text: Cybersecurity Risk Management and Strategy The Fund is externally managed by the Advisers and has no employees or internal information systems. Thus, the Fund relies on the Advisers, BlackRock, Inc. ("BlackRock") as well as the custodian and other service providers to protect the Fund's information from cybersecurity threats. The Fund's chief compliance officer (the "CCO") oversees the Fund's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board of Trustees. The CCO and the Advisers also review key Fund service providers' compliance and risk management policies and procedures related to cybersecurity matters, evaluate such service providers' use of information systems, which have the potential to subject the Fund to information technology vulnerabilities, and receive reports from the Fund's service providers regarding any cybersecurity threats and incidents.

companyName: BlackRock Private Credit Fund


text: Specifically, the Fund's relies on the enterprise risk management ("ERM") framework of BlackRock for the Fund's cybersecurity risk management and strategy. The Board of Trustees of the Fund periodically receives reports from BlackRock and from the Advisers regarding BlackRock's cybersecurity program. Key aspects of the ERM framework are summarized below.

secItem: Item 1C


text: BlackRock's Enterprise Risk Management Framework BlackRock recognizes the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Cybersecurity represents an important component of BlackRock's approach to ERM. BlackRock leverages a multi-lines-of-defense model with cybersecurity operational processes executed by global information security and other teams and dedicated internal audit technology and technology risk management ("TRM") teams that independently review technology risks. BlackRock's cybersecurity program is fully integrated into its ERM framework and is aligned with recognized frameworks, including NIST CSF, FFIEC CAT, FedRAMP, SOC 1/2, ISO 27001/2 and others. BlackRock aims to inform and continuously improve its cybersecurity program through engagement with regulatory, client, insurer, vendor, partner, peer, government and industry organizations and associations, as well as external audit, technology risk, information security and other assessments.


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's Board of Directors (BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC"). • Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks. • Safeguards: The Fund deploys a range of people, process and technical controls that are designed to protect the Fund's information systems from cybersecurity threats, which may include, among others: physical security controls; perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention; tabletop exercises, ongoing vulnerability and patch management; vendor due diligence; multi-factor authentication; device encryption; application security, code testing and penetration testing; endpoint security, including anti-malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges; employee awareness, training, and phishing testing; data loss prevention program and monitoring; information security incident reporting and monitoring; and layered and comprehensive access controls. • Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address the Fund's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis. • Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third-party systems. Operational incidents can arise as a result of failures by third parties with which BlackRock does business, such as failures by internet, communication technology and cloud service providers or other vendors to adequately follow processes and procedures, safeguard their systems or prevent system disruptions or cyberattacks. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.


text: • Education and Awareness: BlackRock's employees and contractors are required to complete an annual information security training to equip them with effective tools to address cybersecurity threats, and to receive communications on BlackRock's evolving information security policies and procedures.


text: BlackRock's global information security team, in collaboration with the technology risk and internal audit teams, engages in the periodic assessment and testing of BlackRock's cyber risks and cybersecurity program. These efforts may include a wide range of activities, including audits, assessments, wargames and "tabletop" exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. BlackRock also participates in financial services industry and government forums in an effort to improve both internal and sector cybersecurity defense. BlackRock regularly engages third parties and advisors to assess its cybersecurity control environment. The results of certain program and control assessments are reported to the Risk Committee, and BlackRock adjusts its cybersecurity program as appropriate based on the information provided by these assessments.


text: As of December 31, 2023, the Fund is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect the Fund's business strategy, results of operations, or financial condition.


text: Cybersecurity Governance The Board of Trustees of the Fund periodically receives reports from BlackRock and from the Advisers regarding BlackRock's cybersecurity program. Team members who support the Fund's information security program have relevant educational and industry experience.


text: At the BlackRock parent level, BlackRock's Board is actively engaged in the oversight of BlackRock's risk management program. The Risk Committee assists the Board with its oversight of BlackRock's levels of risk, risk assessment, risk management and related policies and processes, including risks arising from cybersecurity threats. The Risk Committee receives regular reports on BlackRock's cybersecurity program, technology resilience risk management and related developments from members of our information security team, including the CISO. The Board and the Risk Committee also receive information regarding cybersecurity incidents that meet certain reporting thresholds. On an annual basis, senior members of BlackRock's technology, risk and information security teams provide a comprehensive overview of BlackRock's cyber risk and related programs to a joint session of the Board's Risk and Audit Committees.


text: Technology and cybersecurity risks at BlackRock are also overseen by the TRCC, a dedicated management risk governance committee and sub-committee of the firmwide ERC. The chair of the TRCC is appointed by the head of Enterprise Risk Management at BlackRock and its members include the CISO as well as a broad range of senior business stakeholders across BlackRock. The TRCC is responsible for oversight of BlackRock's technology and cybersecurity risk management practices and helps ensure that technology and cybersecurity risks remain within firmwide risk tolerances and technology and cybersecurity risk issues are escalated as appropriate to the ERC and other committees. The TRCC also reviews any relevant technology and cybersecurity risk related issues and helps ensure that they are appropriately escalated, reported, and remediated.


text: BlackRock's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by BlackRock's CISO. As of December 31, 2023, the CISO had over 30 years of experience in information technology with a 25-year concentration in information security, including previously serving as the CISO at several global financial institutions, and held the Certified Information Systems Security Professional certification. The CISO works closely with the leadership team and other subject matter experts in the global cybersecurity group, who collectively have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and overseeing cybersecurity controls in technology risk and audit functions, as well as having relevant degrees and industry-leading certifications.


text: The CISO and members of the TRCC monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation of BlackRock's incident response plan.


text: Risk Management and Strategy We have developed a framework designed to safeguard our organization's digital assets from threats and vulnerabilities. It involves a systematic approach of identifying, assessing, and mitigating risks associated with our technology systems, data, and operations. Key components of this include assessments of vulnerabilities, establishing security controls and policies, training employees, and having a well-defined incident response plan. Regular testing, compliance adherence, resource allocation, and continuous monitoring are also crucial to keeping our environment secure. We take a proactive approach, aiming to mitigate risk, protect sensitive information, and ensure the resilience of our digital infrastructure from cyber threats. We engage consultants or other third parties in conducting periodic assessments and testing of our policies, standards, processes, and practices.

companyName: Xponential Fitness, Inc.

ticker: XPOF


text: Material risks are those that have the potential to cause substantial harm or financial loss. Our approach involves a targeted strategy to protect critical data, systems, and infrastructure against cybersecurity challenges including cyber threats, data breaches, or regulatory compliance issues.


text: Third-party risk mitigation in cybersecurity is a crucial aspect of safeguarding our digital assets and ensuring data integrity and privacy. We monitor and manage the potential vulnerabilities and security gaps that can arise when working with external vendors, partners, or suppliers who have access to sensitive information or systems. We assess the cybersecurity practices of our third parties by evaluating their compliance with security standards. Evaluating third-party compliance helps us mitigate the risks of data breaches or security incidents originating from external sources, ultimately safeguarding our reputation, legal compliance, and overall cybersecurity posture.


text: We believe that the risks from cybersecurity threats, including as a result of any previous cybersecurity events, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business, results of operations, cash flows and financial condition.


text: The audit committee of our board of directors has primary responsibility for overseeing our risk management process relating to cybersecurity, which includes risks arising from cybersecurity threats.


text: The Vice President of Information Technology works together with our board of directors, audit committee, and members of executive management ("Cybersecurity Team") to set the strategic digital landscape. The Cybersecurity Team provides strategic guidance and oversight to ensure our cybersecurity posture is robust and aligned with our overall objectives. The Cybersecurity Team does this by establishing cybersecurity policies and setting risk tolerance levels, approving budgets for security initiatives, and ensuring compliance with relevant regulations and standards. The Cybersecurity Team engages in regular discussions regarding incident response strategies to assess the preparedness for cyber threats and continually evaluates our incident response plans. The Incident Response Team ("IRT") is led by the Vice President of Information Technology, who is the overall incident response coordinator. The IRT works together with our President to assess risk and materiality of an incident and engage members of Cybersecurity Team as needed.


text: Through ongoing communications with these teams, the Vice President of Information Technology and the Cybersecurity Team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the board of directors and the audit committee when appropriate.


text: Our Vice President of Information Technology's experience includes various roles in information technology and information security for over 15 years. Members of the Cybersecurity Team each hold undergraduate and, in some cases, graduate degrees in their respective fields, and each have experience managing risk at the Company or at similar companies, and assessing cybersecurity threats.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: LENSAR, Inc.

ticker: LNSR


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • an information technology team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Our Business— We rely significantly on the use of information technology. Cybersecurity risks – any technology failures causing a material disruption to operational technology or cyber-attacks on our systems affecting our ability to protect the integrity and security of customer and employee information – could harm our reputation and/or could disrupt our operations and negatively impact our business."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from internal information technology staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including the Director of Information Technology, Chief Operating Officer, Chief Financial Officer, and Principal Accounting Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team collectively has over 30 years of experience managing cybersecurity risks and is knowledgeable about our products and systems.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information technology personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Seer, Inc.

ticker: SEER


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards and Technology and the Center for Internet Security, as well as information security standards issued by the International Organization for Standardization, including ISO 27001. In 2023, our cybersecurity systems and processes achieved ISO 27001 certification. We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology (IT) environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - If we, or our vendors, partners or customers, experience a significant disruption in our information technology systems or breaches of data security, our business could be adversely affected."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of the cybersecurity risk management program. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives periodic briefings from the Audit Committe on our cybersecurity risk management program.


text: The Audit Committee receives regular reports from our dedicated Chief Information Security Officer (CISO) on our cybersecurity risks. In addition, our CISO updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser potential impact.


text: We have established an internal cross-functional leadership committee with the objective of overseeing the cyber security program, incidents, risks and initiatives. The committee is chaired by our CISO and is comprised of the President and Chief Financial Officer, Chief Legal Officer, Chief People Officer, Chief Data Officer, Chief Operations and Product Development Officer and the SVP of Product. This committee oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: The IT management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has over 20 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support and execution and holds a Certified Information Systems Security Professional certification.


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data.

companyName: BYLINE BANCORP, INC.

ticker: BY


text: Managing Material Risks and Integrated Overall Risk Management We have developed an Information Security Program (the "Program") as part of our overall risk assessment and Enterprise Risk Management ("ERM") to address material risks from potential cybersecurity threats, as well as to facilitate the governance and oversight of cybersecurity risks. The Program, which is administered by our Chief Risk Officer, includes policies and procedures that identify how security measures and controls are developed, implemented, maintained and assessed.


text: As part of our ERM, our Board of Directors reviews and approves the Program on an annual basis. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing management's reporting on Program effectiveness. In addition to a Privacy and Security Governance Committee, we also have Governance, Risk, Information Technology and Compliance functions that monitor and address enterprise risks, including cybersecurity risks.


text: A risk assessment, based on a method and guidance from a recognized national standards organization, is conducted at least annually. The risk assessment, along with risk-based analysis and judgment, are used to select security controls to address and to seek to mitigate risks. Factors considered during this process include, but are not limited to, the likelihood and severity of the risk, the impact on the Company and others, such as our customers, if a risk materializes, the feasibility and cost of controls, and the impact of controls on our operations.


text: Engaging Third Parties on Risk Management Specific controls that address cybersecurity risks include endpoint threat detection and response, identity and access management, logging and monitoring involving the use of security information and event management, multi-factor authentication, conditional access, firewalls and intrusion detection and prevention, and vulnerability and patch management. We engage third-party security firms in different capacities to provide or operate some of these controls, such as vulnerability assessments, penetration testing and other procedures to identify potential weaknesses in our systems and processes. In addition, as a financial institution, we conduct appropriate due diligence and monitoring procedures to address potential cybersecurity threats related to the use of third-party technology and outsourced services, including pre-acquisition due diligence, imposition of contractual obligations, and performance monitoring.


text: Oversight of Third-party Risk We have processes in place to oversee and manage risks associated with third-party service providers, including risks related to data breaches or other security incidents. This includes conducting security due diligence reviews of critical third-party providers, subjecting third parties to periodic risk assessments and requiring third parties to sign standard contractual provisions before receiving sensitive information from the Company.


text: Risk from Cybersecurity Treats We recognize that individual employees are frequent targets of threat actors. We regularly train employees on the importance of protecting our information, and communicate with our customers and employees on the importance to protect information and enhancing cybersecurity through security campaigns, newsletters, posters and ad-hoc communications. If specific threats are identified, management may communicate those threats directly to employees for heightened awareness. Our cybersecurity program requires employees to review and acknowledge information security and privacy policies annually, complete multiple cybersecurity training courses throughout the year, and participate in mock phishing campaigns regularly.


text: We also have a written Incident Response Plan and conduct tabletop exercises to enhance incident response preparedness. Business Continuity and Disaster Recovery plans are used to prepare for the potential for a disruption in technology we rely on. Employees undergo security awareness training when hired and annually.


text: While to-date we have not experienced a significant cybersecurity incident, significant data loss or any material financial losses related to cybersecurity attacks on our systems and those of our customers and third-party service providers are under constant threat, and it is possible that we could experience an incident in the future that could have a material adverse effect on our business strategy, results of operations and financial condition. See also Item 1A, Risk Factors – Technology Risks.


text: As a financial institution (or third parties it relies on) we may not be able to fully, continuously, and effectively, implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate, and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: Cybersecurity Risk Management and Strategy We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our client's and our data. We have a global cybersecurity and privacy program to help effectively assess, identify, and manage cybersecurity threat risks. We have developed a list of cybersecurity risks from known threats and our own history to help identify what is most meaningful and potentially impactful to the Company. The cybersecurity and privacy initiatives to address the risks are complex, strategic, and ever evolving. Threats and risks are identified from threat intelligence sources that include our vendors, industry, and government organizations. We continuously monitor and scan the cyber landscape to review evolving threats and risks that may impact us. Information from these various sources are reviewed by our cybersecurity and risk teams to evaluate risks in line with the NIST Cybersecurity Framework. Threat intelligence from other financial institutions and industry consortiums that serve financial institutions, such as the Financial Services Information Sharing and Analysis Center, provides key information on how risks are affecting our industry, with ability to preemptively mitigate emerging threats, as discussed above in Part I, Item 1A of this Form 10-K under the heading Technology and Data Security.

companyName: CRAWFORD & CO

ticker: CRD-A


text: We score cybersecurity risks based on the likelihood and impact on our operations. Such cybersecurity risks are integrated and evaluated as part of the global Enterprise Risk Management ("ERM") program, which is managed by the ERM Director. The Governance Committee of the Board of Directors maintains oversight of the ERM program and the Audit Committee maintains oversight of the cybersecurity program to ensure risks to the Company are managed within our risk appetite.


text: Our ERM program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process when identifying and assessing material risks. Our ERM team collaborates with internal subject matter specialists, as necessary, to gather insights and report on the most significant risks. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to identify threats and improve our incident response plan.


text: We identify and assess cybersecurity incidents based on multiple factors including information from previous events and incidents. The Cybersecurity Incident Response Team ("CSIRT") categorizes events into four levels of severity with defined requirements to assess criticality. The CSIRT informs both our leadership as well as our SEC Cybersecurity Rules Disclosure Committee ("SCRDC"), Cybersecurity and Privacy Council and the Audit Committee of the Board on matters related to cybersecurity risks that are deemed to materially affect the Company.


text: We perform ongoing cybersecurity awareness training for our employees that reinforces our Global Information Security policies, standards and practices. In addition, employees receive periodic newsletters emphasizing awareness of new cybersecurity threats (e.g., phishing attempts, smishing, pretexting, and deep fakes). This training is mandatory for all employees globally and is supplemented with periodic phishing tests. Additionally, we perform an annual external evaluation of our cybersecurity program using the NIST Cybersecurity Framework.


text: We regularly engage with consultants to review our cybersecurity program to help identify areas for continued focus, improvement and compliance. Our processes also address cybersecurity risks associated with third-party service providers, including those with access to our non-public or restricted data, including client data. Third-party risks are also included within our ERM program and are actively reported to the Audit and Governance Committees. Our Third-Party Risk Management Program comprises a defined process to identify, assess, and mitigate risks by our third-party suppliers and service providers, specifically including cybersecurity and privacy risks.


text: We are also in the process of simplifying our technology landscape and implementing several new cybersecurity technologies that will help improve the management of cybersecurity risks and threats. In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial (including no related penalties and settlements).


text: Cybersecurity Governance Our global cybersecurity and privacy program is managed by our Chief Information Security Officer ("CISO"), Vice-President of Global IT Security, Global Chief Privacy Officer ("CPO"), and Chief Information Officer ("CIO"). We have also established a Cybersecurity and Privacy Council, which is comprised of our senior management team, including our CEO. The Cybersecurity and Privacy Council meets on a quarterly basis with the CISO, CPO and CIO to keep our CFO, General Counsel and other executive leadership informed of cybersecurity activities and new risks and requirements. The objective of this council is to review, discuss, and manage cybersecurity and privacy risks and threats, prioritize risks, monitor risk mitigation progress, advise and update on the evolving legal landscape, as well as provide visibility into ongoing activities and programs.


text: The Board of Directors provides oversight and has designated primary responsibility to the Audit Committee who oversees our information security programs including cybersecurity and is actively involved in monitoring the progress of key cybersecurity initiatives. The CISO manages the cybersecurity program in collaboration with the CIO, CPO, and our business leaders. The CISO provides updates to the Audit Committee quarterly, including progress on the cybersecurity initiatives, risk trends and scores, and any cybersecurity incidents. Executive leadership and the Board of Directors are regularly informed and updated on any potentially material incidents.


text: We also created a SCRDC composed of members from cybersecurity, privacy, legal, audit, and finance teams. This committee's objective is to review and discuss the nature of cybersecurity and privacy incidents and determine impact and materiality.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CISO, CPO, CIO, and VP of Global IT Security. Our security, privacy, and IT leaders have extensive relevant work experience in various roles which includes developing cybersecurity strategy, implementing effective information and cybersecurity programs, and implementing cybersecurity and privacy solutions. These leaders have relevant degrees and certifications, including Certified Information Systems Auditor, Certified Information Systems Security Professional, Fellow of Information Privacy, and Certified Information Privacy Professional. As described above, we have experienced professionals in the key roles of the CISO, CPO, CIO, and VP of Global IT Security. The cybersecurity and privacy offices are responsible for incident reporting and management, which includes cybersecurity threats. The Incident Response team, comprising key cross-functional professionals and stakeholders globally, meets weekly and as needed to identify, respond, contain, and coordinate events where activities threaten the security, confidentiality, integrity, and availability of our information, including client information and information systems.


text: Once an event materially impacts systems or data, these cross-functional professionals and stakeholders evaluate the incident using key factors (e.g., type and scope of information impacted, systems impacted, reputational impact) and promptly inform senior leadership, the Audit Committee and the Board of Directors. Further, we may consult outside counsel or external advisors given the circumstances and situation (e.g., client, controls, location, or regulatory landscape).


text: Cybersecurity Risk Management and Strategy Cybersecurity is an important part of our overall risk management systems and processes and an area of focus for our Board and management. We have developed and implemented an enterprise-wide information security program designed to identify, protect, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity and privacy threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools; an internal continuous pen testing program; and a third-party pen testing program to allow security researchers to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors. We also maintain a third-party security program to identify, prioritize, assess, mitigate, and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful. Emerald's third-party security program is designed to mitigate cybersecurity risks associated with external service providers. This program includes conducting rigorous security assessments of potential third-party partners before onboarding, ensuring they meet our high standards for cybersecurity.

companyName: Emerald Holding, Inc.

ticker: EEX


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use widely adopted risk quantification models including those described in National Institute of Standards and Technology (NIST) special publications as well as the FAIR Institute's Factor Analysis of Information Risk (FAIR) methodology for Quantifying and Managing Risk to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, red team exercises, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We also engage an external firm to assist in our annual Payment Card Industry Data Security Standard (PCI DSS) self-attestation of compliance, as well as third-party penetration testing of our cardholder environment and related systems. We continuously enhance our cybersecurity measures by providing ongoing training for our employees, including simulated phishing exercises, to ensure they are fully prepared to address potential threats. The results of these assessments are reported to the Audit Committee as discussed below under "--Cybersecurity Governance."


text: In the last ten years, we have not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "We face continually evolving cybersecurity and similar risks, which could result in loss, disclosure, theft, destruction or misappropriation of, or access to, our confidential information and cause disruption to our business, damage to our brands and reputation, legal exposure and financial losses," which is incorporated by reference into this Item 1C.


text: Cybersecurity Governance The Board oversees our annual enterprise risk assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats. Specifically, our Audit Committee is responsible for the oversight of risks from cybersecurity threats and receives regular updates from senior management including our Chief Information Officer and Director of Cyber Security, on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. Our cybersecurity protocol requires that the Chair of the Audit Committee and senior management be immediately notified upon any cybersecurity incident.


text: Our Chief Information Officer, who has over 20 years of experience in the cybersecurity and information security space, leads our global information security team responsible for overseeing the Emerald information security program. We also have a Director of Cyber Security who brings 24 years of experience in the information technology field, including 15 years of direct experience in cybersecurity. In addition, the team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies. This team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments, and findings.


text: We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; customer attrition; and reputational risks. We have implemented several cybersecurity processes, technologies and controls to aid in our efforts to assess, identify and manage such material risks.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: Risk Management and Strategy Our cybersecurity specific risk assessment process, helps identify our cybersecurity threat risks by comparing our cybersecurity program to industry standards and best practices standards set by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and the Center for Internet Security ("CIS"), as well as by annually engaging experts to attempt to infiltrate/test our information systems (as such term is defined in Item 106(a) of Regulation S-K).


text: We have established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our senior leadership and executive team on a monthly basis. We have established an information security risk committee, chaired by our chief information security officer ("CISO") and comprised of employees and executive management, to, among other things, coordinate and communicate the direction, current state, security risks (gaps) and governance of our information security program. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: To identify and assess material risks from cybersecurity threats, our Cybersecurity Governance, Risk and Compliance ("GRC") team considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity and potential mitigations.


text: We employ a range of tools and services including (but not limited to) regular network and endpoint monitoring, vulnerability assessments and penetration testing to inform our professionals' risk identification and assessment.


text: Technical Safeguards We regularly assess and deploy internal and third party technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: Incident Response and Recovery Planning We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address and guide our employees, management and board of directors on our response to a cybersecurity incident.


text: Third-Party Risk Management Our cybersecurity risk processes address risks associated with our use of third-party service providers, including those in our "supply chain" (subservice organizations). Third-party risks are included within our GRC and procurement program, including the selection and oversight of our third-party service providers.


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: External Assessments We perform periodic internal and third-party assessments to test our cybersecurity controls and regularly evaluate our policies and procedures for handling and control of sensitive data and systems, in an effort to identify areas for continued focus, improvement and/or compliance (e.g., SOC, SOX, PCI, HIPAA).


text: Board's Oversight Role Cybersecurity is an important part of our risk management processes and an area of continued focus for our board of directors, audit committee and management. Our board of directors is responsible for the oversight of the overall corporate approach to cybersecurity risks. The board of directors has delegated such enterprise and cybersecurity risk management to its audit committee. At least quarterly, the audit committee and/or board of directors receives an overview from management of our cybersecurity threat risk management and strategy, covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan and any material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.


text: Under its charter, the audit committee is charged with discussing our major financial, information technology and cybersecurity risk exposures and the steps management has taken to monitor and control such exposures as well as the oversight of management's plans to address such risks. A member of our audit committee and board of directors with a strong background in information technology and cybersecurity risk management through service in related senior executive positions of other publicly traded companies meets regularly with our CISO to discuss our cybersecurity risk management processes.


text: Management's Role Our cybersecurity program, which is discussed in greater detail above, is led by our CISO, who has over 20 years of prior work experience in various roles with large public companies involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. In addition, our CISO manages a team of highly trained and experienced cybersecurity professionals in support of the cybersecurity program.


text: Members of the audit committee and the board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management programs. Material cybersecurity threat risks are also considered during audit committee and/or board discussions of important matters such as enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions and other relevant matters.


text: Disclosure Controls and Procedures In addition to the information security risk committee discussed above, we maintain a disclosure committee with certain responsibilities that include among other things, the discussion of cybersecurity matters for materiality, proper internal reporting systems and incident disclosure evaluation. The disclosure committee also has a cybersecurity subcommittee that meets at least quarterly to discuss ongoing internal and external cyber-events, as well as mapping out the response process in the event of a cybersecurity incident that may reasonably be viewed as potentially material, including assessing the incident, materiality and disclosure obligations.


text: Cybersecurity Risks Notwithstanding the discussion above and our efforts to address cybersecurity risks, we cannot guarantee you that we can mitigate or eliminate all cyber-related risks, including those related to operational disruption; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; customer attrition; and reputational risks. We urge you to read our discussion regarding whether and how risks from identified cybersecurity threats could materially affect us as part of our risk factor disclosures at "Item 1A - Risk Factors"—Risks Related to Our Business and Industry" and "—Risks Related to Our Technology and Intellectual Property" of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: As a data-driven company, we may be a potential target for cyberattacks and may be exposed to a number of cybersecurity risks in the normal course of operations. Our success as a business may depend upon our ability to address these risks, and to keep our platform and internal systems secure for the benefit of our merchants, users, business partners, employees, and other stakeholders.

companyName: ContextLogic Inc.


text: In order to protect our customers' data - and any other data we manage or handle - we have adopted a number of safeguards and security measures. For example, we have implemented firewalls, endpoint protection, detection and response solutions, intrusion detection systems, access controls including multi-factor authentication, vulnerability scanning, software static analysis, dynamic analysis, third- party independent penetration testing, independent third- party control audits, a public bug bounty program. In addition, we have developed and maintained a robust Incident Response Plan ("IRP"), which is designed to equip our employees and managers with the necessary tools to detect, respond to, and ultimately prevent cybersecurity incidents affecting the platform.


text: Our IRP contains detailed processes and procedures to assist employees in managing cybersecurity incidents when they happen, including techniques for detecting/identifying suspicious activity in our data environment, response and escalation protocols to defend against intrusions and contain any potential data leakage, data preservation measures to ensure data integrity going forward, and remediation steps to diagnose root causes and secure gaps to prevent future attacks.


text: Our cybersecurity risk management program and our IRP is led by our Director of Security, who is supported by a multi-tier incident response team comprised of security, technical, and legal experts across our business who are responsible for coordinating and managing data security efforts, including incident response. This cross-functional team of specialists operates under the supervision of our executive management team with oversight from the Audit Committee of our Board of Directors and holds briefings to ensure the executive group is attuned to matters of data security impacting us. Our Director of Security has 14 years of experience working in the IT, infrastructure, and security domains. Before that, he worked for 6 years at Microsoft and 4 years at Garmin in similar roles.


text: Finally, the IRP is also supported by a full curriculum of training for engineering and non-engineering employees that is drafted and administered under the supervision of our Director of Security. Importantly, these training sessions include several modules and quizzes for both technical and non-technical employees to assist our employees in comprehensively understanding the importance of data security to our stakeholders and our business and the various ways they can promote a security environment throughout our Company.


text: Risk Management and Strategy Assessing and Responding to Cyber Threats and Cyber Incidents Our IRP sets forth the company's process for assessing cyber threats. The IRP serves as the incident response plan for Higher-Risk Security Incidents affecting Wish Information Systems and Wish Data, and it applies to all Wish personnel, including employees, contractors, consultants, and any other individuals acting for or on behalf of the Company of its subsidiaries or affiliated entities anywhere in the world. Lower-Risk Security Incidents are managed by the IT/Engineering Teams under their internal processes. The IRP assesses and responds to cyber threats by the following, to the extent applicable, (1) review from the initial assessment team, (2) escalation to a core incident response team, (3) involvement of the extended incident response team, (4) initial containment and preservation, (5) investigation, (6) breach notification, (7) remediation and resumption, and (8) post-mortem assessment.


text: As part of our IRP, we conduct regular testing to ensure that the IRP is functional and effective. Tests may include tabletop exercises, full simulations, verbal walkthroughs with relevant stakeholders, or responses to actual Security Incidents.


text: We also engage third-party services to conduct evaluations of our security controls, including the IRP, whether through penetration testing, independent cybersecurity audits or consulting on best practices to address new challenges and risks. These evaluations include testing both the design and operational effectiveness of security controls.


text: Proactively Managing Privacy Risks We also take several measures to proactively manage privacy risks. As part of our commercial contract review process, we require every third-party vendor ("vendor") engaged by the company to go through a separate privacy review. The privacy review includes, evaluating the personal data processed by the company and/or vendor, assessing the potential risks to such personal and applicable data subjects and identifying the specific measures that must be implemented to mitigate against such risks. One of these measures is to require vendors to agree to our standard Data Security and Privacy Addendum ("DPSA"), which was prepared with the assistance of outside consultants or revising the vendor's proposed Data Protection Agreement ("DPA") to provide the same protections as our DSPA. Wish's DSPA contains privacy preserving language and security controls to protect the Company in the event of a Security Incident.


text: Additionally, we've also appointed a Data Protection Officer ("DPO") who advises and monitors data protection functions at the Company. Our DPO has 15 years of experience working in cybersecurity, IT, governance, risk management, regulatory compliance, and data protection and privacy program design and implementation. Our DPO previously served as the DPO for several large companies, including ecommerce, life sciences, ESG, and legal services businesses. Our DPO is also a Certified Information Systems Security Professional.


text: Board and Management Oversight The Company's management is involved in assessing Security Incidents to the extent discussed in the IRP above. The Board and Audit Committee are notified and updated on any Security Incidents on a regular basis. The Board actively oversees our enterprise risk management, including cybersecurity risks. Our cybersecurity policies and procedures are integrated into our overall risk assessment program. Additionally, the Audit Committee is responsible for overseeing our cybersecurity risk management and strategy and regularly meets with the CTO about the Company's ongoing compliance and risk management and reports to the Board regularly.


text: Cybersecurity Threat Disclosure To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us. For further discussion of risks related to data protection, cybersecurity, and intellectual property, please see Item 1A, "Risk Factors".


text: Assessment, Identification and Management of Material Risks from Cybersecurity We recognize the importance of maintaining cybersecurity measures to safeguard our information systems and to protect the confidentiality and availability of information located on our information systems. Given this importance, we have integrated the consideration of operational risks related to cybersecurity into our enterprise risk management program, which is reviewed and updated annually and the results of this review are presented to the Board.

companyName: RAND CAPITAL CORP

ticker: RAND


text: Given the size and scope of our operations, RCM and our officers use a third-party IT service provider to assist the Corporation in assessing, identifying and managing the material risks from cybersecurity threats to the Corporation and in administering our IT systems. We believe that our third-party IT service provider has sufficient knowledge, experience and capabilities to effectively assist the Corporation on cybersecurity matters.


text: The Corporation's cybersecurity risk management systems processes, which are formalized in the Corporation's cybersecurity risk management policy, include security controls, monitoring systems, tools and related services, and oversight from each of RCM, our officers and our third-party IT service provider in assessing, identifying and managing risks from cybersecurity threats. The Corporation, through our third-party IT service provider, has implemented and expects to continue to implement risk-based controls designed to prevent, detect and respond to information security threats. We rely on these controls to help us protect our information, our information systems, and the information of third parties who entrust us with their sensitive information.


text: The Corporation's cybersecurity risk management policies include physical, administrative and technical safeguards, as well as plans and procedures designed to help the Corporation seek to prevent and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us or RCM. In addition, our cybersecurity risk management programs include periodic identification and testing of our vulnerabilities and cybersecurity awareness training. Finally, our Chief Compliance Officer conducts an annual due diligence review, including as to cybersecurity matters, of those third-party service providers that have possession of the Corporation's material non-public information and reports the results of those assessments to the Board.


text: In the event of a cybersecurity incident impacting us, the Corporation's cybersecurity risk management policy provides processes for responding to such an incident and facilitates coordination among the Corporation's officers and our third-party IT service provider. Depending on the nature of the incident, it may also be reported to the Board, if appropriate.


text: Material Impact of Cybersecurity Risks In the last three fiscal years, we have not experienced a material information security breach incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors — Risks related to our Business and Structure — We are subject to cybersecurity risks and incidents that may adversely affect our operations, the operations of RCM or the companies in which we invest. A failure in our, or RCM's, cybersecurity systems could impair our ability to conduct business and damage our business relationships, compromise or corrupt our confidential information and ultimately negatively impact business, financial condition and operating results."


text: Oversight of Cybersecurity Risks Our cybersecurity program is managed by the officers of Rand and RCM, and is primarily administered by our experienced third-party IT service provider. The officers of Rand and our third-party IT service provider are in regular communications as a means to discuss and determine actions to be taken by the Corporation with respect to our ongoing cybersecurity risk mitigation efforts.


text: The Board, as a whole, rather than any committee of the Board, has responsibility for oversight and review of cybersecurity matters with respect to the Corporation, including the risks from cybersecurity threats to the Corporation. Our Chief Compliance Officer reports to the Board on a semi-annual basis, or more frequently if necessary, on cybersecurity matters and developments applicable to the Corporation. In addition, the Board also receives periodic reports from the Corporation's third-party IT service provider. These reports, whether from the Chief Compliance Officer or the Corporation's third-party IT service provider, include updates on the Corporation's cybersecurity programs, the external threat environment, and the Corporation's programs and processes to address and mitigate the risks associated with the evolving cybersecurity threat environment. In addition, these reports also include updates on the Corporation's overall IT systems and capabilities and the Corporation's business continuity plan that may need to be activated if a material cybersecurity incident involving the Corporation were to occur. In the event of a material cybersecurity incident, our Chief Compliance Officer would make a report to the Board regarding the event, and the Board would engage in oversight responsibility with respect to the Corporation's response to such event.


text: We understand the importance of preventing, identifying, assessing and managing material risks associated with cybersecurity threats. Cybersecurity processes to identify, assess and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process and are designed to help protect our information assets and operations from internal and external cyber threats and protect employee and patient information from unauthorized access or attack, as well as secure our network and systems. We have implemented into our operations these cybersecurity processes, technologies and controls to identify, assess and manage material risks. Specifically, we engage a third-party cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic internal and external penetration testing by an independent cybersecurity firm to inform our risk identification and assessment of critical, high, medium and minor material cybersecurity threats.

companyName: Dyne Therapeutics, Inc.

ticker: DYN


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: • Monitor evolving cybersecurity standards and emerging data protection laws and implement changes to our processes to comply; • Conduct annual policy re-certifications for all employees regarding data protection, data breach reporting requirements and data classification; • Employ multifactor authentication on internal and external systems; • Conduct regular phishing email simulations for all employees; and • Carry cybersecurity risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities that we and our third-party cybersecurity providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: As part of the above processes, we engage with subject matter expert consultants to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: Our processes also include assessing cybersecurity threat risks associated with our use of third-party services providers in normal course of business use, including those in our supply chain or who have access to patient and employee data or our systems. Third-party risks are included within our risk management process discussed above. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, cybersecurity threats may affect our business. See "Our internal information technology systems, or those of our vendors, collaborators or other contractors or consultants, may fail or suffer security breaches, loss or leakage of data and other disruptions or compromise, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, trigger contractual and legal obligations, potentially exposing us to liability, reputational harm or otherwise adversely affecting our business and financial results." in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: The Audit Committee of the Board of Directors is responsible for oversight of our cybersecurity risk assessment, risk management, incident response procedures and cybersecurity risks and provides updates to the Board of Directors regarding such oversight. Periodically during each year, the Audit Committee receives an overview from our Vice President, Head of Technology of our cybersecurity threat risk management and strategy processes, including potential impact on us, the efforts of management to manage the risks that are identified and our incident response preparations. Members of the Board of Directors regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk assessment, risk management and strategy programs.


text: Our cybersecurity risk assessment, management and strategy processes are led by our Vice President, Head of Technology. Our Vice President, Head of Technology has over 20 years of experience in various roles involving managing information security, managing privacy and data protection, developing cybersecurity strategy, and implementing cybersecurity programs. The Vice President, Head of Technology, a Certified Information Security Manager (CISM) with up-to-date credentials, is informed about and monitors the prevention, mitigation, detection and remediation of cybersecurity incidents through management of the cybersecurity risk management and strategy processes described above, including our incident response plan.


text: The Company's Board of Directors (the "Board") is responsible for overseeing the Company's risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") and are included in the Company's overall risk management system and processes. In general, the Company seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company's information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: Aptevo Therapeutics Inc.

ticker: APVO


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Company has information security and risk management policies and procedures designed to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of incidents in a timely manner. • Technical Safeguards: The Company implements technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. Additionally, the Company leverages an industry standard Endpoint Detection and Response (EDR) tool to manage and monitor endpoint security for laptops and servers including scanning and monitoring of vulnerabilities. Further, the Company has mandated multi-factor authentication for all employees in addition to periodic security and phishing training and awareness.


text: In 2023, the Company engaged an independent assessor to assess the maturity of its cybersecurity program against the NIST Cybersecurity Framework (NIST CSF). The results of the NIST CSF maturity assessment laid the roadmap for the cyber initiatives conducted in 2023 and future. Further, a third-party conducted an external and internal penetration test, performed a dark web scan for any Aptevo private and confidential data and assessed Aptevo's cloud security configuration posture. All critical and high-risk findings from that assessment were addressed in 2023.


text: • Incident Response and Recovery Planning: The Company has established and maintains security incident response and disaster recovery plans designed to address the Company's response to a cybersecurity incident. • Third-Party Risk Management: The Company leverages third-party vendors to house critical clinical trial data. These vendors are required to be GxP compliant which entails strong cybersecurity controls that are validated by a third-party auditor. Furthermore, the Company has begun performing security risk assessments prior to on-boarding new significant vendors. • Education and Awareness: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: The Board has designated the Audit Committee as the governing committee for the oversight of the Company's material IT cybersecurity risks. The Audit Committee reviews cybersecurity risks through quarterly updates, and the committee monitors the status of ongoing projects to strengthen existing information security controls and practices and mitigate the potential risk of cybersecurity incidents. Quarterly, the Company's Chief Financial Officer (CFO), with support from the expert firm providing Chief Information Officer (CIO) services, presents on material cybersecurity risks and their accompanying mitigation and remediation strategies to the Audit Committee.


text: The CIO and CFO are key management roles responsible for assessing and managing material risks from cybersecurity threats. The CIO reports to the CFO and is responsible for implementing and maintaining the enterprise cybersecurity organization. The CIO has over 20 years of experience in Information Security and Cybersecurity for public and private institutions in the pharmaceutical, insurance, manufacturing, healthcare, and non-profit industries. The CFO also brings over 20 years of experience with a focus on small to mid-size public companies in the life science and technology fields.


text: The CIO, in coordination with senior management including the CFO, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. The CIO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Cipher Digital Inc.

ticker: CIFR


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • individuals, including employees and external third party service providers, who are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Cyber-attacks, data breaches or malware may disrupt our operations and trigger significant liability for us, which could harm our operating results and financial condition, and damage our reputation or otherwise materially harm our business."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Technology Officer (CTO), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a security incident response plan.

companyName: Seres Therapeutics, Inc.

ticker: MCRB


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a security incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, "Risk Factors— Risks Related to Our Operations—Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."


text: The Audit Committee receives quarterly reports from our Chief Information Officer, or CIO, on our cybersecurity risks. In addition, our CIO updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team, including our CIO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO has over three decades of IT experience in life sciences organizations. Her cybersecurity work includes the development and implementation of cybersecurity policies, platforms, and robust end-user training curriculums. Our CIO and IT Information Security Group work together to monitor and report cybersecurity trends and threats to management. Additionally, we work with an external IT partner and external cybersecurity counsel to assess, identify, and manage risks from cybersecurity threats. The IT Information Security Group undertakes table-top business disruption, disaster recovery and related response strategies, and plans on a periodic basis, and aims to review, and if appropriate update, applicable policies and procedures annually.


text: Our management team and IT Information Security Group supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, and processes are being integrated into the Company's ERM program and based on recognized frameworks and industry standards, including the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of Company and customer systems, information, and products.

companyName: CECO ENVIRONMENTAL CORP

ticker: CECO


text: The Company has engaged third-party cybersecurity service providers and leverages leading technologies and expertise to monitor, maintain, and provide 24/7 managed detection and response capabilities for coordination, escalation and remediation of alerts associated with information technology systems utilized by the Company.


text: Risk Management and Strategy The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity program as necessary based on the information provided by these assessments, audits, and reviews.


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, and third-party and independent reviews. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the Company's Vice President of Information Technology (the "VP of IT").


text: The VP of IT reports to the Chief Financial and Strategy Officer and is the head of the Company's cybersecurity team. Through ongoing communications, the VP of IT and the Executive Leadership Team, which includes our Chief Executive Officer, Chief Financial and Strategy Officer, and Chief Administrative and Legal Officer, monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.


text: The VP of IT has served in various roles in information technology and information security for over 25 years, including leading the cybersecurity programs for three public companies. The VP of IT holds undergraduate and graduate degrees in business and has attained multiple cybersecurity certifications including Certified Information Security Manager.


text: Cybersecurity threats, including those as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For more information on our cybersecurity related risks, refer to "Part I, Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: Cybersecurity Risk Management and Strategy The Company is externally managed by the Advisor and has no employees or internal information systems. Thus, the Company relies on the Advisor, BlackRock, Inc. ("BlackRock") as well as the custodian and other service providers to protect the Company's information from cybersecurity threats. The Company's chief compliance officer (the "CCO") oversees the Company's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board of Directors. The CCO and the Advisor also review key Company service providers' compliance and risk management policies and procedures related to cybersecurity matters, evaluate such service providers' use of information systems, which have the potential to subject the Company to information technology vulnerabilities, and receive reports from the Company's service providers regarding any cybersecurity threats and incidents.

companyName: BlackRock Capital Investment Corp


text: Specifically, the Company relies on the enterprise risk management ("ERM") framework of BlackRock, Inc. ("BlackRock") for the Company's cybersecurity risk management and strategy. The Board of Directors of the Company periodically receives reports from BlackRock and from the Advisor regarding BlackRock's cybersecurity program. Key aspects of the ERM framework are summarized below.


text: BlackRock's Enterprise Risk Management Framework BlackRock recognizes the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Cybersecurity represents an important component of BlackRock's approach to ERM. BlackRock leverages a multi-lines-of-defense model with cybersecurity operational processes executed by global information security and other teams and dedicated internal audit technology and technology risk management ("TRM") teams that independently review technology risks. BlackRock's cybersecurity program is fully integrated into its ERM framework and is aligned with recognized frameworks, including NIST CSF, FFIEC CAT, FedRAMP, SOC 1/2, ISO 27001/2 and others. BlackRock aims to inform and continuously improve its cybersecurity program through engagement with regulatory, client, insurer, vendor, partner, peer, government and industry organizations and associations, as well as external audit, technology risk, information security and other assessments.


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's board of directors (BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC"). • Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks. • Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls; perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention; tabletop exercises, ongoing vulnerability and patch management; vendor due diligence; multi-factor authentication; device encryption; application security, code testing and penetration testing; endpoint security, including anti-malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges; employee awareness, training, and phishing testing; data loss prevention program and monitoring; information security incident reporting and monitoring; and layered and comprehensive access controls. • Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis. • Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third-party systems. Operational incidents can arise as a result of failures by third parties with which BlackRock does business, such as failures by internet, communication technology and cloud service providers or other vendors to adequately follow processes and procedures, safeguard their systems or prevent system disruptions or cyber-attacks. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence..


text: • Education and Awareness: BlackRock's employees and contractors are required to complete an annual information security training to equip them with effective tools to address cybersecurity threats, and to receive communications on BlackRock's evolving information security policies and procedures.


text: BlackRock's global information security team, in collaboration with the technology risk and internal audit teams, engages in the periodic assessment and testing of BlackRock's cyber risks and cybersecurity program. These efforts may include a wide range of activities, including audits, assessments, wargames and "tabletop" exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. BlackRock also participates in financial services industry and government forums in an effort to improve both internal and sector cybersecurity defense. BlackRock regularly engages third parties and advisors to assess its cybersecurity control environment. The results of certain program and control assessments are reported to the Risk Committee, and BlackRock adjusts its cybersecurity program as appropriate based on the information provided by these assessments.


text: As of December 31, 2023, the Company is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.


text: Cybersecurity Governance The Board of Directors of the Company periodically receives reports from BlackRock and from the Advisor regarding BlackRock's cybersecurity program. The CCO delivers quarterly reports to the Board of Directors of the Company. Team members who support the Company's information security program have relevant educational and industry experience.


text: At the BlackRock parent level, BlackRock's Board is actively engaged in the oversight of BlackRock's risk management program. The Risk Committee assists the Board with its oversight of BlackRock's levels of risk, risk assessment, risk management and related policies and processes, including risks arising from cybersecurity threats. The Risk Committee receives regular reports on BlackRock's cybersecurity program, technology resilience risk management and related developments from members of our information security team, including the CISO. The Board and the Risk Committee also receive information regarding cybersecurity incidents that meet certain reporting thresholds. On an annual basis, senior members of BlackRock's technology, risk and information security teams provide a comprehensive overview of BlackRock's cyber risk and related programs to a joint session of the Board's Risk and Audit Committees.