilities. We aim to continuously evolve our information security program in response to the ever-changing landscape of best practices, industry-specific risks, company-specific risks, and potential threats. This evolution is also driven by validation tests in an effort to ensure our program remains robust and effective. In the wake of the October 2023 cybersecurity incident, we prioritized implementation of enhanced safeguards consistent with our incident response process and further fortifying our commitment to information security.

companyName: Maverick Merger Sub 2, LLC

ticker: COOP


text: We also have a process to evaluate third-party providers, which is designed to understand the potential risks and impact of threats to our supply chains as well as potential privacy risks associated with external data management. This process has multiple components and is designed to assess our providers performance across several domains, including data security, asset management, communications and operations management, access control, business continuity management, financial, and legal compliance.


text: Considering the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors, in evaluating and testing our risk management systems. These engagements allow us to leverage specialized knowledge and insights, including leading industry practices, to better inform our cybersecurity strategies and processes. Our collaboration with these third parties includes audits, threat assessments, and consultations to enhance our security measures.


text: In addition, we undergo several compliance audits annually, which include a SOX compliance audit, and a SOC1 audit. Our approach to managing compliance-related risks includes maintaining a data loss prevention program, centralized compliance management, an identity management platform, ongoing Managed Security monitoring, threat and vulnerability monitoring, and information security risk insurance.


text: Governance Related to Cybersecurity Risks The full Board of Directors conducts several reviews throughout the year in an effort to ensure that our cyber strategy and risk management is appropriate and prudent. It is the responsibility of the Board of Directors to understand and oversee our strategic plans, the associated risks, and the steps that our senior management team is taking to manage and mitigate those risks. Principle responsibility in this domain is shared by our Chief Risk and Compliance Officer, who has approximately 20 years of leadership experience in the financial services sector with an extensive background in the mortgage industry, and our Chief Information Officer who has approximately 20 years of experience leading technology and product engineering functions.


text: Our Enterprise Risk Committee reviews and discusses cybersecurity, information security and data privacy risks at regular intervals. A quarterly Enterprise Risk Committee meeting is chaired by our Chief Risk and Compliance Officer and includes information security briefings led by the Chief Information Security Officer.


text: We also hold quarterly Audit and Risk Committee meetings, during which our Board of Directors receives briefings on information security matters. Risks that are identified during these processes are reviewed by executive leadership and corrective action plans are established to address and manage the issues, as applicable and appropriate.


text: We believe in a proactive approach to enterprise risk management. A major tenet of our cybersecurity program includes training to educate and inform team members on cyber hygiene and threat management as well as regular testing to check for understanding. We have invested in technology and dedicated internal resources to facilitate training for application developers, conduct tabletop exercises, run anti-phishing campaigns, and train on privacy regulations. These training activities, along with other key risk indicators, are tracked and reported to our Enterprise Risk Committee on a quarterly basis.


text: Recent Cybersecurity Activity As previously disclosed on a Form 8-K dated November 2, 2023, as amended by the Form 8-K/As dated, November 9, 2023, and December 15, 2023, on October 31, 2023, we experienced a cybersecurity incident in which an unauthorized third party gained access to certain of our technology systems and obtained personal information relating to substantially all of our current and former customers. Following detection of this incident, we initiated response protocols that included deploying containment measures involving shutting down certain systems as a precautionary measure. We notified law enforcement, regulatory authorities, and other stakeholders. We worked with our existing cybersecurity firms and retained additional cybersecurity experts to support our actions.


text: Our engagement with law enforcement and regulators, and defense of litigation is ongoing. To assist our customers, we have offered identity protection services, including credit monitoring, to all of our current and former customers for two years.


text: The cybersecurity incident did not result in a misstatement to the interim consolidated financial statements previously filed or included in this Annual Report on Form 10-K. In addition, while we cannot presently quantify the full extent of remediation and legal expenses associated with this cyber-attack, we do not believe the incident has materially affected or is reasonably likely to materially affect, our business strategy, results of operations, or financial condition.


text: Cyber Risk Management and Strategy Our cyber risk management and strategy has been incorporated into our compliance and risk management program across a number of verticals. For example, information security risk assessments are performed across our business processes, including, but not limited to, third-party services, vendors and systems that process sensitive data. We undergo external annual penetration assessments to evaluate susceptibility to attack, for example, through social engineering, application websites and system/network vulnerabilities. We aim to continuously evolve our Information Security program in response to the ever-changing landscape of best practices, industry-specific risks, company-specific risks, and potential threats. This evolution is also driven by validation tests in an effort to ensure our program remains robust and effective. In the wake of the October 2023 cybersecurity incident, we prioritized implementation of enhanced safeguards consistent with our incident response process and further fortifying our commitment to information security.


text: In addition, we undergo several compliance audits annually, which include a SOX compliance audit, a SOC1 audit and a SOC2 audit. Our approach to managing compliance-related risks includes maintaining a data loss prevention program, centralized compliance management, an identity management platform, ongoing Managed Security monitoring, threat and vulnerability monitoring, and information security risk insurance.


text: Governance Related to Cybersecurity Risks The full Board of Directors conducts several reviews throughout the year in an effort to ensure that our cyber strategy and risk management is appropriate and prudent. It is the responsibility of the Board of Directors to understand and oversee our strategic plans, the associated risks, and the steps that our senior management team is taking to manage and mitigate those risks. Principal accountability in this domain is placed with our Chief Information Security Officer, who has approximately 25 years of experience in cybersecurity program design and implementation. Responsibility is shared by our Chief Risk and Compliance Officer, who has approximately 20 years of leadership experience in the financial services sector with an extensive background in the mortgage industry, and our Chief Innovation and Digital Officer who has approximately 20 years of experience leading technology and product engineering functions.


text: Risk Management and Strategy We have developed and implemented various processes to oversee and manage the cybersecurity risks that may impact our business and have integrated this cybersecurity risk management framework into our Company's broader risk management framework.

companyName: ACACIA RESEARCH CORP

ticker: ACTG


text: Managing Material Risks & Integrated Overall Risk Management To manage cybersecurity risk and threats, we have developed and continuously review and update our internal risk controls ("Cyber Risk Controls"), which include administrative, physical, and technical controls and which are aligned to the CIS Critical Security Controls and the National Institute of Standards and Technology Cybersecurity Framework. The Cyber Risk Controls are in many cases integrated with our other controls, policies, procedures and programs to maximize their effectiveness. Likewise, our internal cybersecurity control group meets regularly to discuss and review identified cyber threats and risks as well as to conduct cybersecurity threat scenario planning. Identified cybersecurity risks are then further analyzed by other risk management personnel as part of our enterprise risk management process.


text: We also have processes in place to stay informed of and monitor prevention, detection, mitigation, and remediation of cybersecurity risks, including but not limited to: employing appropriate incident prevention and detection software where appropriate; employing industry-standard encryption protocols where appropriate; conducting regular vulnerability scans; applying patches in a timely manner; conducting penetration tests and implementing recommended corrective actions in a timely manner; maintaining a well-defined incident response plan and supporting procedures; conducting regular phishing simulations and tabletop exercises; and requiring employees to complete cybersecurity training.


text: Engaging Third Parties on Risk Management We collaborate with vendors, service providers, assessors, auditors, consultants, and other third parties on an as-needed basis to develop secure informational and operational technology systems and protect against cybersecurity threats. For example, we engage third-party security experts to conduct risk assessments and program enhancements, including vulnerability assessments, cybersecurity tabletop exercises, and internal and external penetration tests.


text: Managing Third-Party Cybersecurity Risk We recognize the potential cybersecurity risks associated with the use of third parties that provide services to us, process information on our behalf, or have access to our informational or operational technology systems, and we have processes in place to oversee and manage these risks. For example, we evaluate third-party service providers' cybersecurity policies, procedures, and practices annually to ensure sufficiently reasonable security measures are in place. We also seek to mitigate third-party cybersecurity risk through contractual safeguards, and/or regular review of the internal control reports of such third parties, and incorporating third-party risk into our incident response plans.


text: Material Impact from Cybersecurity Incidents While we have experienced and will continue to experience varying cyber incidents in the normal conduct of our business, thus far to our knowledge, such incidents have not materially affected, and are not reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition.


text: Management Personnel Our internal cybersecurity control group has responsibility for assessing, monitoring, and managing risks related to cybersecurity threats. The control group is comprised of members of senior leadership, including in-house legal counsel, and multiple independent third-party Certified Information Systems Security Professional (CISSP) Information Technology and Cybersecurity consultants. Specifically, we have retained a Virtual Cheif Information Security Officer and other members of our cybersecurity control group, each of whom supports our cybersecurity risk management and governance practices. Such retained individuals have substantial prior work experience in various roles involving cybersecurity risk management and information technology, including security, compliance, systems and programming, and bring a wealth of expertise in their roles. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy process described above, and report to our internal cybersecurity control group and executive team on a regular basis (at least monthly).


text: Monitor Cybersecurity Incidents Our internal cybersecurity control group meets on a monthly or more frequent basis to discuss and assess risks related to cybersecurity threats and review any reported cybersecurity incidents. The reviews include a review of the incident log, assessments of risks identified by multiple independent third parties and a review of our cyber risk as well as cybersecurity threat modeling. Identified risks related to cybersecurity threats are further analyzed as part of our enterprise risk management process. Our employees are provided with regular security policy and security awareness training including identifying potential cybersecurity incidents and reporting them to our security incident response team.


text: Board of Directors Oversight The Audit Committee of our Board of Directors has oversight responsibility for the policies, processes and risks relating to cybersecurity. A senior member of our internal group attends all scheduled Audit Committee meetings and provides in-depth reports to the committee on cybersecurity risks and updates on the status of projects to strengthen the Company's cybersecurity systems and improve cyber readiness. Moreover on a quarterly basis, a senior member of our internal control group reports to the Audit Committee and assists the committee with its review of relevant cybersecurity risks and evaluation and updating of our Cyber Risk Controls. Certain members of our Audit Committee have specific experience in information security and cybersecurity, and the Company has made cybersecurity training available to members of the Audit Committee.


text: Risk Management and Strategy We have developed and implemented various processes to oversee and manage cybersecurity risks that may impact our business and have integrated this cybersecurity risk management framework into our Company's broader risk management framework.


text: Managing Material Risks & Integrated Overall Risk Management To manage cybersecurity risk and threats, we have developed and continuously review and update our internal risk controls ("Cyber Risk Controls"), which include administrative, physical, and technical controls and which are aligned to the CIS Critical Security Controls and the National Institute of Standards and Technology Cybersecurity Framework. The Cyber Risk Controls are in many cases integrated with our other controls, policies, procedures and programs to maximize their effectiveness. Likewise, our internal cybersecurity control group meets regularly to discuss, and review identified cyber threats and risks as well as to conduct cybersecurity threat scenario planning. Identified cybersecurity risks are then further analyzed by other risk management personnel as part of our enterprise risk management process.


text: Managing Third-Party Cybersecurity Risk We recognize the potential cybersecurity risks associated with the use of third parties that provide services to us, process information on our behalf, or have access to our informational or operational technology systems, and we have processes in place to oversee and manage these risks. For example, we evaluate third-party service providers' cybersecurity policies, procedures, and practices annually to ensure sufficiently reasonable security measures are in place. We also seek to mitigate third-party cybersecurity risk through contractual safeguards, and/or regular review of the internal control reports of such third parties and incorporating third-party risk into our incident response plans.


text: Management Personnel Our internal cybersecurity control group has responsibility for assessing, monitoring, and managing risks related to cybersecurity threats. The control group is comprised of members of senior leadership, including in-house legal counsel, and multiple independent third-party Certified Information Systems Security Professional (CISSP) Information Technology and Cybersecurity consultants. Specifically, we have retained a Virtual Chief Information Security Officer and other members of our cybersecurity control group, each of whom supports our cybersecurity risk management and governance practices. Such retained individuals have substantial prior work experience in various roles involving cybersecurity risk management and information technology, including security, compliance, systems and programming, and bring a wealth of expertise in their roles. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy process described above, and report to our internal cybersecurity control group and executive team on a regular basis (at least monthly).