text: Cybersecurity Incident Response Plan We have a Cybersecurity Incident Response Plan which is maintained by the Security and Compliance Team. The Incident Response Plan establishes what people and organizations need to be engaged in the event of a significant incident. The Incident Response Plan also provides templates for technical resolution, documentation and communication to internal stakeholders as well as insurers and governmental and other regulatory agencies.


text: We also manage cybersecurity risk by limiting our threat landscape. For example, as an omni-channel retailer, we accept credit and debit cards via all sales channels and protecting cardholder data is a critical component of our security practices. Accordingly, PCI compliance (discussed briefly above) is very important and we engage an external qualified assessor to audit our compliance and to provide us with a report on compliance that is also shared with various payment providers. To help reduce our exposure to unauthorized access of cardholder data, we have utilized a strategy of minimizing or eliminating the storage of, and unencrypted transmission of, cardholder information across our various systems.

companyName: Zumiez Inc

ticker: ZUMZ

secItem: Item 1C


text: Moreover, our businesses do not involve or represent national infrastructure, the likes of which are common targets of cyber attackers (e.g., energy, oil & gas, transportation, communications, banking and financial systems, etc.). We recognize that cyber threats are a permanent part of the risk landscape and that new threats are constantly evolving. For these and other reasons, cybersecurity is a top risk management priority at Zumiez.


text: Like many companies, we face a number of cybersecurity risks in the day-to-day operation of our business. Although to date these risks have not materialized into any instances or series of instances that have had a material adverse effect on our business or otherwise caused material harm to the company, we have, on occasion, experienced cybersecurity threats to our data and information systems, including phishing attacks. For more information about the cybersecurity risks we face, see the risk factor entitled "If we fail to meet the requirements to adequately maintain the privacy and security of personal data and business information, we may be subject to adverse publicity, litigation and significant expenses" in Item 1A Risk Factors.


text: As discussed above, the Security and Compliance team takes a lead role in helping to ensure that we maintain comprehensive technologies and programs to ensure our systems are effective and prepared for cybersecurity risks. This team is supported by our Zumiez North America Cybersecurity Team, which consists of the Security and Compliance Program Manager, the Director of Infrastructure IT, the Vice President of IT, the Chief Financial Officer and the Chief Legal Officer. Additional support and guidance are provided by the Zumiez North America IT Steering Committee, which consists of the Chief Financial Officer, Chief Legal Officer, the Executive Vice President of North American Consumer Teams, the Vice President of IT, the Director of Infrastructure IT and the Senior Program Manager of Digital Commerce. Together, the Zumiez North America Cybersecurity Team and the Zumiez North America IT Steering Committee provide guidance and oversight to the Security and Compliance Team in alignment with the company's overall risk management and oversight framework.


text: Members of management, including our Chief Legal Officer, regularly report on the company's cybersecurity matters to our board's Audit Committee. The Audit Committee has been assigned the responsibility for reviewing and discussing with management the company's major operational, legal and regulatory risks, including data security and privacy and the company's policies to identify and manage cybersecurity risks.


text: In order to inform the Audit Committee of the planning and execution of our cybersecurity program, several different reports are provided from management.


text: Annual Cybersecurity Plan. This plan is provided for the first quarter Audit Committee meeting and outlines the cybersecurity related strategic initiatives for the fiscal year. It outlines any new investments and projects and their alignment with the cybersecurity framework, as well as the expected timelines for the implementation of these activities.


text: Quarterly Cybersecurity Memos. At the 2nd, 3rd and 4thquarter Audit Committee meetings, an update memo is provided to the Audit Committee that details the progress against the Annual Cybersecurity Plan, any updates on PCI compliance and SOX compliance activities and any emerging threats. The memo also contains a summary of significant cybersecurity threats over the past quarter both within our ecosystem and outside our ecosystem and any impact (if any) they may have had upon the company.


text: Internal Audit Reports. Our internal audit function's reviews of our information security programs and controls are included in quarterly reports to the Audit Committee.


text: The cybersecurity program and related risks are also discussed with the full Board of Directors as part of the review and discussions around the topic of risk management and the risk oversight framework that generally take place at the 3rd quarter Board of Directors meeting.


text: Any potentially significant information security issues that arise during the year are discussed with management and captured in our disclosure controls and procedures and are discussed with our Audit Committee chair between board meetings as appropriate.


text: Risk Management and Strategy Identifying, assessing, and managing material cybersecurity risks is an important function of our enterprise risk management program. Material cybersecurity risks from cybersecurity threats are managed across Medallion Financial Corp., the Bank, Medallion Capital, and third-party vendors and monitoring such risks and threats involves coordination between us as the parent company and our two main operating subsidiaries. We continue to integrate our cybersecurity programs into our enterprise risk management program, which is led by various senior representatives of the Company and overseen by the Audit Committee of the Company's Board of Directors.

companyName: MEDALLION FINANCIAL CORP

ticker: MFIN


text: Medallion Financial Corp., the Bank and Medallion Capital are each responsible for developing cybersecurity programs appropriate for their respective entities, including as may be required by applicable law or regulation. These programs have been guided by the National Institute of Standards and Technology Cybersecurity Framework, other industry-recognized standards, and contractual requirements, as applicable, and seek to protect each entity against cybersecurity risks and provide a foundation to respond promptly to cybersecurity events. Each entity maintains technical and organizational safeguards, including, among other things, employee testing and training, incident response programs and tabletop exercises, evaluations and assessments by third parties, vulnerability scanning, vendor management, cybersecurity insurance, and business continuity mechanisms for the protection of Company assets. Our programs also assess and manage third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors and other business partners associated with our use of third-party service providers.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, and we currently do not expect that risks from cybersecurity threats are reasonably likely to materially affect us, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: The Audit Committee of our Board of Directors is responsible for overseeing the Company's enterprise risk management program, including overseeing the adequacy of protection of the Company's technology, including physical security, patent and trademark program, proprietary information, and information security. The Audit Committee receives quarterly reports from our Information Security Director and third parties on cybersecurity matters. In addition, the Audit Committee receives quarterly reports addressing cybersecurity as part of our enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates. These reports include, among other things, existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents, if any, and the status of key information security initiatives. Our Audit Committee members also engage in ad hoc conversations with management on cybersecurity-related news and events, and discuss any updates, as needed, to our cybersecurity risk management and strategy programs.


text: Medallion Financial Corp. employs a Director of Information Security, and our main operating subsidiaries have similar functions and/or roles conducted by various individuals. Such information security leadership are responsible for developing cybersecurity programs appropriate for their respective entities, including as may be required by applicable law or regulation. These individuals' expertise in information security and cybersecurity generally has been gained from a combination of education, including relevant degrees and/or certifications, and prior work experience. They are informed by their respective cybersecurity teams and third-party vendors about, and monitor, the prevention, detection, mitigation and remediation efforts relating to any cybersecurity incidents as part of the cybersecurity programs described above.


text: Information regarding cybersecurity risks may be elevated from information security leadership through a variety of different channels, including discussions between or among subsidiary and parent company management, reports to subsidiary and parent company risk committees and reports to subsidiary and parent company boards and board committees. As noted above, the Audit Committee regularly receives reports on cybersecurity matters from our Information Security Director and third parties as well as part of our enterprise risk management program.


text: Cybersecurity Risk Management and Strategy To help protect the Company from a major cybersecurity incident that could have a material impact on operations or the Company's financial results, the Company has implemented policies, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps the Company takes to reduce its vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include, but are not limited to: establishing information security policies and standards, implementing information protection processes and technologies, monitoring its information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices.

companyName: AWARE INC /MA/

ticker: AWRE


text: The Company has implemented a Cybersecurity Policy (the "Policy") that provides a framework for responding to cybersecurity incidents. The Policy includes requirements for incident disclosure and reporting, protocols for incident evaluation, including the use of third-party service providers and partners, and processes for notification and internal escalation of information to the Company's senior management, incident response team, and Board of Directors (the "Board") and appropriate Board committees. The Policy also addresses requirements for the Company's external reporting obligations. The Plan is reviewed and updated, as necessary but no less frequently than once a year, under the leadership of the Company's Chief Security Officer ("CSO").


text: Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on the Company's cybersecurity-related risks.


text: The Board of Directors, primarily through its Audit Committee, oversees the Company's cybersecurity program. Management regularly reports to the Audit Committee on the current state of the Company's cybersecurity program, including the current threat landscape, cybersecurity risks, and any significant incidents. The Audit Committee may provide updates to the Board on the substance of these reports and any recommendations for improvements that the Audit Committee deems appropriate.


text: At the management level, the Company has established written policies and procedures to ensure that significant cybersecurity incidents are immediately investigated, addressed through the coordination of various internal departments, and publicly reported, to the extent required by applicable law.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and employees ("Information Systems and Data").

companyName: IN8BIO, INC.

ticker: INAB


text: Our information security function is led by our third party security consultant ("IT consultant") with whom we have worked since formation, and it helps identify, assess and manage the Company's cybersecurity threats and risks. The information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example automated tools, subscribing to reports and services that identify certain cybersecurity threats, conducting threat assessments for internal and external threats, engaging third parties for threat assessments, and conducting assessments to identify vulnerabilities. Our assessment and management of material risks from cybersecurity threats are integrated into our risk management processes. For example, our IT consultant and certain management, including our CFO, evaluate material risks from cybersecurity threats against our overall business objectives and our CFO periodically reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: risk assessments, encryption of certain data, segregation of certain data, network security controls, physical security controls, asset management, employee training, penetration testing, and cybersecurity insurance. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example penetration testing firms, dark web monitoring services, and professional services firms, including legal counsel.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, and contract manufacturing organizations. We utilize certain vendor management processes to help manage cybersecurity risks associated with our use of certain these providers, including, for example, risk assessments and reviews of the provider's written security program documentation. Our vendor management processes may vary depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the rick factor entitled "If our information technology systems, or those of the third parties with whom we work, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to, a significant disruption of our product development programs and our ability to operate our business effectively, regulatory investigations or actions, litigation, fines and penalties, reputational harm, loss of revenue or profits, and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the CFO, the Chief Operating Officer ("COO") and the IT consultant having over 30 years of information security experience. The CFO and COO each have over 10 years of experience in roles with responsibility for overseeing information technology and security functions.


text: Our CFO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the CFO, COO and CEO, who help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the audit committee for certain cybersecurity incidents.


text: The audit committee receives periodic reports from our CFO concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Lyra Therapeutics, Inc.

ticker: LYRA


text: We design and assess our program based on the core principles of the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a lead IT person principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our business, financial condition, and results of operations may suffer in the event of information technology system failures, cyberattacks, data security incidents, or deficiencies in our cybersecurity."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding significant cybersecurity incidents.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also periodically receives briefings from management on our cyber risk management program.


text: Our management team, including the Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The CFO has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information technology personnel and our retained external cybersecurity consultants. Our management team's cybersecurity experience is limited.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: BCP Investment Corp

ticker: BCIC


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program, overseen by the Adviser's Global Head of Infrastructure & Cybersecurity ("GHIC"), which is designed to assess, identify, and manage material cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and other specialists as appropriate to evaluate cybersecurity measures and risk management processes, including those applicable to the Company.


text: The Company relies on the Adviser's risk management program and processes, which include cyber risk assessments. The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company takes steps to identify and oversee risks from cybersecurity threats associated with our use of such entities and the Chief Compliance Officer ("CCO") of the Company reviews cybersecurity-related reports provided by key service providers.


text: Board Oversight of Cybersecurity Risks The Board would be made aware of any material risks associated with cybersecurity threats. The Board currently receives periodic updates from the Company's CCO regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO, in managing such risks relating to cybersecurity threats, relies on the assistance provided by the Adviser's GHIC. The Adviser's GHIC has extensive experience in managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company since 2021 and has worked in the financial services industry for more than 15 years, during which the CCO has gained expertise in assessing and managing such risks applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of material cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with legal, information technology, and/or compliance personnel of the Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, results of operation, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any material risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operation, and financial condition.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and we have integrated these processes into our overall risk management systems and processes. We periodically assess material risks from cybersecurity threats, including any potential unauthorized occurrences on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Enliven Therapeutics, Inc.

ticker: ELVN


text: We have established a risk management framework which provides for the identification, assessment, management, and monitoring of cybersecurity risks. The implementation of this framework includes an iterative and periodically updated risk identification process and will include penetration testing. Identified risks are assessed, managed, monitored, and periodically reassessed to account for new threats, changes in operations, the effectiveness of implemented safeguards, and other factors.


text: Our risk management framework activities include the identification, assessment, and monitoring of reasonably foreseeable internal and external risks, including risks associated with key third-party vendors and service providers. The risk assessment, monitoring, and review process address the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. In this context, under our risk management framework, we periodically work to re-design, implement, update, and maintain reasonable safeguards to minimize identified risks, including risks related to third-party vendors and service providers; monitor the effectiveness of our safeguards; and reasonably address any identified gaps in existing safeguards.


text: As part of our risk management framework, we also periodically assign third-party cybersecurity training to our employees on our cybersecurity policies and safeguards.


text: We employ external cybersecurity consultants to help design and implement our cybersecurity policies and procedures, and to identify, assess, manage, and monitor cybersecurity risks. Under the supervision of senior executive management, our Head of Information Technology (IT), supported by external cybersecurity consultants, supervises and directs the implementation of our cybersecurity risk management framework.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled, "Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer actual or suspected security or data privacy incidents or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal information, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations, and potentially significant delays in our clinical trials and delivery to market." and "We are subject to stringent and changing privacy, data protection and data security laws, regulations and standards as well as policies, contracts and other obligations related to data privacy, data protection and data security. Our actual or perceived failure to comply with such obligations could lead to enforcement or litigation (that could result in fines or penalties), a disruption or cancellation of clinical trials or commercialization of products, reputational harm, or other adverse business effects."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee. The audit committee has primary board responsibility for strategic oversight of our cybersecurity program, including by quarterly reviewing and discussing with management the Company's cybersecurity and other information technology risks, controls and procedures, as well as the Company's plans to mitigate cybersecurity risks and to respond to data breaches.


text: Our Chief Legal Officer, with the assistance of and informed by our Head of IT, and our external consultants, is primarily responsible for overseeing our cybersecurity risk management framework, including assessing and managing our material risks from cybersecurity threats, as well as monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Chief Legal Officer has experience as a senior legal, compliance and operations executive in highly regulated companies, including in roles with executive-level responsibility for overseeing data privacy and security compliance. Our Head of IT has experience overseeing the IT function, including cybersecurity, for private and public biotechnology.


text: The processes by which our senior management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents include regular reports from the Chief Legal Officer and Head of IT. Our Chief Legal Officer and Head of IT also provides quarterly briefings to the audit committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses as well as the results of our risk management activities. Our audit committee provides updates to the board of directors on such reports.


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Logan Ridge Finance Corp.


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program, overseen by the Adviser's Global Head of Infrastructure & Cybersecurity ("GHIC"), which is designed to assess, identify, and manage material cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and other specialists as appropriate to evaluate cybersecurity measures and risk management processes, including those applicable to the Company.


text: The Company relies on the Adviser's risk management program and processes, which include cyber risk assessments. The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company takes steps to identify and oversee risks from cybersecurity threats associated with our use of such entities and the Chief Compliance Officer ("CCO") of the Company reviews cybersecurity-related reports provided by key service providers.


text: Board Oversight of Cybersecurity Risks The Board would be made aware of any material risks associated with cybersecurity threats. The Board currently receives periodic updates from the Company's CCO regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO, in managing such risks relating to cybersecurity threats, relies on the assistance provided by the Adviser's GHIC. The Adviser's GHIC has extensive experience in managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company since 2021 and has worked in the financial services industry for more than 15 years, during which the CCO has gained expertise in assessing and managing such risks applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of material cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with legal, information technology, and/or compliance personnel of the Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, results of operation, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any material risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operation, and financial condition.


text: We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes and practices. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve and recover from security incidents in a timely manner. We require annual information security training to be completed by our employees, and we maintain a limited cybersecurity liability insurance policy.

companyName: REGENXBIO Inc.

ticker: RGNX


text: Our Senior Vice President of Information Technology (SVP, IT) is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. Our current SVP, IT has over 25 years of experience in information technology and possesses the requisite education, skills and experience expected of an individual assigned to these duties. We also engage third-party consultants and auditors to assess the effectiveness of our cybersecurity prevention and response systems and processes. Where applicable, third-party service providers are contractually obligated to notify us of material incidents arising from cybersecurity events within their purview.


text: We identify, assess and manage material risks from cybersecurity threats by following written policies and procedures, which are in compliance with the International Organization for Standardization (ISO) 27001 Information Security Management System. The output of this process is then integrated with our enterprise risk management (ERM) program. The ERM program is managed cross-functionally, with input from various senior management representatives across our business operations, and is used to assess risks to our business based on their potential likelihood and magnitude of impact. Our information technology organization provides the inputs to our ERM process related to material cybersecurity risks and mitigation plans. The information technology team is responsible for the prevention, detection, mitigation and remediation of cybersecurity incidents. Cybersecurity incidents are documented and triaged in accordance with a defined process. Incidents deemed to be significant are escalated to the Audit Committee of our Board of Directors after appropriate assessment by the information technology organization and other internal stakeholders. In the event an incident highlights an emerging or previously unidentified cybersecurity risk, such risk is then synthesized into the ERM process.


text: The Audit Committee of our Board of Directors oversees our ERM program regarding material risks arising from cybersecurity threats impacting our business. Management provides quarterly reporting on our material enterprise risks to the Audit Committee. In addition to material risks identified through the ERM process, our information technology management provides periodic reporting, at least semi-annually, on our cybersecurity risk profile and risk mitigation strategies to the Audit Committee. This reporting is also made available to the full Board of Directors.


text: In the last three years, we have not identified any cybersecurity incidents which have materially affected, or are reasonably likely to materially affect, our business. For further information regarding cybersecurity risks, please refer to "Risk Factors – Risks Related to Our Business Operations" and other risks described in the "Risk Factors" section of this Annual Report on Form 10-K.


text: The Company relies on the cybersecurity strategy and policies implemented by the Advisor. The cybersecurity program seeks to address cybersecurity risks and support the Company's operational resilience.

companyName: 5C Lending Partners Corp.


text: Cybersecurity Program Overview The Advisor has established a cybersecurity program designed to identify, evaluate, and mitigate risks from cybersecurity threats applicable to the Company.


text: The program encompasses: • Risk Assessments: Regular evaluations to identify and address potential vulnerabilities and threats to the Company's systems and data. • Security Measures: Implementation of cybersecurity controls, technologies, and protocols to protect against unauthorized access and mitigate risk. • Monitoring: Surveillance of systems, networks, and potential threats to timely detect and respond to evolving cyber risks. • Incident Response: Monitors systems for unauthorized access or data breaches. Follows an incident response plan to contain, investigate, and resolve incidents as well as reports significant incidents to senior management and regulatory authorities as needed.


text: The Advisor through the Resource Sharing Agreement utilizes external cybersecurity vendors and consulting firms to perform internal and external penetration testing, vulnerability assessments, and cybersecurity reviews. These independent evaluations assess the effectiveness of the Advisor's, and in turn the Company's, cybersecurity framework and risk management practices and help identify areas for continued focus and improvement.


text: The Company leverages the Advisor's expertise in cybersecurity risk management and compliance, including the assessment and ongoing oversight of risks associated with our use of third-party vendors, suppliers, and service providers critical to the Company's business functions. Any material risks identified by the Advisor's chief technology officer (the "CTO"), will be reported to the Advisor's chief operating officer (the "COO") and the Company's chief compliance officer (the "CCO").


text: Board Oversight of Cybersecurity Risks The Company's Board of Directors is primarily responsible for overseeing the Company's management of cybersecurity risks. The Company's CCO, consults with the Advisor's CTO and COO to develop cybersecurity updates that the Company's CCO, along with the Advisor's CTO, delivers periodically to the Board of Directors on topics including: • Updates on the Advisor's cybersecurity program as it impacts us. • The effectiveness of the Company's cybersecurity program. • Current and emerging cybersecurity threats. • Significant cybersecurity incidents impacting the Company and its operations.


text: Management's Role in Cybersecurity Risk Management The Advisor's management team, including its CTO, collaborates to execute and oversee the Company's cybersecurity program. Responsibilities include: • Incident Management: Addressing and remediating cybersecurity incidents that may impact the Company. • Compliance Oversight: Ensuring adherence to regulatory standards and best practices for cybersecurity. • Risk Evaluation: Ongoing assessment of risks posed by third-party service providers and internal operations. • Enhancements to the Program: Ongoing improvements necessitated by the changing environment.


text: At 5C's Executive Committee meetings the CTO provides an executive summary report disclosing needed changes to our cybersecurity program, incidents, and potential threats. The Advisor's CTO has over twenty years of specialized experience in managing cybersecurity and information security programs for financial services organizations.


text: The Company's CCO has over twenty-seven years of experience in the financial services industry, including eighteen years specializing in compliance and nine years in technology. The Company's CCO is actively involved in monitoring and addressing cybersecurity risks in consultation with the Advisor's CTO and COO. The Company's CCO is informed of incidents, vulnerabilities, and control enhancements in order to ensure robust and effective cybersecurity practices.


text: Cybersecurity Incidents and Material Impacts The Company has not experienced any cybersecurity incidents that materially affected our business strategy, operational results, or financial condition. The Company remains vigilant in monitoring and mitigating potential cybersecurity risks to safeguard its long-term resilience and operational integrity, but there is no guarantee that any risks from cybersecurity threats will not materially affect us in the future. For additional discussion of the Company's risks from cybersecurity threats, see "Item 1A. Risk Factors—Risks Related to the Company's Business and Structure—Cybersecurity risks and cyber incidents may adversely affect the Company's business or the business of the Company's portfolio companies by causing a disruption to the Company's operations or the operations of the Company's portfolio companies, a compromise or corruption of the Company's confidential information or the confidential information of the Company's portfolio companies and/or damage to the Company's business relationships or the business relationships of the Company's portfolio companies, all of which could negatively impact the business, financial condition and operating results of the Company or the Company's portfolio companies."


text: Cybersecurity Risk Management and Strategy As an externally managed BDC, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Adviser, an indirect subsidiary of Apollo. Apollo determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for us and other affiliated entities managed by Apollo, and we rely on Apollo for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Apollo Debt Solutions BDC


text: Apollo's Board of Directors is involved in overseeing Apollo's risk management program, including with respect to cybersecurity, which is a critical component of Apollo's overall approach to enterprise risk management ("ERM"). Apollo's cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance," Apollo's Board of Directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer ("CISO") and the Chief Information Security Officer of Athene Holding Ltd. ("AHL's CISO"), a subsidiary of Apollo, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, and also receive support, as appropriate, from our executive officers and other representatives of the Adviser and its affiliates. • Collaborative Approach. Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with our management and our Board, as applicable, in a timely manner. • Technical Safeguards. Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.


text: Apollo engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. Apollo regularly engages third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to Apollo's risk management function, and Apollo adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Cybersecurity threat risks have not materially affected our company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Business and Structure - Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, a misappropriation of funds, and/or damage to our business relationships, all of which could negatively impact our financial results."


text: Cybersecurity Governance Apollo's Board of Directors' oversight of cybersecurity risk management is supported by the audit committee of Apollo's Board of Directors ("Apollo's audit committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. Apollo's Board of Directors, Apollo's audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from Apollo's risk management professionals, Apollo's Chief Security Officer ("CSO"), the CISO, the AHL CISO. other members of management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from Apollo's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, Apollo's Board of Directors and/or Apollo's audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full Apollo Board of Directors or Apollo's audit committee receives presentations and reports on cybersecurity risks from Apollo's CSO or CISO, as well as from AHL's CISO, at least annually.


text: Apollo's CSO holds an undergraduate degree in Management Information Systems and Business Administration, which he received magna cum laude. He has over 25 years of cyber-related experience, having served in various roles in technology and cybersecurity, including as Head of IT Risk Management, Executive Director of IT & Risk Compliance, and Global IT Risk Evaluation Lead at large financial institutions and consulting firms. He was also previously Apollo's CISO for nearly eight years. Apollo's CISO holds a master's degree in Business Information Systems and has served in various roles in information technology and information security for over 25 years across a number of large financial institutions, including as Director, Cybersecurity and Risk.


text: Apollo's CISO, in coordination with the Apollo Technology and ERM teams, works collaboratively across Apollo to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of Apollo's cybersecurity risk management program, multidisciplinary teams throughout Apollo are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to Apollo's audit committee or Apollo's Board of Directors, as appropriate.


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of our Board, our audit committee regularly interacts with, and receives reports from, our management, the Adviser, Apollo, and other service providers. The audit committee of our Board receives presentations and reports on cybersecurity risks from Apollo's CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Apollo's peers and third parties. Additionally, Apollo and other service providers periodically report to management as it relates to our cybersecurity practices.


text: Apollo's cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to our company, the Adviser, and evaluation of the adequacy of our cybersecurity program (as coordinated through the Adviser and Apollo), including risk mitigation, compliance and controls.


text: Cybersecurity Risk Management and Strategy Candel has implemented cybersecurity risk management processes that are informed by industry standards in accordance with the scale of our business. Our cybersecurity risk management processes are designed to assess, identify and mitigate risks from current and emerging cybersecurity threats.

companyName: Candel Therapeutics, Inc.

ticker: CADL


text: We use various tools and processes to accomplish these objectives, including policies and procedures, risk assessments, and testing. Further, we require our employees to participate in cybersecurity risk awareness trainings and phishing exercises.


text: Our cybersecurity risk management processes are supported by third-party service providers, including a managed services provider that assists the Company with, among other things, threat monitoring and cybersecurity incident response and escalation services. We rely on a third-party service provide r to assist us with our cybersecurity practices, including for vulnerability assessments, penetration testing, and managing IT environments. Our process for onboarding new vendors with access to critical systems or data includes vendor questionnaires, contractual obligations, and if deemed appropriate, review of vendor audit reports.


text: Our incident management processes include reporting to senior management, including the Chief Financial Officer (CFO), Chief Executive Officer, Vice President Quality Assurance, and Director GxP Systems, and, where appropriate, to the board of directors. To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats that could affect our information or systems. For more information, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: Cybersecurity Governance The board of directors has delegated oversight of the Company's cybersecurity risk management program to the Audit Committee, including responsibilities for reviewing and discussing cybersecurity risks, implementing risk management programs, controls and procedures, and performing high level reviews of the threat landscape.


text: Our Senior Director, Information Technology (Senior Director, IT) is responsible for the strategic leadership and day-to-day management of our cybersecurity risk management program. The individual occupying this role has over thirty years of experience with information technology management and over five years of cybersecurity risk management.


text: Our Senior Director, IT engages in regular meetings with our third-party managed IT service provider and the Director, IT to review and assess our cybersecurity risk management processes. The Senior Director, IT reports such findings to our CFO who annually presents updates on cybersecurity risks, mitigation strategies, and, if necessary, incident response activities to our Audit Committee. Further, our Audit Committee updates the full board of directors on matters relating to cybersecurity risk management, as necessary.


text: The Company's cybersecurity program is integrated within its overall risk management function. The Company engages third parties, including an outsourced cybersecurity team and additional vendors that conduct cybersecurity testing. All critical vendors of the Company, including its cybersecurity vendors, are subject to the requirements of its vendor management policy and processes. The Company is a regulated entity and undergoes regulatory reviews to ensure the Bank remains in compliance with all appropriate standards, including related to its management of third-party vendors.

companyName: Ponce Financial Group, Inc.

ticker: PDLB


text: Internally, the cybersecurity program is managed by the Company's Senior Vice President and Chief Information Officer. She has held senior management positions in information technology, management information systems and information security for over 30 years. She reports regularly to the risk and audit committees of the Board of Directors about the prevention, detection, mitigation, and remediation of cybersecurity incidents. Additionally, the full board annually assesses all critical risks of the Company, including cybersecurity risks, and also receives periodic updates relating to key cybersecurity issues as part of their oversight.


text: The Company's Senior Vice President and Chief Information Officer also regularly reports to the Company's executive risk management ("ERM") committee, which oversees Company-wide risk at the management level, regarding cybersecurity risks. Members of the ERM committee include our President and Chief Executive Officer.


text: While to date, we have not had a major cyber incident, nor experienced significant data loss or any material financial losses related to cybersecurity attacks, it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. See Item 1A. "Risk Factors." – "We face significant operational risks because the financial services business involves a high volume of transactions and increased reliance on technology, including risk of loss related to cyber security breaches. " for further discussion of potential risks related to cybersecurity incidents.


text: Our board recognizes the critical importance of maintaining the trust and confidence of our patients, business partners and employees. Our board is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management, or ERM. Through our ERM program, risks are identified, assessed and managed at the organization level, mission and business process level, and information system level. Our cybersecurity program, policies and procedures are fully integrated into our ERM program and are maintained in accordance with industry good standards. We also have an Information Security program that more specifically addresses cybersecurity risks and is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: SUTRO BIOPHARMA, INC.

ticker: STRO


text: Risk Management and Strategy As one of the critical elements of our overall ERM approach, our cybersecurity program is focused on the following key areas:


text: 1. Governance: Our board's oversight of cybersecurity risk management is supported by our Audit Committee of our board (the "Audit Committee"), which regularly interacts with our executive leadership, including our Chief Executive Officer, Chief Financial Officer and our General Counsel and other key officers.


text: 2. Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We also engage security vendors with credentialed security professionals to bolster our cybersecurity risk management, security event monitoring and detection, and incident and crisis response capability.


text: 3. Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including mail flow algorithms, firewalls, intrusion prevention and detection systems, malware and antivirus protection, network security protection, cloud console security and single sign-on multi-factor authentication. We also regularly conduct security and patch vulnerability scanning to help safeguard our security infrastructure.


text: 4. Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are periodically evaluated. We utilize an established internal framework designed to assess promptly the severity and materiality of cybersecurity events and incidents based on various predefined quantitative and qualitative criteria, including the impact to potential personally identifiable information and/or patient health information, and to determine the appropriate level of response. Incidents are escalated based on their severity and materiality for prompt response and mitigation. This systematic approach involves preliminary investigations and detailed assessments to determine the severity and materiality of each incident, and there are established communication channels and engagement processes with those involved in this incident response process.


text: 5. Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We have implemented communication channels with our key third-party vendors to communicate regarding potential cybersecurity risks and incidents, and generally seek to include appropriate security clauses in our contracts with our vendors, including notification requirements.


text: 6. Education and Awareness: We provide regular, mandatory security awareness training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in a periodic assessment of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents at least annually. We evaluate our cybersecurity program's capabilities and processes, and we aim to continuously enhance our program according to our internal and external risk assessments. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.


text: We have previously engaged, and may engage in the future, with third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, vulnerability assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any cybersecurity threats that have materially affected or are likely to affect us, including our business strategy, results of operations or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the "Risk Factors" disclosures in Item 1A of this Annual Report on Form 10-K.


text: Our board, in coordination with the Audit Committee, oversees our ERM process, including the management of risks arising from cybersecurity threats. Our Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including our information security strategy, ongoing cybersecurity preparedness projects and programs, recent cybersecurity-related developments, changing regulations, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Further, our Information Security Team, consisting of Company IT staff, meets biannually with our Information Security Governance Committee to review our policies, incidents, responses and preventative measures. In addition, our Information Security Team presents a summary of information security key performance indicators quarterly to our Audit Committee.


text: Our Chief Executive Officer, Chief Financial Officer, General Counsel and other key officers and our Information Security team work collaboratively across the Company to implement and monitor our Information Security Program, which is designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Our Information Security team is deployed to address cybersecurity threats and to respond to cybersecurity incidents, including those stemming from any violation of our cybersecurity policies. Further, our Information Security Team monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.


text: Our Information Security team collectively has a combined experience of over 70 years managing and supporting information technology in the biotech industry and oversees our cybersecurity program. They have experience developing and leading cybersecurity programs, including evaluating and implementing tools and technologies that enable defense and response capabilities, and developing critical cybersecurity procedures and training and awareness programs. Our cybersecurity consultant has served in various roles in information technology and information security for approximately 25 years. We also consult with two different service providers who specialize in corporate cybersecurity.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, data associated with our clinical trials or manufacturing campaigns, and other confidential information that is proprietary, strategic or competitive in nature. We perform periodic assessments of our information security processes, and the results of these assessments are reported to the audit committee of the board of directors (Audit Committee) as part of a cybersecurity update report conducted at least annually.

companyName: aTYR PHARMA INC

ticker: ATYR


text: We also engage vendors from time to time to assist with enterprise managed detection and response, security information and event management, and enterprise vulnerability management. These vendors also assist us from time to time in identifying, assessing and managing material risks from cybersecurity threats. The vendors include threat intelligence service providers, cybersecurity software providers and managed cybersecurity service providers.


text: We have adopted an Incident Response Management Procedure (Procedure) designed to help us respond to cybersecurity incidents and mitigate our risks and impacts. An incident response team is responsible for carrying out the Procedure and is led by our Information & Technology (IT) department, and includes members from our legal and compliance, finance, and human resource departments (Security Management Team). We also manage and maintain business continuity and disaster recovery capabilities to help ensure the availability of business-critical technology resources during adverse conditions.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management process. In addition, we have implemented a cybersecurity third-party risk management process designed to assess the cybersecurity practices and monitor certain critical third parties, and to assist the business in making risk-informed technology services decisions. Our practice is to perform due diligence on certain third parties who maintain Sensitive Information, including CROs that manage and administer our clinical trials, and our CDMOs that manufacture our drug product to be used in clinical trials. Additionally, we monitor these third parties through frequent program management meetings as well as joint steering committee meetings in certain cases.


text: For a description of the risks from cybersecurity threats that may materially affect us and how those threats may do so, see our risk factors under Part 1. Item 1A. "Risk Factors - If our information technology systems or data, or those maintained by the third-parties with whom we work, are or were compromised, this could result in a Material Adverse Impact."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for reviewing, assessing and considering the overall risk management policies and procedures, including our cybersecurity risk management processes, and oversight of mitigation of risks from cybersecurity threats.


text: Our Security Management Team is responsible for day-to-day management of cybersecurity risk, including hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our cybersecurity risk assessment and management processes are implemented and maintained by the Security Management Team. Our Security Management Team includes our CFO who has more than 15 years of experience in managing IT departments, and certain members of our IT department who have over 25 years of experience in cybersecurity, information security, data protection, privacy, regulatory compliance and risk management.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CFO, CEO and other members of our executive leadership team (ELT). Our CFO, CEO and ELT work with our Security Management Team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management policies include reporting to the Audit Committee for certain cybersecurity incidents.


text: The Audit Committee receives annual reports concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Governance Related to Cybersecurity Risks Our Board of Directors ("Board") holds overall oversight responsibility for the Company's strategy and risk management, including in relation to cybersecurity risks. Our Board exercises its oversight function through the Audit Committee, which oversees the management of risk exposure across various areas, including data security risks, in accordance with its charter. The Audit Committee receives quarterly reports from our Chief Information Officer ("CIO") on the status of the Company's cybersecurity program, including measures implemented to monitor and address cybersecurity risks and threats, as appropriate.

companyName: REPLIGEN CORP

ticker: RGEN


text: Our enterprise risk management committee ("ERMC") is composed of senior management, including the CIO and other senior executives. The ERMC monitors and oversees risk areas that potentially could pose a high impact to the business, and cybersecurity currently is one of the ERMC's priority focus areas. The ERMC reports on our top identified risks and steps to address those risks to the full Board on a semi-annual basis. Our CIO has over twenty years of information technology experience.


text: Our IT Infrastructure & Security Operations teams manage the day-to-day administration of our cybersecurity program. We also work with a managed security service provider to monitor for vulnerabilities and threats. The service provider has the authority to take actions to remediate critical and high vulnerabilities, and these are reported to the IT Infrastructure & Security Operations team and up to the CIO and other members of senior management, where appropriate. We engage employees in our cybersecurity efforts through a quarterly process for employees to complete mandatory security and awareness training as well as monthly simulated phishing campaigns. We also conduct specific training and tabletop exercises for key personnel involved in cybersecurity risk management.


text: Cybersecurity Risk Management and Strategy We maintain a cybersecurity program, which is informed by industry standards, that includes processes for identification, assessment, and management of cybersecurity risks and which is integrated into our larger enterprise-wide risk management program. We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify areas of enhancement, and develop strategies for the mitigation of cyber risks. We also conduct regular security penetration testing and have established a vulnerability management process supported by security testing, for the treatment of identified security risks based on severity. Third-parties that access, process, collect, share, create, store, transmit or destroy our information or have access to our systems may have additional contractual controls.


text: Our IT Infrastructure & Security Operations team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks through various means, including by leveraging managed security service providers and other third-party security software and technology services. In addition, we institute processes and technologies for the monitoring of security alerts from internal parties and external resources, including from information security research sources. We also have implemented processes and technologies for network monitoring and data loss prevention procedures.


text: We have been subject to cybersecurity incidents in the past, including the publicly disclosed July 2024 security incident. Although we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents have materially affected us, our business strategy, results of operations or financial condition, there is no guarantee that past security incidents and any future incidents will not have a material impact on our business strategy, results of operations, or financial condition in the future. See Item 1A, "Risk Factors," to this report for more information.


text: Cybersecurity Risk Management and Strategy Our enterprise risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Given the increasing reliance on technology and potential cyber threats, information security (and by entailment cybersecurity) is a critical component of this program. Our Chief Information Security Officer ("CISO") is primarily responsible for this cybersecurity component and is a key member of the enterprise risk management organization, which is overseen by our Chief Risk Officer. As discussed below, our CISO reports periodically throughout the year on cybersecurity related risks, threats, and our responses, to the Technology Committee and our board of directors.

companyName: GUARANTY BANCSHARES INC /TX/


text: Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. To mitigate these risks and protect sensitive customer data, financial transactions, and our information systems, Guaranty has implemented comprehensive cybersecurity practices. Key components of the cybersecurity program include the following: • A dedicated cybersecurity team working closely with our Information Technology team to cover all critical cyber defense functions such as engineering, data protection, vulnerability management, identity and access management, insider risk management, security operations, threat emulation and threat intelligence. • A risk assessment process that identifies and prioritizes material cybersecurity risks, identifies and evaluates the effectiveness of controls to mitigate the risks, and reports results to executive management and the Board of Directors. • A Managed Detection and Response ("MDR") service, which provides an additional layer of around-the-clock security monitoring (including intrusion detection and alerting) for information systems. • A training program that educates employees about cybersecurity risks, how to protect themselves from cyberattacks, and encourages general awareness about cybersecurity threats and how to stay safe online. • An incident response plan, which is tested periodically and outlines the steps that will be taken to respond to a cybersecurity incident. The Bank engages reputable third-parties to conduct various independent assessments on a regular basis, including but not limited to security audits, vulnerability assessments, and various other testing.


text: The Bank leverages in-house resources and third-party service providers to implement and maintain processes and controls to manage identified risks.


text: Our Vendor Management program is designed to ensure that our vendors meet our cybersecurity requirements. This includes conducting periodic risk assessments of vendors, requiring vendors to maintain appropriate cybersecurity controls and monitoring vendor compliance with our cybersecurity requirements.


text: The Bank's risk management program and strategy are designed to ensure confidential information and information systems are appropriately protected from a variety of threats, both natural and man-made. Periodic risk assessments are performed to validate control requirements and ensure that the Bank's information is protected at a level commensurate with its sensitivity, value, and criticality. Preventative and detective security controls are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Bank and customer information. Minimally, these controls include identity and access management, data encryption, data loss prevention, incident response, security monitoring and alerting, third party risk management, and vulnerability management.


text: The Bank's risk management program and strategy are regularly reviewed and updated to ensure that they are aligned with the Bank's business objectives.


text: Risks from Cyber Threats Like many businesses, the Bank faces numerous cybersecurity risks in connection with providing services to our customers. Guaranty does not currently believe that any current or previous risks from cybersecurity threats have materially affected, or are reasonably likely to materially affect the Bank, including its business strategy, results of operations, or financial condition. Unfortunately, the sophistication of cyber threats continues to increase, and the Bank's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. No cybersecurity program will be able to anticipate all cyber threats and breach attempts, and there may exist limitations to the ability to effectively implement preventive measures against such breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Bank's business strategy, results of operations or financial condition, please refer to "Item 1A. Risk Factors."


text: Board of Directors Oversight The Board of Directors is charged with overseeing the establishment and execution of the Bank's risk management framework and monitoring adherence to related policies required by applicable regulations and statutes. Consistent with this responsibility, the Board may delegate some responsibilities to the Audit Committee. The CISO holds the primary day-to-day responsibility for the strategic, operational, and risk management components of cybersecurity. The Audit Committee, and the board through summary reports, receives updates on cybersecurity risks and incidents and the cybersecurity program through direct communication with the CISO. Additionally, awareness and training on cybersecurity topics is provided to the Board at least annually.


text: Management's Role The Information Security department is responsible for implementing and maintaining the Banks's Information Security program, which addresses cybersecurity risk management and cyber threats. The Information Security department consists of cybersecurity and information risk professionals who assess, identify, and manage cybersecurity risks. Information Security is led by the CISO, who reports directly to the Chief Financial Officer and with dotted-line reporting to the Audit Committee. Additionally, the CISO is a key member of the Technology Committee, which is charged with Bank's managerial oversight and steering organization for all information technology areas (including cybersecurity).


text: The Bank's CISO has over 20 years of experience in cybersecurity across various verticals. Our CISO brings a wealth of expertise to his role. His background includes extensive experience and certifications in all facets of information technology and information security. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. The Bank's CISO remains informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. To assist the Information Security team in such knowledge acquisition, we subscribe to services that provide Bank personnel with alerts on security incidents and threats. Our CISO oversees the implementation and processes for regular monitoring of our information systems. This includes the deployment of advanced security measures and regular internal/external assessments to identify potential vulnerabilities. In a cybersecurity incident, the information security incident response plan is enacted. This plan includes immediate actions to mitigate the impact of and remediate the incident.


text: Cybersecurity Risk Management and Strategy Astrana Health operates in an increasingly interconnected and digitized world, where the protection of sensitive information and the resilience of our information technology systems are paramount to our mission of delivering exceptional healthcare services. Cybersecurity is a critical component of our enterprise risk management program, reflecting our commitment to safeguarding the privacy and security of the patients, employees, and others who entrust us with their data.

companyName: Astrana Health, Inc.

ticker: ASTH


text: As a healthcare organization, we manage large quantities of protected health information ("PHI"), personally identifiable information ("PII"), and other sensitive data. Recognizing the heightened risks posed by cyber threats, we have implemented a comprehensive cybersecurity framework that is designed to proactively identify, assess, and mitigate the risks associated with these threats. This includes protection against ransomware, phishing attacks, data breaches, and the evolving tactics of sophisticated cyber adversaries, as well as other types of cyber threats. Our cybersecurity program is built upon industry-recognized standards and, and we continuously adapt our program to defend against the changing threat landscape.


text: Cybersecurity Governance Astrana Health's governance framework reflects our commitment to managing cybersecurity risks with accountability and transparency. This framework is rooted in collaboration between executive leadership, employee operational teams, and the Board of Directors, resulting in comprehensive oversight at every level of the organization.


text: The Board of Directors oversees cybersecurity as part of its enterprise risk management responsibilities. The Audit Committee reviews cybersecurity risks, including IT internal controls, the use of artificial intelligence, business continuity plans, disaster recovery programs, and data protection initiatives. The Audit Committee also receives regular reports from management, including the CISO (as defined below), on key cybersecurity metrics, threat landscapes, risk mitigation strategies, and significant cybersecurity or data privacy incidents (if any).


text: Executive Leadership Our cybersecurity program is led by the Chief Information Security Officer ("CISO"), a Certified Information Systems Security Professional (CISSP) with over 25 years of experience in technology, cybersecurity strategy, risk management, and regulatory compliance, including extensive industry experience. The CISO works closely with the Company's executive leadership to implement and oversee the Company's cybersecurity initiatives. The CISO is also responsible for broader IT governance and risk management, resulting in a cohesive approach to protecting our technology infrastructure and sensitive data.


text: AI Policy and Governance Astrana Health recognizes the transformative potential of artificial intelligence ("AI") in healthcare and the corresponding responsibility to implement it ethically and securely. Our AI policy and governance framework emphasizes transparency, fairness, and accountability in the use of AI technologies across our operations. This includes rigorous data privacy safeguards, continuous monitoring to mitigate algorithmic bias, and adherence to industry best practices and regulatory standards. An internal committee comprising experts in technology, legal, compliance, and healthcare operations works to ensure that AI deployments meet ethical and cybersecurity standards. Periodic audits and risk assessments are conducted to evaluate the performance, reliability, and security of AI systems in critical workflows.


text: Cross-Functional Collaboration Astrana Health utilizes a cross-functional governance structure that engages enterprise risk management, compliance, IT, legal, privacy, and data governance teams. Our risk management / cyber working group, which includes certain of our senior leaders, including operations, finance, internal audit, IT, cyber, legal, and communications, meets at least four times per year to discuss significant risks to the Company identified by our enterprise-wide risk management process, including cybersecurity risks identified by our cybersecurity risk management program. The group also discusses the steps management has taken to identify, monitor, assess, and control or avoid such exposures and reviews performance measures against the Company's risk appetite and tolerance and provides recommendations of corrective action where appropriate. This collaborative approach enables a holistic evaluation of cybersecurity risks and aims to ensure that identified threats are promptly addressed.


text: Cybersecurity Program Components Astrana Health's cybersecurity program employs a multi-layered approach, incorporating a wide range of policies, technologies, and processes to detect, prevent, and respond to cyber threats.


text: Proactive Monitoring and Threat Detection We leverage advanced security technologies and tools to continuously monitor our IT systems and networks. Our 24/7 Security Operations Center is equipped to detect anomalies and respond to emerging threats in real-time, aiming to minimize the risk of undetected cyberattacks.


text: Employee Training and Awareness Astrana Health fosters a culture of cybersecurity awareness through mandatory training programs, phishing simulations, and engagement campaigns. These efforts seek to enable employees to identify and report potential threats, thereby reducing organizational vulnerability to common attack vectors.


text: Data Encryption and Access Controls Robust encryption protocols safeguard sensitive data, both in transit and at rest. Multi-factor authentication and role-based access controls further restrict unauthorized access, ensuring that only authorized personnel can access critical systems and information.


text: Incident Response and Recovery Our comprehensive incident response plan outlines detailed procedures for addressing and recovering from cybersecurity incidents. This plan, which is integrated with our business continuity and disaster recovery strategies, aims to ensure operational resilience and timely remediation of affected systems.


text: Third-Party Risk Management Vendors and service providers are rigorously vetted through a structured third-party risk management program. This process includes security assessments, contractual requirements for compliance with cybersecurity standards, and ongoing monitoring to ensure alignment with Astrana Health's security policies.


text: Independent Audits and Assessments External firms conduct regular penetration testing, Service Organization Controls (SOC) 2 audits, and other assessments to validate the effectiveness of our cybersecurity controls and identify areas for improvement.


text: Industry Standards and Benchmarks Our cybersecurity program is aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Additionally, periodic tabletop exercises simulate real-world scenarios to test our readiness and improve our incident response capabilities.


text: Cybersecurity Incidents Although we have been subject to breaches of our IT systems, including breaches of the IT systems of third-party service providers, the impact of such attacks has not been material to our business strategy, operations or results of operations, financial position, or cash flows through the date of this report. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect the Company. For additional information on the risks we face from cybersecurity threats, please refer to Part I, Item 1A, "Risk Factors" of this Form 10-K.


text: In the ordinary course of business, CSB relies on electronic communications and information systems to conduct its operations and to store sensitive data. CSB employs an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. CSB employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. CSB Places a high priority and focus on securing the confidential information it receives and stores about its customers and associates and providing highly available systems.

companyName: CSB Bancorp, Inc.

ticker: CSBB


text: Our Information Security ("IS") Program consists of policies, procedures and guidelines to ensure the security, availability, and confidentiality of systems and customer information. The IS Program is led by our Information Security Officer ("ISO") under the direction of the Chief Information Officer ("CIO") and is subject to oversight by our IT Steering Committee. The IT Steering Committee is a cross-functional management committee with overall responsibilities for identifying and approving the IT Strategic plan, identifying and approving strategic technology based initiatives that improve/enhance the security posture and mitigation efforts of cybersecurity threats, monitoring of the technology infrastructure and systems, monitoring critical vendors, monitoring cybersecurity threats and issues, and conducting, reviewing, and monitoring IT based risk assessments. These efforts include the framework used to identify and prevent cyberattacks or breaches. The IT Steering Committee makes recommendations for approval of certain risk assessments, risk frameworks, and appropriate application of mitigation strategies and frameworks to the Board of Directors.