text: We have processes to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers. Such processes include evaluating service providers to ensure coverage of key cybersecurity risks have appropriate mitigations. We also monitor for threats impacting key service providers and assesses identified threats for potential impacts to services, data, and systems.


text: Risk Management & Strategy As previously discussed under the section titled "Enterprise Risk Management", through our ERM program we have a risk management framework that recognizes the risks inherent in our operating segments as well as the risks associated with the operations of our holding company. This process includes assessing, identifying and managing material risks related to cybersecurity.

companyName: PROASSURANCE CORP

ticker: PRA

secItem: Item 1C


text: ProAssurance's Information Systems Security department, with assistance from third-party security vendors, regularly monitors the Company's systems for indicators of attack or compromise to mitigate the risk of cyberattacks. The Company continually enhances its cyber and information security in order to identify and neutralize emerging threats and improve its ability to prevent, detect and respond to attempts to gain unauthorized access to the Company's data and systems. ProAssurance regularly adds additional security measures to its computer systems and network infrastructure to mitigate the possibility of cybersecurity breaches, including firewalls and penetration testing. The Company encrypts sensitive information and data and utilizes stringent access controls. Team members are required to complete quarterly security training which encompasses a wide range of cybersecurity topics. This training informs all team members of the processes and procedures to follow in the case they encounter a possible cybersecurity threat. This training is reinforced through periodic simulated phishing tests.


text: The Company also evaluates the integrity and security of the technology infrastructure of certain third parties that access, process or store data that the Company considers to be sensitive, significant, or legally protected. ProAssurance reviews and assesses its third-party providers' cybersecurity controls, as appropriate, and makes changes to the Company's business processes to manage these risks.


text: While our Board is responsible for ensuring that our entire ERM process is in place and functioning, our Audit Committee has the primary oversight responsibility for risks relating to cybersecurity. Our Vice President of Information Security regularly attends and presents to our Audit Committee on material cybersecurity risks and mitigating procedures. Our Vice President of Information Security oversees ProAssurance's information security and data privacy programs and is responsible for establishing and implementing our security strategy alongside our General Counsel, to whom the Vice President of Information Security reports directly. Our Vice President of Information Security has been with ProAssurance since 1998 and has over 25 years of IT and cybersecurity experience.


text: The Company has a formal process in place for identifying, handling and disclosing of material cybersecurity incidents. The Company's Security Oversight Committee ("SOC") includes our Chief Financial Officer, General Counsel, Vice President of Information Security, and representatives from our Internal Audit, Legal, Compliance and Information Systems departments. The purpose of the SOC is to develop and review the Information Security policies, standards and guidelines for the Company that manage Cyber Risk. Furthermore, the Company's Code of Ethics and Conduct explicitly prohibits officers, directors, team members, or other insiders who are subject to the Code from transacting in the Company's stock during a time when such individuals have knowledge of any material undisclosed cybersecurity incident or breach.


text: Effective July 26, 2023, the SEC finalized rules requiring registrants to disclose material cybersecurity incidents. Per the ruling, any cybersecurity incident deemed to be material shall be disclosed within four business days of materiality determination. The determination of materiality related to cybersecurity incidents is subjective, however, the Company has implemented materiality consideration in its formal process.


text: All possible cybersecurity incidents are reported to our General Counsel for consideration of materiality. Our General Counsel escalates consideration of materiality to our Chief Executive Officer, Chief Financial Officer and other corporate officers as appropriate. The Company does not utilize any third-party service providers for consideration of materiality for cybersecurity incidents. Upon determination that the Company has experienced a material cybersecurity incident, the Company will disclose the incident within four business days as required by regulation. Our Board is also notified of any material cybersecurity incidents immediately upon determination of materiality.


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company. Please refer to Item 1A, Risk Factors under the heading "Technology, Data Security and Privacy" for additional information on our cybersecurity threats.


text: ProAssurance's Information Systems Security department, with assistance from third-party security vendors, continually monitors the Company's systems for indicators of attack or compromise to mitigate the risk of cyberattacks. The Company regularly enhances its cyber and information security in order to identify and neutralize emerging threats and improve its ability to prevent, detect and respond to attempts to gain unauthorized access to the Company's data and systems. ProAssurance regularly adds additional security measures to its computer systems and network infrastructure to mitigate the possibility of cybersecurity breaches, including firewalls and penetration testing. The Company encrypts sensitive information and data and utilizes stringent access controls. Team members are required to complete quarterly security training which encompasses a wide range of cybersecurity topics. This training informs all team members of the processes and procedures to follow in the case they encounter a possible cybersecurity threat. This training is reinforced through periodic simulated phishing tests. Further, all team members are required to read and acknowledge the Company's guidelines for the use of publicly available generative artificial intelligence tools. The Company's guidelines explain how to protect the Company from risks that can arise if legally protected, proprietary or confidential information is shared with these tools.


text: The Company also evaluates the integrity and security of the technology infrastructure of certain third parties that access, process or store data that the Company considers to be sensitive, significant or legally protected. ProAssurance reviews and assesses its third-party providers' cybersecurity controls, as appropriate, and makes changes to the Company's business processes to manage these risks.


text: While our Board is responsible for ensuring that our entire ERM process is in place and functioning, our Audit Committee has the primary oversight responsibility for risks relating to cybersecurity. Our Vice President of Information Security regularly attends and presents to our Audit Committee on material cybersecurity risks and mitigating procedures. Our Vice President of Information Security oversees ProAssurance's information security and data privacy programs and is responsible for establishing and implementing our security strategy alongside our General Counsel, to whom the Vice President of Information Security reports directly. Our Vice President of Information Security has been with ProAssurance since 1998 and has over 26 years of IT and cybersecurity experience.


text: The Company has a formal process in place for identifying, handling and disclosing of material cybersecurity incidents. The Company's Security Oversight Committee includes our Chief Financial Officer, General Counsel, Vice President of Information Security and representatives from our Internal Audit, Legal, Compliance and Information Systems departments. The purpose of the SOC is to develop and review the Information Security policies, standards and guidelines for the Company that manage Cyber Risk. Furthermore, the Company's Code of Ethics and Conduct explicitly prohibits officers, directors, team members or other insiders who are subject to the Code from transacting in the Company's stock during a time when such individuals have knowledge of any material undisclosed cybersecurity incident or breach.


text: All possible cybersecurity incidents are reported to our General Counsel for consideration of materiality. Our General Counsel escalates consideration of materiality to our Chief Executive Officer, Chief Financial Officer and other corporate officers as appropriate. The Company does not utilize any third-party service providers for consideration of materiality for cybersecurity incidents. Upon determination that the Company has experienced a material cybersecurity incident, the Company will disclose the incident within four business days as required by regulation. Our Board will also be notified of any material cybersecurity incidents immediately upon determination of materiality.


text: Cybersecurity Risk Management and Strategy We are regularly subject to cyberattacks and other cybersecurity incidents. In response, we evaluate and implement cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risks. Our management team collaborates with our Information Security function, led by our Chief Information Officer ("CIO") to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations.

companyName: Arhaus, Inc.

ticker: ARHS


text: We assess our information security program against the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This program includes policies, processes and procedures to help assess and identify our cybersecurity risks and inform how security measures and controls are developed, implemented and maintained. Such risk assessments along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls and impact of controls on operations.


text: We consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment. In addition, we continue to expand training and awareness practices to mitigate risk from human error, including mandatory computer-based training and internal communications for employees. Our employees undergo cybersecurity awareness training and regular phishing awareness campaigns that are based upon and designed to emulate real-world contemporary threats. We provide prompt feedback (and, if necessary, additional training or remedial action) based on the results of such exercises. Our processes also considers cybersecurity risks associated with our use of third-party service providers including suppliers, software and cloud-based service providers during contracting and vendor selection processes. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), the Company has a written incident response plan outlining how to address cybersecurity events that occur. The plan sets forth the steps for coordination among various corporate functions and governance groups and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure, comply with applicable legal obligations and mitigate the impact to our brand and reputation and on impacted parties. We also maintain insurance coverage that, subject to its terms and conditions, is intended to help us cover certain costs associated with cybersecurity incidents and information system failures.


text: The Company (or the third parties it relies on) may not be able to fully, continuously, or effectively design and implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine whether and how to implement certain security controls and it is possible that we may not implement the necessary controls if we are unable to recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate cybersecurity risks. Cybersecurity events, when detected by security tools or third parties, may not always be identified immediately or addressed in the manner intended by our cybersecurity incident response plan.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition Based on the information available as of the date of this Form 10-K, we have no reason to believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see Item 1A, "Risk Factors" in this Form 10-K.


text: Cybersecurity Governance Our cybersecurity risk management and strategy processes are led by our CIO. Our cybersecurity team has experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing multiple industry and regulatory compliance environments.


text: Cybersecurity is an important part of our overall risk management processes and the Audit Committee of our Board of Directors has primary oversight responsibility for the Company's cybersecurity and other technology risks. The Committee reviews and discusses with management our cybersecurity, privacy and data security programs, the status of projects to strengthen internal systems and any significant cybersecurity incidents, including recent incidents at other companies and the emerging threat landscape. The Committee also reviews with management the implementation and effectiveness of the Company's controls to monitor and mitigate cybersecurity risks. In addition, our Board receives periodic updates regarding our cybersecurity program.


text: Cybersecurity is an important part of our overall risk management processes and the Technology Committee of our Board of Directors has primary oversight responsibility for the Company's cybersecurity and other technology risks. The Committee reviews and discusses with management our cybersecurity, privacy and data security programs, the status of projects to strengthen internal systems and any significant cybersecurity incidents, including recent incidents at other companies and the emerging threat landscape. The Committee also reviews with management the implementation and effectiveness of the Company's controls to monitor and mitigate cybersecurity risks. In addition, our Board receives periodic updates regarding our cybersecurity program.


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data include confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also use systems and processes designed to reduce the impact of a security incident at a third-party vendor or customer. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions.

companyName: Gold Flora Corp.

ticker: GRAM


text: As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected.


text: We have a unified and centrally-coordinated team that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at Gold Flora Corporation in close coordination with senior leadership and other teams across the Company. Reporting to our Director of IT are a number of experienced system administrators and managed service providers "MSP" responsible for various parts of our business, each of whom is supported by a team of trained cybersecurity professionals. In addition to our in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "We may be subject to risks related to security breaches," which should be read in conjunction with the information above.


text: We maintain a cybersecurity program that is reasonably designed to protect our information against cybersecurity threats that may result in material adverse effects on the confidentiality, integrity and availability of our information systems as well as our business operations, financial condition and overall performance.

companyName: ESAB Corp

ticker: ESAB


text: Internal Cybersecurity Team and Governance The Board maintains responsibility for oversight of risks that may affect the Company. Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee reviews the Company's policies with respect to risk assessment and enterprise risk management, including with respect to cybersecurity risks. Certain members of our Audit Committee have experience with respect to cybersecurity risk management and have attended external trainings.


text: The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives reports and presentations from members of the Company's management team responsible for overseeing the Company's cybersecurity risk program, including the head of our global cybersecurity team. These reports and updates may address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee periodically reports to the Board on data protection and cybersecurity matters. We also have protocols by which certain cybersecurity incidents are escalated within the Company and, in certain circumstances, reported to the Board and/or Audit Committee in a timely manner.


text: At the management level, the head of the global cybersecurity team is responsible for overseeing and implementing a cybersecurity strategy aligned with the Company's goals and needs. Our head of global cybersecurity has extensive experience with respect to cybersecurity matters as a result of over 10 years of relevant work experience and holds multiple industry certifications. Our cybersecurity function is supported by cybersecurity personnel with substantial industry experience as well as our network of regional IT leaders and our global IT infrastructure team. The head of the global cybersecurity receives ongoing updates from such individuals regarding the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: In conjunction with management, the head of global cybersecurity regularly reviews risk management measures to identify and mitigate data protection and cybersecurity risks. Key performance indicators, emerging threats, current trends and notable detections are reported to members of the Company's senior leadership team. The global cybersecurity team also works closely with our legal team to address legal, regulatory and contractual requirements.


text: Risk Management and Strategy Cybersecurity related risks are integrated into our overall enterprise risk management ("ERM") process. As a result, risks posed by cybersecurity threats are among the risks that the Company's ERM process evaluates and assesses at least annually. The results of this risk assessment, including cybersecurity, are presented to the Board of Directors annually.


text: The cybersecurity team implements, monitors and maintains controls leveraging the National Institute of Standards and Technology ("NIST") CyberSecurity Framework. These controls are designed to protect the confidentiality, availability and integrity of information systems. Our cybersecurity processes include automated tools and technical safeguards managed and monitored by our cybersecurity team. We view cybersecurity as a responsibility shared by all of our associates. As an organization committed to continuous improvement, we periodically conduct incident response tabletop exercises with key members of our leadership team, including our Chief Executive Officer, perform internal and external assessments and engage consultants to help assess the design and effectiveness of our program. In addition, we expect all of our associates as well as our third-party vendors to help protect against cybersecurity risks, and we conduct periodic awareness campaigns, emerging threats communications and specific trainings.


text: We have adopted a Global Cybersecurity Incident Response Procedure that applies in the event of a cybersecurity threat or incident. These procedures include an incident response playbook which outlines the steps to be addressed in the event of a cybersecurity incident, from incident detection to mitigation, recovery and notification within the Company and to the Audit Committee and/or Board of Directors, as specified.


text: We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. We employ systems and processes designed to oversee, identify and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. Despite ongoing efforts to continued improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, disruption of our business operations, revenue and client loss, legal actions, or statutory penalties, among other consequences.


text: Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate and remediate cybersecurity incidents. While we are not aware of any material cybersecurity threats or incidents that have had or are reasonably likely to materially affect us, including having a long-term impact on our business strategy, results of operations or financial condition, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. For additional information the cybersecurity risks faced by our Company, refer to Item 1A. "Risk Factors—Risks Related to Our Business—Our electronic information systems have been and could in the future be, subject to service interruptions, data corruption, cyber-based attacks and network security breaches. Significant disruptions in, or breaches in security of, our electronic information systems or data can adversely affect our business and financial statements."


text: Internal Cybersecurity Team and Governance The Board maintains responsibility for oversight of risks that may affect the Company. Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee reviews the Company's policies with respect to risk assessment and enterprise risk management, including with respect to cybersecurity risks. Certain members of our Audit Committee have experience with respect to cybersecurity risk management.


text: The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives reports and presentations from members of the Company's management team responsible for overseeing the Company's cybersecurity risk program, including our Chief Information Officer ("CIO"). These reports and updates may address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee periodically reports to the Board on data protection and cybersecurity matters. We also have protocols by which certain cybersecurity incidents are escalated within the Company and, in certain circumstances, reported to the Board and/or Audit Committee in a timely manner.


text: At the management level, our CIO is responsible for overseeing and implementing a cybersecurity strategy aligned with the Company's goals and needs. Our CIO has extensive experience with respect to cybersecurity matters as a result of over 20 years of relevant work experience. Our cybersecurity function is supported by highly trained cybersecurity personnel with substantial industry experience as well as our network of specialized consulting partners, regional IT leaders and our global IT infrastructure team. Our CIO receives ongoing updates from such individuals regarding the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: In conjunction with management, the CIO regularly reviews risk management measures to identify and mitigate data protection and cybersecurity risks. Key performance indicators, emerging threats, current trends and notable detections are reported to members of the Company's senior leadership team. The global cybersecurity team also works closely with our legal team to address legal, regulatory and contractual requirements.


text: The cybersecurity team implements, monitors and maintains controls that are aligned with the guidance defined by the National Institute of Standards and Technology ("NIST") CyberSecurity Framework. These controls are designed to protect the confidentiality, availability and integrity of information systems. Our cybersecurity processes include automated tools and technical safeguards managed and monitored by our cybersecurity team. We view cybersecurity as a responsibility shared by all of our associates. As an organization committed to continuous improvement, we periodically conduct incident response tabletop exercises with key members of our leadership team, including our Chief Executive Officer, perform internal and external assessments and engage consultants to help assess the design and effectiveness of our program. In addition, we expect all of our associates as well as our third-party vendors to help protect against cybersecurity risks, and we conduct periodic awareness campaigns, emerging threats communications and specific trainings.


text: We have adopted a Global Cybersecurity Incident Response Procedure that applies in the event of a cybersecurity threat or incident. These procedures include an incident response playbook that outlines the steps to be addressed in the event of a cybersecurity incident, from incident detection to mitigation, recovery and notification within the Company and to the Audit Committee and/or Board of Directors, as specified.


text: We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. We employ systems and processes designed to oversee, identify and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. Despite ongoing efforts to continuously improve our holistic ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, disruption of our business operations, revenue and client loss, legal actions, or statutory penalties, among other consequences.


text: Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate and remediate cybersecurity incidents. While we are not aware of any material cybersecurity threats or incidents that have had or are reasonably likely to materially affect us, including those having a long-term impact on our business strategy, results of operations or financial condition, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. For additional information on the cybersecurity risks faced by our Company, refer to Item 1A. "Risk Factors—Risks Related to Our Business—Our electronic information systems have been and could in the future be, subject to service interruptions, data corruption, cyber-based attacks and network security breaches. Significant disruptions in, or breaches in security of, our electronic information systems or data can adversely affect our business and financial statements."


text: Risk management and strategy The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Castellum, Inc.

ticker: CTM


text: Managing Material Risks & Integrated Overall Risk Management Castellum strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our IT department continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs.


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our critical systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties includes periodic audits, threat assessments, and consultation on security enhancements.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, the Company implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes quarterly assessments by our Vice President of Technology and Deployment (the "VP of Technology") and on an ongoing basis by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: The Board is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence. The Board is briefed on a periodic basis as to the nature of actions taken to mitigate risks from cyberattacks.


text: Board of Directors Oversight The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Management's Role Managing Risk The VP of Technology and Deployment and the CEO play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a semi-annual basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, the Company implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes quarterly assessments by our Cybersecurity Manager and on an ongoing basis by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: Management's Role Managing Risk The COO and the CEO play a pivotal role in informing the Audit Committee on cybersecurity risks. The COO was Castellum's Vice President of Technology and Deployment before becoming COO in September of 2024, and is a certified CMMC Professional. They provide comprehensive briefings to the Audit Committee on an at least an annual basis. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.


text: Cybersecurity Risk Management and Strategy Recognizing the ever-evolving nature of cybersecurity threats, we have established a cybersecurity risk management program designed to safeguard the confidentiality, integrity, and availability of our critical systems and data. This program integrates into our overall enterprise risk management framework and draws guidance from industry standards and best practices, including the National Institute of Standards and Technology Framework. aIdentification and assessment of cybersecurity risks that could impact our operations, facilities, third-party vendors, critical systems, and information. bUtilizing threat intelligence and historical adversarial activity to inform risk assessments and readiness evaluations. aImplementing administrative, physical, and technical controls designed to protect data and systems, as established in our Cyber Security policy.

companyName: IREN Ltd

ticker: IREN


text: b Leveraging external service providers, including assessors, consultants, auditors, and other third parties, to assess, test, monitor, and respond to cybersecurity threats in an attempt to maintain robust security controls. aEstablishing processes to oversee and identify cybersecurity risks associated with third-party service providers.


text: bEvaluating third-party vendors for compliance with our cybersecurity standards and requiring them to maintain appropriate security controls to protect our data. aMaintaining a cybersecurity incident response plan that outlines procedures for responding to and managing cybersecurity incidents.


text: bConducting regular cybersecurity awareness training for all employees, contractors, interns, and any user with access to Company systems to increase the preparedness and awareness of risks and procedures.


text: aRegularly updating and improving our cybersecurity practices and policies based on changing business practices, emerging threats, new technologies, and evolving industry standards. bConducting ongoing penetration testing and benchmarking against industry practices to enhance our security posture.


text: Cybersecurity Incidents: In our fiscal year ended June 30, 2025, we did not identify any cybersecurity incidents that have materially affected our business strategy, operations, or financial condition. We continue to monitor and seek to manage these risks proactively to protect the ongoing security and resilience of our organization. A cybersecurity incident could result in (i) an interruption in our services, (ii) the loss of ability to control or operate our equipment, (iii) misappropriation of personal data and (iv) the loss of critical data that could interrupt our operations, any of which could, among other things, adversely impact our reputation and brand and expose us to increased risks of violation of applicable law, governmental and regulatory investigation and enforcement actions, or private litigation or other liability, including potentially significant financial losses.


text: Cybersecurity Governance Our cybersecurity governance structure is designed to achieve effective oversight and management of cybersecurity risks across the organization.


text: a The Board holds ultimate oversight responsibility for our cybersecurity risk management program. It receives regular updates from management on cybersecurity risks, incidents, and the overall effectiveness of the program.


text: b The Board's Audit and Risk Committee is specifically tasked with overseeing cybersecurity and information technology risks, so that risk management strategies align with the company's overall risk profile.


text: a Day-to-day responsibility for managing cybersecurity risks lies with our Chief Technology Officer (CTO) who leads a dedicated cybersecurity team. This team includes internal and external security professionals with expertise in cybersecurity management.


text: a Our Incident Response Team, led by our CTO, coordinates the Company's response to cybersecurity incidents. This team includes representatives from IT, legal, investor relations, risk & compliance, and other relevant departments (as required).


text: b The Incident Management Plan - Technology and Data, developed by our cybersecurity team, follows a structured process for escalating, assessing and categorizing cybersecurity incidents, and IREN's response process, including remediation and post-incident activities. This is designed to be a systematic and coordinated approach to managing cybersecurity incidents.


text: a Our CTO has over 15 years of experience in cybersecurity management, and has a background in security and information technology solutions.


text: bMembers of the Cybersecurity team possess a diverse range of expertise, including prior work experience in cybersecurity, and specialized knowledge and skills in cybersecurity.


text: a Management regularly informs and updates the Board and the Audit and Risk Committee on cybersecurity risks, incidents, and the effectiveness of risk management strategies.


text: b Management provides frequent informal communications to the Board between regularly scheduled meetings to keep the Board apprised of any emerging risks or incidents.


text: For further details on the cybersecurity risks we face, refer to Part I, Item 1.A. "Risk Factors" of this Annual Report on Form 10-K.


text: We have a comprehensive approach to identifying and managing cybersecurity risks that involves our information technology security personnel, senior management, Audit Committee and Board of Directors. Our cybersecurity risk management function is integrated into our overall risk management system and processes.

companyName: Douglas Elliman Inc.

ticker: DOUG


text: Governance. The Board of Directors has formally tasked the Audit Committee with oversight responsibility to review cybersecurity and data privacy risks. The Audit Committee receives regular reports from management about cybersecurity matters. In addition to regular reporting, we have procedures by which potential cybersecurity incidents are reported in a timely manner to the Chief Technology Officer, who then notifies the Chief Operating Officer and General Counsel of cybersecurity incidents and they collectively determine if a specific incident warrants escalation to the Audit Committee and the Board of Directors. Our CTO, who has more than 25 years of information security and cybersecurity experience, manages cybersecurity at the corporate segment and oversees a team of dedicated cybersecurity personnel employed in our real estate brokerage segment. Our governance procedures are generally designed to identify, assess, mitigate, prevent and, where required, respond to cybersecurity security incidents and threats in a timely manner to minimize the loss or compromise of information and assets and to facilitate incident resolution.


text: Cybersecurity incident identification and response. We use several processes and procedures to protect our data, systems and employees from cyber incidents, to reduce our overall cybersecurity risk profile, and to identify and respond to cybersecurity incidents in a timely manner. These processes and procedures leverage a variety of tools, including a security incident and event manager interface that uses behavioral analytics and provides live metrics and reports of attempted breaches and logs of firewalls, authentication attempts, emails, anti-malware, attempted intrusions and applications. We also conduct periodic tests to assess our processes and procedures and the threat landscape, which include, among other things, the engagement of third-party experts for external and internal penetration testing and system security assessments.


text: We have adopted an incident response plan that applies upon the occurrence of a cybersecurity incident involving a breach of our own information technology systems and applications. Pursuant to this response plan, if an incident occurs, a multi-disciplinary team is assembled that includes our CTO and General Counsel and, if appropriate, our COO and CFO, which in turn may leverage the expertise of third-party consultants, external legal counsel and other resources. The plan includes procedures designed to facilitate containment of, and responses to, a cybersecurity incident, which are based on the type of incident, the location of the incident and the breadth of the incident. The plan also establishes procedures for notifying any impacted parties, including our customers, law enforcement and regulatory authorities, third-party vendors and insurance providers. Our CTO will provide periodic updates to the Audit Committee and, when appropriate, the Board of Directors during this process.


text: After an incident, we would review and document the causes and effects of the incident, evaluate the remediation plan, and consider post-incident improvements. Where applicable, the CTO reports these findings to the Audit Committee and, when appropriate, the Board of Directors.


text: Processes to identify material risks associated with the use of third-party service providers. In addition to internal resources, we utilize third-party service providers to supplement and maintain our information technology systems. We have procedures to oversee and identify cybersecurity risks associated with our use of these third-party service providers, including procedures that apply if a cybersecurity incident occurs at a third-party service provider that results in our systems or data or our customers' data being compromised. These processes and procedures include, among others, a diligence review conducted by our information technology team of substantially all of our external business partners and a focused review of any such third parties' cybersecurity audit attestations, such as Service Organization Controls, NIST 800 alignments, ISO certifications, PCI DSS compliance or other recognized external reviews. In the case of a cybersecurity incident affecting a third-party, these procedures also govern interactions with personnel of the impacted third-party to determine the date, scope and effects of the cybersecurity incident, review the response and remediation measures taken by the third-party and conduct an inventory of potentially compromised data. Our notification process for a cybersecurity incident affecting a third-party is the same as the notification process that applies to a cybersecurity incident that affects our own information technology systems and applications.


text: Cybersecurity risks and previous incidents. We and certain of our third-party service providers have experienced, and expect to continue to experience, internal and external cybersecurity threats and incidents, which can result, and have resulted, in the misappropriation and unavailability of critical data and confidential or proprietary information (our own and that of third parties, including personally identifiable information) and the disruption of business operations. However, we have not been subject to cybersecurity incidents that, individually or in aggregate, have been material to our operations or financial condition, but we cannot provide assurance that they will not have a material impact in the future. See Item 1A. Risk Factors.


text: Governance. The Board of Directors has formally tasked the Audit Committee with oversight responsibility to review cybersecurity and data privacy risks. The Audit Committee receives regular reports from management about cybersecurity matters. In addition to regular reporting, we have procedures by which potential cybersecurity incidents are reported in a timely manner to the Chief Technology Officer (CTO), who then notifies the Chief Executive Officer of cybersecurity incidents and they collectively determine if a specific incident warrants escalation to the Audit Committee and the Board of Directors. The acting CTO is our Executive Vice President, Chief Financial Officer, Treasurer, and Secretary, who took over responsibilities in October 2024 upon the departure of the Company's prior CTO. Our CTO manages cybersecurity at the corporate segment and oversees a team of dedicated cybersecurity personnel employed in our real estate brokerage segment, including a Chief Information Security Officer. Our governance procedures are generally designed to identify, assess, mitigate, prevent and, where required, respond to cybersecurity security incidents and threats in a timely manner to minimize the loss or compromise of information and assets and to facilitate incident resolution.


text: We have adopted an incident response plan that applies upon the occurrence of a cybersecurity incident involving a breach of our own information technology systems and applications. Pursuant to this response plan, if an incident occurs, a multi-disciplinary team is assembled that includes our CTO and the General Counsel of Douglas Elliman Realty LLC and, if appropriate, the CFO of Douglas Elliman Realty LLC, which in turn may leverage the expertise of third-party consultants, external legal counsel and other resources. The plan includes procedures designed to facilitate containment of, and responses to, a cybersecurity incident, which are based on the type of incident, the location of the incident and the breadth of the incident. The plan also establishes procedures for notifying any impacted parties, including our customers, law enforcement and regulatory authorities, third-party vendors and insurance providers. Our CTO will provide periodic updates to the Audit Committee and, when appropriate, the Board of Directors during this process.


text: Cybersecurity Risk Management and Strategy We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats which have been integrated into the Company's overall risk management strategy and processes. The Company seeks to address cybersecurity risks through a comprehensive approach that is focused on implementing robust protective measures, promoting user awareness and education, continuously monitoring for potential threats, and swiftly responding to any security incidents to ensure the confidentiality, integrity, and availability of sensitive information.

companyName: Perimeter Solutions, Inc.

ticker: PRM


text: In addition, we actively engage with key vendors and industry communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures and have processes in place to oversee and identify the risk of cybersecurity threats associated with our use of these third-party vendors. We generally require third parties to, among other things, maintain security controls to protect our confidential information and data, and notify us of material cybersecurity threats that may impact our business.


text: In 2023, we did not identify any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Our Board has oversight of our strategic and business risk management and has delegated the oversight of cybersecurity risk management to the Company's Audit Committee. The Company's Audit Committee is responsible for overseeing all matters relating to the security of and risks related to the Company's information technology systems and procedures, including its cybersecurity and other information technology risks. The Audit Committee is responsible for ensuring the Company has processes in place for assessing, identifying and managing material risks from cybersecurity threats.


text: The Company's information security program is managed by the Company's Chief Information Officer (the "CIO"), whose team is responsible for leading our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The CIO has extensive global experience in developing and executing information technology strategies. The CIO and the information security team, in collaboration with the Chief Financial Officer and the Audit Committee, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: The CIO provides periodic reports to our Board, as well as our Chief Financial Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: Cybersecurity Risk Management and Strategy The Company proactively manages its cybersecurity and data privacy risks with organizational and technical controls including a comprehensive set of policies and procedures for assessing, identifying, and managing material risks from cybersecurity threats which have been integrated into the Company's overall risk management strategy and processes. The Company seeks to address cybersecurity risks through a comprehensive approach that is focused on implementing robust protective measures, promoting user awareness and education, continuously monitoring for potential threats, and swiftly responding to any security incidents to ensure the confidentiality, integrity, and availability of sensitive information.


text: The Company's Incident Response Team, which is comprised of members of the finance, legal, information technology and operations teams conduct annual tabletop exercises in which various levels of management participate in simulated data security/privacy scenarios that the Company, its customers, vendors and/or its personnel may face in the future. The Company engages external resources to refresh the subject matter of these exercises and to continually challenge the Company's management in these exercises. Annual formal training using an online platform is required for all employees. Topics include how to identify suspicious activities and occurrences related to social engineering, phishing, viruses, and insider threats.


text: In 2024, we did not identify any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: The Company's information security program is managed by the Company's Incident Response Team, which is responsible for leading our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Members of the Incident Response Team have extensive global experience in developing and executing information technology strategies. The Incident Response Team, which includes the Chief Financial Officer ("CFO"), in collaboration with the Audit Committee, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: The CFO provides periodic reports to our Audit Committee, as well as other members of our senior management as appropriate. These reports occur at least annually and include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: Risk Management and Strategy We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include responses to and assessments of internal and external threats to the security, confidentiality, integrity and availability of the Company's data and systems along with other material risks to firm operations, at least annually or whenever there are material changes to our systems or operations. As part of our risk management process, we engage outside providers to conduct periodic internal and external penetration testing. We use NIST Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements. We store firm data in cloud environments with security appropriate to the data involved and have adopted controls around, among other things, vendor risk assessment, access and acceptable use and backup and recovery.

companyName: TPG Inc.

ticker: TPG


text: We have processes to oversee and identify material risks associated with the use of third-party service providers, taking into account the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider.


text: We have established an Enterprise Risk Committee ("ERC") to manage overall risk across the Company including cybersecurity risks identified by the cybersecurity team; the ERC includes representatives from relevant functions and is led by our Chief Executive Officer ("CEO"). We have also established an Operational Risk Committee ("ORC") which is responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of our risk management, control and governance processes is assigned to our Chief Information Security Officer, who periodically reports, among other things, potentially material cybersecurity incidents to the ORC and, in coordination with the Chief Information Officer and Head of Operations, reports to the ERC at least annually. The Chief Information Security Officer leads the Company's cybersecurity team, which includes individuals dedicated to incident detection and response. This team is responsible for identifying threats that can impact the Company and designing controls to mitigate vulnerabilities before they are exploited and to detect and neutralize any threats that do materialize. The Chief Information Security Officer and Chief Information Officer each have more than 20 years of experience in their fields. The Chief Information Security Officer and senior members of the cybersecurity team hold industry standard certifications.


text: Our Audit Committee is briefed on cybersecurity risks at least once each year and as needed in connection with any potentially material cybersecurity incidents. The Chief Information Security Officer reports at least annually, to our Audit Committee and such report may address overall assessment of the Company's compliance with this and other cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Risk Management and Strategy We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include risk assessments of internal and external threats to confidentiality, integrity and availability of the Company's data and systems along with other material risks to firm operations.


text: These risk assessments inform our cybersecurity program and the continued development of a layered set of controls aimed at preventing, detecting and responding to threats. Our administrative, organizational, technical and physical security controls include, but are not limited to, policies and procedures, system hardening vulnerability scanning and patching, employee training and awareness, third-party risk management processes, backup and recovery processes, access controls, data encryption in transit and at rest, network perimeter controls and identity verification. We also have policies and controls in place designed to detect and respond to cybersecurity events, including an incident response plan, an incident response team with dedicated roles and responsibilities for assessing and responding to a cybersecurity event, system logging and ongoing monitoring, and periodic training exercises simulating cybersecurity events that are designed to raise awareness and test our team's response readiness capabilities.


text: The nature, scope and effectiveness of these controls are regularly reviewed through a series of internal and external processes. The Cybersecurity team performs both automated monitoring on a continuous basis and manual reviews of key controls. We also conduct annual assessments of our cybersecurity program using industry standard cybersecurity frameworks, such as the NIST Cybersecurity Framework, as benchmarks to perform our evaluation. This does not imply that we fully meet any particular industry standards, specifications or requirements. In addition, independent reviews of our cybersecurity control effectiveness are conducted by TPG's Internal Audit team on a periodic basis. We also engage external providers to conduct periodic external assessments, including penetration testing.


text: We have established an Enterprise Risk Committee ("ERC") to manage overall risk across the Company including cybersecurity risks identified by the Cybersecurity team; the ERC includes representatives from relevant functions and is led by our CEO. We have also established an Operational Risk Committee ("ORC") which is responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of our risk management, control and governance processes is assigned to our Chief Information Security Officer ("CISO"), who periodically reports, among other things, potentially material cybersecurity incidents to the ORC and reports to the ERC at least annually. The Cybersecurity team also regularly coordinates with other key stakeholders within the Firm, including Compliance, Human Resources, Internal Audit and Legal.


text: The Chief Information Security Officer leads the Company's Cybersecurity team, which is responsible for implementing, maintaining and enforcing our cybersecurity program. Our CISO previously held various leadership roles within the Technology Risk department of one of the world's largest banking institutions over a 17-year period. He holds a Bachelor of Science in Electrical Engineering and Mathematics from the University of Texas at Arlington and is a Certified Information Systems Security Professional (CISSP). Our Cybersecurity team possesses a variety of cybersecurity skill sets and extensive expertise obtained through decades of experience, numerous industry certifications, and advanced degrees. The Cybersecurity team continues to take steps to maintain up-to-date knowledge of evolving cybersecurity threats and countermeasures.


text: The Audit Committee of our Board of Directors has primary oversight over the Cybersecurity program. The Chief Information Security Officer reports at least annually to the Audit Committee and such report may address overall assessment of the Company's compliance with our cybersecurity policies, including risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Cyber criminals do, however, target TPG and our employees and vendors. Ongoing or future attacks such as these could have impacts on TPG's operations. For additional information on these ongoing risks please refer to "Part 1. Item 1A. Risk Factors—Failure to maintain the security of our information and technology networks or data security breaches could harm our reputation and have a material adverse effect on our results of operations, financial condition, and cash flow".


text: We face cybersecurity risks that could materially affect our business, financial condition, and results of operations. Cybersecurity threats include unauthorized access, data breaches, theft, misuse, disruption, or destruction of systems, digital assets, or confidential information. These risks are heightened given our reliance on digital asset custodians, cryptocurrency wallet providers, online hosting services, and other unaffiliated third-party service providers.

companyName: C2 Blockchain, Inc.

ticker: CBLO


text: Because a substantial portion of our current and past assets are maintained in the form of digital assets such as DOG Coin, and as of June 30, 2025, Cardano (ADA) tokens, our exposure to cybersecurity threats is significant. If the systems of our third-party wallet providers, custodians, or other service providers are compromised, or if our own limited internal protections fail, we could suffer an immediate and total loss of such assets. Unlike traditional bank accounts or securities held with registered brokers, digital assets may not be recoverable if stolen or rendered inaccessible due to a cyber incident. Any such loss could have a material adverse effect on our financial condition, business prospects, and results of operations.


text: developed or implemented a formal, enterprise-wide cybersecurity risk management program due to our small size, limited personnel, and early stage of operations. Our approach to cybersecurity consists primarily of commercially available tools such as multi-factor authentication, password protection, and encryption for certain Company accounts. We also rely on third-party custodians and wallet service providers for safeguarding digital assets, and we informally monitor industry alerts and provider communications for potential risks. These measures may not be sufficient to detect or prevent sophisticated or evolving threats, and our ability to evaluate or influence the cybersecurity practices of third-party service providers is limited.


text: cybersecurity matters rests with our sole officer and director, Levi Jacobson, who evaluates service providers, monitors for potential incidents, and would be responsible for coordinating any response. We do not currently employ dedicated cybersecurity personnel or maintain outside consultants on a continuing basis, though we may engage external advisors in the event of a material incident. As we currently have only one director, board-level oversight and management responsibilities are consolidated.


text: have not experienced any known material cybersecurity incidents. However, there can be no assurance that our systems or those of our service providers will not be compromised in the future. A successful attack could result in the theft or complete loss of our DOG Coin or other digital asset holdings, disruption of planned operations, reputational harm, potential legal liability, and the diversion of resources.


text: The Company maintains a governance structure to address cybersecurity risk, which involves a dedicated Security Operations Team (the "Security Operations Team"), an executive security steering committee (the "Executive Security Steering Committee"), and the Compliance and Risk Committee of the Board and the Board.

companyName: DraftKings Inc.

ticker: DKNG


text: The Company's Security Operations Team, led by our Chief Information Security Officer, is responsible for identifying, assessing, mitigating, and reporting on material cybersecurity risks to the Company's Executive Security Steering Committee. The Company's Chief Information Security Officer holds high-level licenses and certifications relating to information security, including a Certified Information Security Manager from the Information Systems Audit and Control Association and a Certified Information Systems Security Professional and a Certified Cloud Security Professional from the International Information Security System Security Certification Consortium. The Company's Executive Security Steering Committee, chaired by the Company's Chief Information Security Officer and comprised of various cross-functional members of senior management, drives awareness and alignment across broad stakeholder groups for cybersecurity governance and risk management and reporting. The Executive Security Steering Committee receives quarterly reports from the Company's Chief Information Security Officer. The Compliance and Risk Committee receives regular reports from the Company's Chief Information Security Officer. The Compliance and Risk Committee periodically reports to the Board.


text: The Company maintains an operational Incident Response Plan ("IRP") that defines how the Company handles cyber incidents, including escalation, reporting and remediation procedures. The IRP is reviewed annually both internally and by third parties during regular audits. In addition, the Company retains a preferred partner with expertise in cyber risks and incidents to advise on cybersecurity related matters. The Company's preferred partner is also part of the Company's IRP procedures and provides independent analysis and advice during cybersecurity investigations. The Company also maintains a Security Awareness Program, which is designed, implemented, and maintained by the Company's Chief Information Security Officer. The Company's Security Awareness Program includes training that reinforces the Company's information technology risk and security management policies, standards and practices, as well as the expectation that employees comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Company's resources and information, as well as how to respond to unauthorized access to or use of Company information. The Security Awareness Program training is mandatory for all employees globally at least annually, and it is supplemented by Company-wide assessment initiatives, including periodic testing. The Company provides specialized security training for certain employee roles, such as application developers.


text: The Company conducts periodic tests to assess the Company's processes and procedures and the threat landscape, which are designed with the goal of implementing and maintaining a robust cybersecurity program. Where appropriate, the Company takes additional and ongoing steps intended to strengthen the Company's cybersecurity capabilities and mitigate the risk of a breach or incident. The Company's security program and IT-related controls are regularly examined by internal auditors, external auditors and various regulators. For example, each year, the Company conducts various third-party audits, including SOC 2 Type2, PCI DSS, ISO 27001. The Company also engages third-party consultants for incident responses. These third-party consultants report directly to the Chief Information Security Officer and, depending on the nature of the incident, report directly to the Executive Security Steering Committee on various topics including, effects of the incident and recommendations on how to strengthen the Company's cybersecurity capabilities and mitigate the risk of a breach or incident. In addition to assessing the Company's cybersecurity preparedness, the Company also considers and evaluates cybersecurity risks associated with its use of third-party service providers. The Company maintains a vendor onboarding program, pursuant to which the Company regularly reviews third-party hosted applications and, when available, requests its vendors to provide SOC2 and/or ISO 27001 certificates. The Company's assessment of risks associated with use of third-party providers is part of the Company's overall cybersecurity risk management program.


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face unknown cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information. We continuously work to enhance our cybersecurity risk management program.


text: The Company maintains an operational Incident Response Plan ("IRP") that defines how the Company handles cybersecurity incidents, including escalation, reporting and remediation procedures. The IRP is reviewed annually both internally and by third parties during regular audits. In addition, the Company retains a preferred partner with expertise in cybersecurity risks and incidents to advise on cybersecurity related matters. The Company's preferred partner is also part of the Company's IRP procedures and provides independent analysis and advice during cybersecurity investigations. The Company also maintains a Security Awareness Program, which is designed, implemented, and maintained by the Company's Chief Information Security Officer. The Company's Security Awareness Program includes training that reinforces the Company's information technology risk and security management policies, standards and practices, as well as the expectation that employees comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Company's resources and information, as well as how to respond to unauthorized access to or use of Company information. The Security Awareness Program training is mandatory for all employees globally at least annually, and it is supplemented by Company-wide assessment initiatives, including periodic testing. The Company provides specialized security training for certain employee roles, such as application developers.


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we have experienced, and we may in the future experience cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information. We continuously work to enhance our cybersecurity risk management program.


text: Risk management and strategy The Company and the broader financial services industry face an increasingly complex and evolving threat environment.

companyName: T Series Middle Market Loan Fund LLC


text: Morgan Stanley has made and continues to make substantial investments in cybersecurity and fraud prevention technology, and employ experienced talent to lead its Cybersecurity and Information Security organizations and program under the oversight of Morgan Stanley's Board of Directors (the "MS Board") and the Operations and Technology Committee of the MS Board ("BOTC").


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify, and manage risks arising from the cybersecurity threats confronting the Firm ("Cybersecurity Program"). Morgan Stanley's Cybersecurity Program helps protect the Firm's clients, customers, employees, property, products, services, and reputation by seeking to preserve the confidentiality, integrity, and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems, including as applicable to the Company and its stockholders. Morgan Stanley continually adjusts its Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.


text: The Adviser and the Administrator manage the Company's day-to-day operations, and the Company uses the Cybersecurity Program to assess, identify and manage material cybersecurity risks affecting the Company and its operations. The Company's business is dependent on the communications and information systems of Morgan Stanley, including but not limited to the Cybersecurity Program, and other third-party service providers.


text: Processes for assessing, identifying, and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and stockholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley forensics team, which develops and implements technologies designed to help detect these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Where a potential threat is identified in Morgan Stanley's environment or which impacts the Company, Morgan Stanley's incident response team evaluates the potential impact to the Firm and, as relevant, the Company, and coordinates remediation where required. These groups, as well as Morgan Stanley's Operational Risk Department, review external cybersecurity incidents that may be relevant to the Firm and the Company, and the outcomes of these incidents further inform the design of the Cybersecurity Program. In addition, Morgan Stanley maintains a robust global training program on cybersecurity risks and requirements and conducts regular training exercises for its employees and consultants, including those personnel relied upon by the Company.


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to the Firm or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity program to identify the impact of their services on the cybersecurity risks to the Firm or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or a Firm audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, certain elements of the Cybersecurity Program are subject to an audit by an independent consultant, as well as an assessment by a separate, independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley and Company Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Risk, is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company. Those processes are periodically tested through tabletop exercises.


text: The Chief Compliance Officer ("CCO") of the Company is responsible for overseeing the Company's risk management function and generally and relies on the CIO, CISO, and Head of Operational Risk to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of Operational Risk has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies. The Company's CCO has worked in the financial services industry for 19 years and has covered business developments from a compliance perspective for over 10 years, during which time the Company's CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of Operational Risk report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our Board.


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO, the CISO, and the Head of Operational Risk, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2023, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify, and manage risks arising from the cybersecurity threats confronting the Firm ("Cybersecurity Program"). Morgan Stanley's Cybersecurity Program helps protect the Firm's clients, customers, employees, property, products, services, and reputation by seeking to preserve the confidentiality, integrity, and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems, including as applicable to the Company and its unitholders. Morgan Stanley continually adjusts its Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.


text: Processes for assessing, identifying, and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and unitholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley cyber threat detection team, which develops and implements strategies designed to defend against these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Morgan Stanley's vulnerability management team, as well as Morgan Stanley's Non-Financial Risk function ("NFR") review external cybersecurity incidents that may be relevant to the Firm and the Company, to further inform the design of the Cybersecurity Program.


text: To assess the efficacy of Morgan Stanley's controls and defenses designed to mitigate cybersecurity risk, it utilizes internal and external testing, including penetration testing and red team engagements. The results of these assessments are used to strengthen the Cybersecurity Program. Additionally, Morgan Stanley maintains a global training program covering cybersecurity risks and requirements, including heightened security training to specialized employees, and conducts regular phishing email simulations for its employees and consultants as preventative measures.


text: When a threat is identified in Morgan Stanley's environment, its incident response team follows an incident response plan to evaluate the impact to the Firm and coordinate appropriate remediation. If warranted, the cybersecurity incident will be reported to applicable regulators, authorities, impacted clients or counterparties, as appropriate. The Firm's cybersecurity incident response and remediation processes, including assessing materiality and reporting requirements, are reviewed through tabletop exercises.


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to the Firm or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity program to identify the impact of their services on the cybersecurity risks to the Firm or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or a Firm audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's minimum cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, key elements of the Cybersecurity Program are subject to a review by an independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley and Company's Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Cyber, Technology, and Information Security Non-Financial Risk, ("Head of NFR CTIS"), is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company.


text: The Chief Compliance Officer ("CCO") of the Company is responsible for overseeing the Company's risk management function and generally relies on the CIO, CISO, and Head of NFR CTIS to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of NFR CTIS has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies. The Company's CCO has worked in the financial services industry for 19 years and has covered business developments from a compliance perspective for over 10 years, during which time the Company's CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of NFR CTIS report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our Board.


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO, CISO and Operational Risk functions, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Material cybersecurity risks are addressed by Morgan Stanley management-level ERM committees with escalation to the BOTC and Board, as appropriate. The BOTC has primary responsibility for assisting the Morgan Stanley board in its oversight of significant operational risk exposures of the Firm and its business units, including IT, information security, fraud, third-party oversight, business disruption and resilience, and cybersecurity risks (including review of cybersecurity risks against established risk management methodologies) and the steps management has taken to monitor and control such exposures.


text: In accordance with its charter, the BOTC receives quarterly reports from (i) Technology, including the CIO or the CISO; (ii) Operations; and (iii) NFR. Such reporting includes updates on Morgan Stanley's Cybersecurity Program, risks from cybersecurity threats, our programs to address and mitigate the risks associated with the evolving cybersecurity threat environment, and NFR's assessment of cybersecurity risks. Senior officers in Technology and NFR also provide an annual report to the BOTC on the status of Morgan Stanley's broader information security program in compliance with the Gramm-Leach-Bliley Act, which includes a discussion of risks arising from cybersecurity threats. At least annually, senior management representatives in Technology and NFR discuss the status of the Cybersecurity Program and key cybersecurity risks with the Morgan Stanley board and, in accordance with such board's Corporate Governance Policies, all board members are invited to attend BOTC meetings and have access to meeting materials. The BOTC, which meets at least quarterly, also reviews and approves significant policies related to cybersecurity, receives an annual independent assessment of key aspects of Morgan Stanley's Cybersecurity Program from an independent third party and holds joint meetings with the BAC and BRC, as necessary and appropriate. The chair of the BOTC regularly discusses cybersecurity developments with senior Morgan Stanley management and reports to the Morgan Stanley board on cybersecurity risks and threats and other related matters.