text: With respect to management, our CIO, who reports directly to our chief executive officer, has over 20 years of experience with our company, including more than 10 years serving in technology-based leadership roles. Our VP, Infrastructure, Operations & Security, who reports directly to the CIO, serves as our ISO and has extensive cybersecurity experience gained from over 20 years serving in security-related roles for the Company. Our ISO, together with our technology management security team, is responsible for developing, maintaining and enhancing systems and processes necessary to protect confidential information from loss, theft, and unauthorized access or use. This team also monitors the systems and networks to detect unauthorized activity or access, responding to any such unauthorized attempts to mitigate loss or to ensure the cessation of all unauthorized access to data. If an incident is identified, this team reports such events to the CIO, who will then, as appropriate, advise the chief executive officer, chief legal officer and other management, as well as others, potentially including law enforcement or clients. We have also established a Risk Committee consisting of members of our finance, legal and technology management departments whose duties include assessing the materiality of any identified incidents to help ensure compliance with the SEC's cybersecurity incident disclosure rules.


text: We are increasingly dependent on sophisticated software applications and computing infrastructure to conduct key operations. We depend on both our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors, and other business partners.

companyName: EyePoint, Inc.

ticker: EYPT

secItem: Item 1C


text: Cybersecurity Program Given the importance of cybersecurity to our business, we maintain a robust cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of administrative, physical, and technical safeguards with regular evaluations of our cybersecurity program, including periodic internal and external audits, penetration tests, and incident response simulations. We also require cybersecurity training when onboarding new employees and contractors, as well as required cybersecurity awareness training for our employees and contractors/other workforce members. Our program leverages industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) to strengthen our program effectiveness and reduce cybersecurity risks.


text: We use a risk-based approach with respect to our use and oversight of third-party service providers. We use a number of means to assess cyber risks related to our third-party service providers, including maintaining vendor questionnaires/conducting due diligence in connection with onboarding new vendors and engaging in periodic reviews thereafter as appropriate.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain a regularly tested incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, and handling it in accordance with that severity level. We have relationships with a number of third-party service providers to assist with cybersecurity containment and remediation efforts.


text: Upon a notification of concerning factors which may be indicative that a notable cybersecurity incident has occurred, the Cyber Security Subcommittee (Cyber Security Subcommittee) consisting of the Chief Legal Officer, Chief People Officer & SVP of IT, Associate General Counsel, Head of Information Technology, and a member of the Financial Reporting team, meets to make an initial assessment. If the Cyber Security Subcommittee determines there is a reasonable likelihood a notable cybersecurity incident has occurred, then notice will promptly be given to certain members of the Company Executive Team including our President/Chief Executive Officer, Chief Financial Officer, Chief Legal Officer & Corporate Secretary, and Chief People Officer/SVP of IT.


text: Our team leverages over 25 years of experience in various cyber security functions. Our SVP of IT, and her team, is responsible for the day-to-day management of the cybersecurity program.


text: The SVP of IT provides periodic briefings for our senior management team on cybersecurity matters, including the prevention, detection, mitigation, and remediation of cybersecurity incidents and cybersecurity threats.


text: While the Board of Directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, discussing with management, and overseeing the Company's cybersecurity and privacy risk exposures and policies. On a quarterly basis, the SVP of IT reports to the Audit Committee on information technology and cybersecurity matters, including key information technology risks. The SVP of IT also apprises the Audit Committee and full Board of Cyber Security Incidents consistent with our incident response program, promptly.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management ("ERM") process. As part of our ERM process, department leaders identify, assess, and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. Department leaders are asked to consider the severity and likelihood of certain risk factors, drawing upon their company knowledge and past business experience. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors." To date, we have not experienced any material cybersecurity incidents or threats.


text: Cybersecurity Risk Management and Strategy The Company has implemented information security programs to, among other actions, assess, identify and manage material risks from cybersecurity threats. These programs include periodic risk assessments, firmwide testing initiatives, periodic phishing tests and annual audits. As the Company assesses its risks and determines how to implement risk management programs, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. The Company also utilizes an independent cybersecurity advisor to provide periodic objective assessments of the Company's capabilities and to conduct advanced attack simulations.

companyName: PREFORMED LINE PRODUCTS CO

ticker: PLPC


text: Further, as of part of the Company's overall information security program, the Company conducts a security awareness program, which includes training that reinforces the Company's security management policies, standards, and practices, as well as the expectation that employees comply with these policies, standards and practices. The Company's security awareness program engages personnel through mandatory periodic training on identifying potential cybersecurity risks and protecting the Company's resources and information. The Company also annually engages third parties (as well as its internal audit department) to audit the Company's information security programs. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and ongoing monitoring.


text: To date, there has not been any previous cybersecurity incident that has materially affected the Company's business strategy, results of operations or financial condition.


text: See Item 1A. Risk Factors under the heading of "The Company employs information technology systems to support its business, and any material breach, interruption or failure may adversely impact the Company's business." for additional information on cybersecurity threats that could have a material impact on the Company. The Risk Factors section should be read in conjunction with this Item 1C.


text: Cybersecurity Risk Governance and Oversight The Company's Board of Directors maintains an active role in the Company's overall enterprise risk oversight to identify and mitigate broader systemic risks. The Audit Committee is responsible for overseeing and reviewing the Company's information security programs, including cybersecurity. The Director of Global Information Systems, who manages information security training and awareness program, updates the Audit Committee periodically regarding information security matters. The findings from the Company's annual third-party and internal information security audits also are reported to the Audit Committee. The Company also actively engages with key vendors and industry participants as part of its efforts, which are reported to the Audit Committee. In addition to the Audit Committee's oversight, the full Board of Directors receives periodic updates relating to information security and cyber security risks. The Board of Directors receives an annual report from its independent cybersecurity advisor.


text: The Director of Global Information Systems has had oversight responsibilities for PLP's information systems and cyber security for 15 years. He attends regular education programs regarding enterprise cybersecurity and supporting technologies. The Director of Global Information Systems reports to the CFO and coordinates with the IT resources across all subsidiary operations to discuss risk management initiatives, testing and training, recent trends and technological developments, and periodic reviews of third-party providers.


text: Governance Related to Cybersecurity Risks Our board of directors is involved in risk oversight through its attention to our overall business strategy, and it has delegated oversight of risk assessment and management to the audit committee. The audit committee administers its risk oversight function by receiving periodic reports from members of senior management. Our audit committee discusses cybersecurity threats and our risk management processes at least annually, receives updates on relevant developments, and considers steps that our management has taken to monitor and seek to address risk exposures. The full board of directors also discusses with management our major risk exposures, their potential impact on us, and the steps we take to manage them.

companyName: Damora Therapeutics, Inc.

ticker: DMRA


text: Our Information Technology Administrator, working with and through external vendors, including our outsourced Data Protection Officer, implements and administers our information security processes. Our Information Technology Administrator, in conjunction with the Data Protection Officer, provides regular reports to our Chief Financial Officer and General Counsel on cybersecurity risks and the implementation of risk management processes.


text: Cybersecurity Risk Management and Strategy Our processes to identify, assess, and manage risks presented by cybersecurity threats are informed by industry cybersecurity standards, including components of the National Institute of Standards and Technology Cybersecurity Framework, ISO 27001 standard, and Health Insurance Portability and Accountability Act ("HIPAA") security regulations. Our cybersecurity management processes have included an assessment to identify key risk areas and to inform our overall strategy, as well as cybersecurity assessments in connection with our review of key financial systems. Our processes also include technical controls, such as network monitoring tools and multi-factor authentication, where appropriate, and we engage reputable vendors to host sensitive company information. Before contracting with such vendors or purchasing third party technology or other solutions that involve exposure to sensitive company information, we conduct due diligence on the vendor, which includes a security review, and we receive and review security updates and alerts from these vendors. We have also implemented annual training for employees as well as phishing and other attack simulations as part of our cybersecurity readiness processes.


text: We have established an incident response process to identify, assess, and respond to cybersecurity events, if any. This process includes established roles, responsibilities and procedures to guide incident response operations, and reporting procedures for notifying members of management and the audit committee, where appropriate. We also maintain back-ups and disaster recovery plans to restore information in the event of an incident. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please see "Item 1A, Risk Factors."


text: We rely on digital technology to conduct our businesses and interact with customers, policyholders, agents, and vendors. With this reliance on technology comes the associated security risks from using today's communication technology and networks.

companyName: HCI Group, Inc.

ticker: HCI


text: Risk Management and Strategy The goal of our cybersecurity risk management strategy is to protect the privacy, integrity, and availability of our critical systems and information. Our processes identify, assess, and manage material risk from cybersecurity threats as part of our entity-wide risk management efforts. To safeguard our data and the data of our customers, management utilizes a multi-layered approach consisting first of an external security operations center company that specializes in the detection and containment of cyber-attacks. For protection of endpoint devices connected to our network, we use the tailored security software of a third-party consultant company for managed detection and response. Perimeter defense technology is used to filter e-mail for threats from malware viruses and e-mail phishing attempts. We also detect threats through the use of our firewalls that monitor incoming and outgoing network traffic.


text: Tools utilized to prevent threats include multifactor authentication, e-mail security services, mobile e-mail security policies, virtual private networks, third-party security experts, and timely applied software patches, among others. We engage in annual penetration testing, disaster recovery testing, internal and external audits of our cybersecurity controls and simulated cyberattack scenarios to gauge our preparedness for these situations. In addition, employees are required to pass a mandatory cybersecurity training course annually and receive periodic phishing simulations to facilitate recognizing phishing attempts. We carry Cyber Insurance which includes access to a Cyber Incident Response team in the case of a cybersecurity event.


text: Management of cybersecurity also extends to third-party service providers we use for specialized purposes such as payroll processing, investment tracking, regulatory financial reporting, and equity compensation plan administration. Our communication with these providers is protected by the safeguards within our security operation center. In addition, we annually obtain a Service Organization Controls (SOC) report on the suitability and operating effectiveness of the providers' controls, known as a SOC 1 Type 2 Report. The report is prepared by an independent service auditor. We review such reports to confirm the existence of effective controls over unauthorized access at third party service providers.


text: We respond to cybersecurity events in accordance with our Cyber Security Incident Response Plan (CSIRP), which follows the guidance of the National Institute of Standards and Technology Cybersecurity Framework and provides for assessment, mitigation, and if necessary, remediation of any effects of a system breach. We also conduct annual breach simulations with internal information technology teams to test each step of our CSIRP.


text: There have been no cybersecurity events in the past that have materially affected the Company's business strategy, results of operations, or financial condition. Although we believe our defenses against cyber-intrusions are sufficient, we continue to update our prevention programs to respond to sophisticated and rapidly evolving attempts to overcome our security measures. Such continuing threats could have a variety of adverse business impacts. See Item 1A – "Risk Factors" under the heading "Security and fraud risks" above for additional information on risks to our business from cybersecurity incidents and related matters.


text: Cybersecurity is a critical component of our overall risk management process. Our Board of Directors oversees our cybersecurity efforts as delegated to and performed by senior management which is responsible for the identification and assessment of material risks from cybersecurity incidents. The members of management responsible for managing cybersecurity threats are HCI Group's Director of Information Technology (IT) and its Network Security Manager, and the Chief Operating Officer of Exzeo USA, Inc., TTIG's software development and IT company. Both the Director of IT and the Chief Operating Officer have extensive experience in managing information systems including the defense of computer networks against cyber intrusions. The Network Security Manager is dedicated to overseeing our multi-layered cybersecurity defenses and leads monthly security meetings attended by IT managers.


text: Our Board receives periodic reports on cybersecurity risks and any material cybersecurity incidents. One member of our Board of Directors, Paresh Patel, has information technology expertise.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our development programs and clinical trials (Information Systems and Data).

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: Our Information Technology (IT) department and IT Director, with the assistance of our legal department and CFO, help identify, assess and manage our cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating our and our industry's risk profile, evaluating threats reported to us and coordinating with law enforcement about such threats as may be appropriate, conducting internal and external audits, conducting internal threat assessments to evaluate for both internal and external threats, having third parties conduct threat assessments, and conducting vulnerability assessments designed to identify vulnerabilities.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, our incident response policy; incident detection and response processes; a vulnerability management policy; a disaster recovery plans; risk assessments; encrypting certain data; network security controls; segregating certain of our data; maintaining access and physical controls; asset management, tracking and disposal; systems monitoring; employee training; penetration testing conducted by third parties; maintaining cybersecurity insurance; and having dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program; (2) the IT department and IT Director discuss cybersecurity risk with management, including our CFO and legal department to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports certain risks to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms (including legal counsel), cybersecurity consultants, cybersecurity software providers, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as hosting companies, contract research organizations (CROs), and contract manufacturing organizations (CMOs). We have processes to manage cybersecurity risks associated with our use of certain of these providers. These processes include reviewing certain vendors' written security program and security assessments, and imposing certain contractual obligations related to cybersecurity on the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management processes may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see the section of this Annual Report on Form 10-K titled "Risk Factors", including, but not limited to, the risk factor titled "If our internal information technology systems or sensitive information, or those of our third-party CROs or other contractors or consultants, are or were compromised, we could experience adverse consequences from such compromise, including but not limited to, a material disruption of our product candidates' development programs, regulatory investigations or actions, litigation, fines and penalties, reputational harm, loss of revenue or profits, and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our personnel, including our IT Director, who has 20 years of experience in IT and cybersecurity and is a member of the Information Systems Audit and Control Association (ISACA).


text: Our IT Director is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO is responsible for approving budgets and, along with our IT Director and our legal department, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability and patch management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CEO, CFO and General Counsel. Such management members work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from our IT Director concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing risk from cybersecurity threats. We periodically assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. Following these risk assessments, we evaluate how to reasonably address any identified gaps in existing safeguards and monitor the effectiveness of our safeguards. We devote resources and designate high-level personnel, including our Chief Business and Legal Officer, who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: Lexeo Therapeutics, Inc.

ticker: LXEO


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, including our cybersecurity safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage specialized third parties in connection with our risk assessment processes. These third parties assist us in designing and implementing our cybersecurity policies and procedures, as well as in monitoring and testing our safeguards.


text: We also require key third-party service provider with access to our IT environment to certify on a contract-by-contract basis that they have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of their security measures that may affect our company.


text: We have not previously experienced any cybersecurity risk or cybersecurity incident which has been determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors" in this Annual Report on Form 10-K, including the risk factor entitled "Our business and operations would suffer in the event of system failures, cyberattacks or a deficiency in our or our CMOs', CROs', manufacturers', contractors', consultants' or collaborators' cybersecurity".


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our Executive Officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through our audit committee.


text: Our Chief Business and Legal Officer and our security governance steering committee, which includes our Controller, Vice President of HR, Vice President of Program Management and Manager of IT/IS, are primarily responsible for assessing and managing our risks from cybersecurity threats. Our Chief Business and Legal Officer has more than a decade of operational experience overseeing and advising on risk management in the highly regulated biopharmaceutical industry, and leads a wide range of business functions, including IT/IS. Our Manager of IT/IS has over 20 years of experience with IT, with an emphasis on cybersecurity over the past two years. They and other members of our security governance steering committee engage in training and education relating to cybersecurity risk.


text: Our Chief Business and Legal Officer and our security governance steering committee oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Chief Business and Legal Officer and our management committee on cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through their work overseeing, working with, and delegating daily operations to the IT/IS team, as well as their work developing and implementing information security policies, consistent with the IT/IS processes. These policies are reviewed at least annually with updates authorized and approved by the security governance steering committee.


text: Our Chief Business and Legal Officer and representatives from our security governance steering committee provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our Chief Business and Legal Officer and representatives from our security governance steering committee provide annual briefings to the board of directors on cybersecurity risks and activities.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: CytomX Therapeutics, Inc.

ticker: CTMX


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our information technology systems, or those of our CROs or other contractors or consultants we may utilize, may fail, suffer disruptions or suffer security breaches, which could result in a material disruption of our product development programs."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from management and, where applicable, external experts, as part of our efforts to keep the Board updated on topics that impact similarly-sized biopharmaceutical public companies.


text: Our management team, including our Vice President, Information Technology, and senior information technology staff, collectively have more than 40 years of experience assessing and managing material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes information systems architecture, operations, cybersecurity, data privacy protection, quality, and regulatory compliance experience.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response and reporting plan.

companyName: BOX INC

ticker: BOX


text: Our cybersecurity risk management program includes: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • teams principally responsible for managing (1) our cybersecurity risk assessment and mitigation processes, (2) our security controls, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response and reporting plan that includes procedures for responding to cybersecurity incidents; • a team responsible for compliance with security and regulatory standards including but not limited to Service Organization Controls (SOC) reporting, International Organization for Standardization (ISO) frameworks 27001/27017/27018/27701, FedRAMP, and HIPAA; • the use of external service providers, where appropriate, to audit, assess, test or otherwise assist with aspects of our security controls, and to assist with the design and implementation of our cybersecurity policies and procedures; and • a third-party risk management process for service providers, suppliers, and vendors.


text: While we have technology and processes in place to detect and respond to cybersecurity threats, we are continually at risk from the evolving cybersecurity threat landscape. We do not believe our business strategy, results of operations or financial condition have been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: Cybersecurity Governance One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to our full Board regarding its activities, including those related to cybersecurity. Our Board of Directors also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our chief information security officer or external experts as part of the Board of Directors' continuing education on topics that impact public companies.


text: Our chief information security officer and chief compliance officer are responsible for assessing and managing our material risks from cybersecurity threats. They also have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes industry-specific expertise in SaaS technology, regulatory compliance knowledge, previous leadership roles in cybersecurity or related fields, as well as a track record of successfully implementing effective cyber risk mitigation strategies.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure We manage cybersecurity threats as part of our general risk mitigation, evaluation, and oversight processes. We implement our cybersecurity program internally through established policies, standards, and the use of enterprise security services that focus on emerging and ongoing cybersecurity risks. We manage these risks to our employees, customers, stockholders, and business partners through a coordinated and consistent IT risk management process overseen by the Senior Manager, IT who assumes the role of our Chief Information Security Officer ("CISO").

companyName: Sonendo, Inc.

ticker: SONX


text: Our information risk management framework is designed to manage and protect against risks in three broad categories: (i) operational risk; (ii) financial risk; and (iii) safety, environmental, and regulatory risk. We consider and evaluate reputational risk as an element of each of these risk categories.


text: We conduct regular security and awareness training for all new hires and for current employees. Employees are required to apply risk assessment processes and to professionally assess risks in the course of performing their job duties.


text: We conduct vulnerability scans of business critical systems on an annual, quarterly, and daily basis. We utilize external third parties to assist in assessing our systems, conduct scans and provide reports based on these scans and we address vulnerabilities as they are identified. We generally review current and prospective third party service providers for cybersecurity risks.


text: Management, under the supervision of our Chief Information Security Officer (CISO), is directly responsible for assessing and managing cybersecurity risks and otherwise implementing our cybersecurity program, which includes our Incident Response Policy and Incident Response Procedure. The CISO reports directly to our Chief Executive Officer. Our CISO has over ten years of IT experience and nine years of significant experience managing cybersecurity threats across our industry. The CISO may call upon business and legal stakeholders across our company to manage cybersecurity threats and incidents.


text: The audit committee of our board of directors is responsible for oversight of the company's programs, policies, procedures, and risk management activities related to information security and data protection. The audit committee meets regularly with CISO to discuss threats, risks, and ongoing efforts to enhance cyber resiliency, as well as changes to the broader cybersecurity landscape. Management promptly updates our board of directors regarding significant threats and incidents as they arise.


text: Risk management and strategy We have established and maintain various information security processes designed to identify, assess, and manage cybersecurity risks to our critical computer networks, third-party hosted services, communication systems, hardware, software, and vital data, such as intellectual property, confidential proprietary information, strategic assets, and nonclinical/clinical trial data ("Information Systems and Data"). Our Chief Operating and Financial Officer, Vice President of Information Technology, cybersecurity business partner and IT & Legal teams collaborate to address cybersecurity threats and risks, leveraging our risk register when needed. Our VP of Information Technology, members of our in-house IT team, and our third-party cybersecurity business partner all play an active role in monitoring and assessing risks from cyber threats through a variety of methods including automated tools, third-party testing, tabletop incident response exercises, threat actor analysis, industry risk profiling, and collaboration with law enforcement.

companyName: Olema Pharmaceuticals, Inc.

ticker: OLMA


text: We employ a range of measures, processes, standards, and policies tailored to specific environments designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include data encryption, network security controls, secure physical facilities, employee training, access management, change management and comprehensive asset management, tracking, and disposal procedures.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the security team, which includes our VP of Information Technology and third-party service providers, works with management to prioritize our risk management processes and take steps to mitigate cybersecurity threats that are determined to be more likely to lead to a material impact to our business. Key findings and status of the cybersecurity landscape are reviewed with the Audit Committee of our Board of Directors, or Audit Committee, which evaluates our overall enterprise risk.


text: We engage various categories of third-party service providers to augment our efforts in monitoring, identifying, assessing, and mitigating significant cybersecurity risks. These third-party service providers encompass a range of expertise, including professional services firms such as legal counsel, cybersecurity consultants with specialized knowledge, providers of cybersecurity software solutions, managed cybersecurity service providers offering ongoing monitoring, protection and support, external testing firms specializing items like penetration testing to evaluate vulnerabilities, and forensic investigators who are enlisted as necessary to conduct comprehensive investigations and assessments when specific incidents or breaches occur.


text: We enlist third-party service providers across our business functions, including application providers, hosting companies, contract manufacturers, and supply chain resources. Depending on the service type, data sensitivity, and provider identity, our vendor management process assesses cybersecurity risks and establishes corresponding contractual cybersecurity obligations, tailored to each provider's role and the nature of Information Systems and Data involved.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under "Part 1. Item 1A. Risk Factors" in this Annual Report on Form 10-K, including under the section titled "—Risks related to employee matters, managing our growth and other risks related to our business."


text: Our Board of Directors retains responsibility for evaluating key business risks faced by the Company, including but not limited to information security. In part, our Board of Directors addresses its general oversight function by delegating the Company's cybersecurity risk management to the Audit Committee. The Audit Committee's responsibilities include supervising risk mitigation efforts related to cybersecurity threats, evaluating the sufficiency and effectiveness of information security policies and practices, and ensuring robust internal controls for information security.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including our Vice President of Information Technology who has over 15 years of extensive experience managing cybersecurity programs, who reports into our Chief Operating and Financial Officer. The Vice President of Information Technology is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Chief Operating and Financial Officer is responsible for approving budgets, aiding in the preparation for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response procedures involve escalating specific incidents to certain members of management as needed, including the Vice President of Information Technology, Chief Operating and Financial Officer and the Chief Executive Officer. The Chief Operating and Financial Officer collaborates with our incident response team, which includes members of our in-house IT, facilities, human resources, regulatory, legal, and communications teams, to address and resolve reported cybersecurity incidents. Olema's incident response procedures mandate reporting certain types of cybersecurity incidents to the Audit Committee and other agencies as required by law.


text: The Audit Committee periodically receives reports from the Vice President of Information Technology on the Company's significant cybersecurity threats, risks, and mitigation processes. The Audit Committee also receives various summaries, presentations, and reports pertaining to cybersecurity threats, risks, and mitigation.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We periodically assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Oric Pharmaceuticals, Inc.

ticker: ORIC


text: We conduct annual risk assessments and penetration tests to identify cybersecurity threats, including assessments and tests with the assistance of independent third-party cybersecurity consultants. We also conduct assessments in the event of a material change in our business practices that may affect key information systems that are vulnerable to such cybersecurity threats. These assessments and tests are designed to assist in the identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following risk assessments and penetration tests, we work to re-design, implement, update, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and monitor the effectiveness of our safeguards.


text: As part of our risk management system, we also periodically provide company-wide cybersecurity training to our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage with external cybersecurity consultants to help design and implement our cybersecurity policies and procedures, as well as to monitor and test the effectiveness of our safeguards. The head of information technology (IT), supported by external cybersecurity consultants and the IT Department, implements our cybersecurity risk management system. The head of IT regularly reports on cybersecurity matters to the Chief Financial Officer.


text: We evaluate the security practices of certain third-party service providers to identify potential cybersecurity risks, including by reviewing documentation concerning their security measures. Where appropriate, including for third-party contracts under which our data will be stored, we contractually obligate providers to implement and maintain reasonable administrative, technical, and physical safeguards and other security measures designed to maintain the confidentiality, security and integrity of our data, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or incidents or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors has ultimate responsibility for oversight of cybersecurity risks, but primary responsibility for cybersecurity risk oversight has been delegated to the audit committee.


text: Our Chief Financial Officer and head of IT, advised by external cybersecurity consultants, are primarily responsible for assessing and managing our material risks from cybersecurity threats. Our head of IT has over 25 years of experience in information technology roles and over 8 years of experience in security roles in the biotechnology industry. Our Chief Financial Officer has approximately 7 years of experience overseeing IT-related processes (including cybersecurity processes).


text: The processes by which our Chief Financial Officer and our senior management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes regular updates from the head of IT to the Chief Financial Officer, as well as periodic reports, as needed, from the Chief Financial Officer and the head of IT to senior management.


text: Our Chief Financial Officer and head of IT provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides updates to the board of directors on such reports.


text: Cybersecurity Risk Management and Strategy As an externally managed REIT, the Company's risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Adviser, an indirect subsidiary of Apollo. Apollo determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for the Company and other affiliated entities managed by Apollo, and the Company relies on Apollo for assessing, identifying and managing material risks to the Company's business from cybersecurity threats.

companyName: Apollo Realty Income Solutions, Inc.


text: The Apollo Global Management, Inc. ("AGM") board of directors is involved in overseeing Apollo's risk management program, including with respect to cybersecurity, which is a critical component of Apollo's overall approach to enterprise risk management ("ERM"). Apollo's cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based, in part, on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas: • Governance: As discussed further under the heading "Cybersecurity Governance," the AGM board of directors has an oversight role, as a whole and at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer ("CISO") and the CISO of Athene Holding Ltd., a subsidiary of AGM, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, as well as, as appropriate, with the Company's executive officers and other representatives of the Adviser and its affiliates. • Collaborative Approach: Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with the Company's management and its board of directors, as applicable, in a timely manner. • Technical Safeguards: Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as the Company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.


text: Apollo engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. Apollo regularly engages third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to Apollo's risk management function, and Apollo adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Cybersecurity threat risks have not materially affected the Company, including its business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Organizational Structure—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, a misappropriation of funds, and/or damage to our business relationships, all of which could negatively impact our financial results."


text: Cybersecurity Governance The AGM board of directors' oversight of cybersecurity risk management is supported by the audit committee of the AGM board of directors (the "AGM audit committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. The AGM board of directors, the AGM audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from Apollo's risk management professionals, AGM's Chief Security Officer ("CSO"), its CISO, and other members of Apollo's management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from Apollo's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM's board of directors and/or the AGM audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM board of directors or the AGM audit committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from AHL's CISO, at least annually.


text: AGM's CSO holds an undergraduate degree in Management Information Systems and Business Administration, which he received magna cum laude. He has over 25 years of cyber-related experience, having served in various roles in technology and cybersecurity, including as Head of IT Risk Management, Executive Director of IT & Risk Compliance, and Global IT Risk Evaluation Lead at large financial institutions and consulting firms. He was also previously AGM's CISO for nearly eight years. AGM's CISO holds a master's degree in Business Information Systems and has served in various roles in information technology and information security for over 25 years across a number of large financial institutions, including as Director, Cybersecurity and Risk.


text: The AGM CISO, in coordination with the Apollo Technology and ERM teams, works collaboratively across Apollo to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of Apollo's cybersecurity risk management program, multidisciplinary teams throughout Apollo are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the AGM audit committee or AGM board of directors, as appropriate.


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of the Company's board of directors and the Company's board of directors, both the audit committee and board of directors regularly interact with, and receive reports from, management of the Company, the Adviser, Apollo, and other service providers. The audit committee of the Company's board of directors and the Company's board of directors receive presentations and reports on cybersecurity risks from AGM's CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Apollo's peers and third parties. Additionally, Apollo and other service providers periodically report to management as it relates to the Company's cybersecurity practices.


text: Apollo's cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to the Company's management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to the Company, the Adviser, and evaluation of the adequacy of the Company's cybersecurity program (as coordinated through the Adviser and Apollo), including risk mitigation, compliance and controls.


text: The Company has processes in place designed to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Investment Adviser and other third-party service providers. The Investment Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Commonwealth Credit Partners BDC I, Inc.


text: Cybersecurity Program Overview The Investment Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Investment Adviser, together with external consultants, actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company. The Company relies on the Investment Adviser's compliance and risk management program and processes, which include periodic review of the Investment Adviser's Cybersecurity Program. The Company depends on and engages various third parties, including service providers, to operate its business. The Company relies on its Chief Compliance Officer ("CCO") and the expertise of risk management, legal, information technology, and compliance personnel of the Investment Adviser when identifying and overseeing risks from cybersecurity threats associated with its reliance upon such third parties.


text: The potential impact of risks from cybersecurity threats posed to the Company are assessed on an ongoing basis, including how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition. Key third-party information security service providers, subject to the Adviser Committee's and Company CCO's oversight, continuously monitor and support the Adviser and Company information security control environment and breach notification processes. The Adviser's Committee, subject to the Company CCO's oversight, monitor best-practices and developments in data privacy and security, including increased scrutiny of third-party service providers having access to sensitive Company data.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the Investment Adviser regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Investment Adviser's operations, including those related to the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, and a Technology Risk and Information Security Committee (the "Committee") established by the Investment Adviser manage the Company's cybersecurity program. The CCO of the Company oversees the Company's oversight function generally and relies on the Investment Adviser's Committee to assist with assessing and managing material risks from cybersecurity threats. The Committee is chaired by an outside cybersecurity and information technology expert, and its other members are the Investment Advisors CFO/CCO, its General Counsel, and its Director of Information Technology. The CCO has been responsible for oversight of the Company's overall SEC compliance program, since the Company's inception and has worked in the financial services industry for more than 25 years, during which time the CCO has gained expertise in assessing and overseeing controls regarding risks applicable to the Company.


text: The Company's Senior Management team is regularly informed regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, and/or other comparable SEC regulated investment funds and their managers, including through the receipt of notifications from service providers and reliance on communications with operations, risk management, legal, information technology, and/or compliance personnel of the Investment Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Beachbody Company, Inc.

ticker: BODI


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security methods and controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: There can be no assurances that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or are effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any notable incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Security Officer (CSO), as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our CSO, Chief Financial Officer (CFO), Chief Operating Officer (COO) and Chief Legal Officer (CLO), are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program. Our management team works closely with our CSO who has over 20 years experience in information technology and operational technology security, and specialized training, including graduating from the Federal Bureau of Investigation Chief Information Security Officer Academy.


text: Our management team supervises efforts to help prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the technical environment.


text: Cybersecurity is a critical element of our information security program. Security controls are implemented in a manner that protects the confidentiality, integrity and availability of our information assets without hindering business operations. Management is responsible for the day-to-day administration of our cybersecurity policies, processes, and practices. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology (the "NIST") and management's knowledge of best practices in the cybersecurity industry. In general, we seek to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity and availability of our information systems or the information that we collect and store, by proactively monitoring for cybersecurity threats and assessing, identifying and managing cybersecurity issues as they occur.

companyName: Scilex Holding Co

ticker: SCLX


text: We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. Key elements of our cybersecurity risk management strategy include: • We require an annual Service Organization Control 2 Type 1 report from all third-party providers attesting to the presence of security processes. Additionally, we require that SaaS/PaaS providers perform risk assessments and manage the security risks associated with their services. • We have established and maintain a comprehensive incident response plan designed to address our response to a cybersecurity incident. We conduct regular training scenarios to test these plans and ensure personnel are familiar with their roles in a response scenario. • We provide regular, mandatory training for employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. • We use a third party to conduct a periodic assessment of our cybersecurity risk posture and maturity against the NIST Cybersecurity Framework. The results are evaluated by management and the Audit Committee and are used to adjust our cybersecurity policies, standards, processes and practices as necessary. • The company studies and evaluates threats in cyber landscape and aims to regularly improve our risk posture by learning from those lessons.


text: Our audit committee receives quarterly presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by other public companies.


text: The Director of IT acts as the Incident Manager and meets regularly with our Incident Response Team, including members of Financial Risk Management, IT Security and Human Resources senior management to discuss the necessary measures to take prior to and during an incident. In the event of an incident, the Incident Manager meets regularly with the executive leadership team and keeps them apprised of the status of any incident during the incident response. Our Board and the audit committee also receive prompt and timely information from the Director of IT and executive leadership regarding any cybersecurity risks that meet certain reporting thresholds, as well as ongoing updates regarding any such risk. Finally, the Incident Response Manager briefs corporate leadership on lessons learned from the incident during or after the recovery phase.


text: The Director of IT, in collaboration with a team of IT professionals, our legal counsel and Human Resources, are tasked with implementing a program designed to protect our information systems from cybersecurity threats and manage material risks. The Director of IT has served in various roles in information technology and information security for over 20 years. The Director of IT and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the audit committee when appropriate.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition as of December 31, 2023. For more information, please see the risk factor disclosures included in Item 1A of this Annual Report on Form 10-K.


text: As an externally managed company, our business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. We, in conjunction with our Manager, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. These processes include responses to and assessments of internal and external threats to the security, confidentiality, integrity and availability of our and our Manager's data and systems along with other material risks to operations. As part of its collective risk management process, our Manager engages a third party information technology consultant ("IT Consultant") to evaluate risks associated with the Manager's information and technology system(s), network and physical devices. Our Manager also uses the National Institute of Standards of Technology (NIST) Cybersecurity Framework to assess its cybersecurity controls.

companyName: Chicago Atlantic Real Estate Finance, Inc.

ticker: REFI


text: Our board of directors has responsibility for the direction and oversight of our risk management. Our board of directors administers this oversight function directly, with support from its committees. In particular, the audit committee of our board of directors (the "audit committee") has the responsibility to consider and discuss our major financial risk exposures and the steps our Manager takes, or is required to take, to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken. Our audit committee also monitors compliance with legal and regulatory requirements.


text: With respect to cybersecurity, the audit committee engages in discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. In addition, employees of our Manager and/or the IT Consultant will brief the audit committee on the Manager's information security program and cybersecurity risks at least annually, and will brief the audit committee as needed in connection with any potentially material cybersecurity incidents affecting the Company. Annual briefings of the audit committee by employees of the Manager and/or the IT Consultant may include topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Cyber Risk Management and Strategy We have adopted cybersecurity risk management activities and processes that are informed by and incorporate elements of recognized industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework, and that are designed to identify, assess, and mitigate critical risks from cybersecurity threats. We have, for example, implemented a process to monitor for potential critical risks from cybersecurity threats using automated tools. To support our cybersecurity risk management efforts, we leverage a managed service provider that provides ongoing support for the protection of our information technology infrastructure.

companyName: ImageneBio, Inc.

ticker: IMA


text: We have an employee security awareness training program, required upon onboarding and on an annual basis thereafter, that is designed to raise awareness of cybersecurity threats across functions, as well as to encourage consideration of cybersecurity risks across our company. As part of this employee training program, we periodically conduct phishing simulations designed to raise employee awareness of such risks.


text: We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers that may be critical to the operations of our business and who have access to our information systems or store our confidential clinical trial data, including, as appropriate, through review of System and Organization Controls reports and security questionnaires and the inclusion of cybersecurity requirements in relevant contracts.


text: As part of our cybersecurity risk management, we have adopted an incident response plan that has been designed to identify and manage significant events that may impact our information technology infrastructure, including those arising from or related to cybersecurity threats.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems and infrastructure. For more information, please see "Risk Factors."


text: Cybersecurity Governance Our Head of Information Technology ("Head of IT") is responsible for the establishment and maintenance of our cybersecurity risk management processes, including the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who is currently in this role has more than eight (8) years of experience in information security and over eighteen (18) years of IT experience in the biotechnology and pharmacology industr. Our Head of IT directly reports to, and meets periodically with, our Senior Vice President of Finance and Administration to discuss and review our cybersecurity risk management processes.


text: Our board of directors has delegated oversight of our company's cybersecurity risk management to our audit committee. The audit committee, pursuant to the audit committee charter, is responsible for reviewing our company's information security and technology risks (including cybersecurity), including high-level review of the threat landscape facing our company and our company's strategy to mitigate cybersecurity risks and potential breaches. We have recently implemented a process for our Senior Vice President of Finance and Administration and/or our Chief Financial Officer, as appropriate, to provide periodic updates to the audit committee on the status of our cybersecurity program and on an as needed basis.


text: We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect information from unauthorized access or attack, as well as secure our network and systems. Such processes include physical, procedural, and technical safeguards, response plans, regular tests on our systems, incident simulations, and routine review of our policies and procedures to identify risks and improve our practices. We engage certain external parties, including consultants, computer security firms and risk management, peer companies, industry groups, and governance experts, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them to help protect us from any related vulnerabilities. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber attacks, and other related breaches.

companyName: Inozyme Pharma, Inc.


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides periodic updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our Executive Director of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The Executive Director of Information Technology has over 25 years of experience working with life science companies and venture capital firms in the information technology field, a certificate from HarvardX (Cybersecurity: Managing Risk), and an active membership in Health-ISAC.


text: We have also established a cross-functional Cybersecurity Steering Committee, led by our Chief Executive Officer serving as the chair and consisting of other executive-level leaders, that is responsible for providing leadership in the protection of information assets and technology. The committee members advise on and prioritize the development of information security initiatives, projects, and policies as advocates for our stakeholders. This committee is also charged with helping to resolve security and compliance risk issues affecting us.


text: In order to help deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with a monthly data protection, cybersecurity, and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security, and educates employees on the importance of reporting all incidents immediately. We engage third-party vendors for 24/7 monitoring and comprehensive incident response measures. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.


text: Privacy Officer, in collaboration with the CISO, is required to review the IRP on at least an annual basis, which may include the incorporation of any lessons learned from prior incidents.

companyName: JONES FINANCIAL COMPANIES LLLP


text: The Partnership has an enterprise-wide business resiliency program, policy and framework to assist in planning for, and mitigating disruption to the Partnership's business operations from, incidents including cybersecurity events, through risk assessment, business impact analysis, response plan development, training, testing, and ongoing maintenance. The Business Resilience Department is responsible for creating and maintaining the Partnership's business resilience policy and framework and overseeing the program's implementation in collaboration with sponsors and leaders from the Firm's business areas. A Business Resilience Oversight Group comprised of general partners meets at least semi-annually and provides oversight of business resilience strategy, risk management, resources, performance, and integration into business processes. Elements of business continuity plans vary based on the nature of the processes involved and the impacts of the incident but can include planning related to human capital, real estate, third-party relationships and technology infrastructure. As part of its business resiliency planning, the Partnership has data centers in two geographically distinct locations and its third-party vendors have data centers in several regions of the United States. A prolonged interruption at any site or of critical systems or software may result in an extended delay of service to the Partnership's clients and substantial costs and expenses.


text: The Partnership, in the normal course of business, at times experiences cybersecurity threats and incidents affecting its data or systems or systems of third parties relied on by the Partnership, and the Partnership's programs and measures discussed above may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us in the future. The Partnership has not identified any previous cybersecurity incidents that have materially affected or are reasonably likely to have a material effect on its business strategy, reputation, financial condition or results of operations. For information on material risks of potential cybersecurity threats, refer to Part I, Item 1A – Risk Factors – Risks Related to Business Operations – Information Security Incidents and Fraud.


text: Risk Management and Strategy Peapack-Gladstone Bank's risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Peapack-Gladstone Bank's Information Security Officer is primarily responsible for cybersecurity and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to the Information Technology Steering Committee and Peapack-Gladstone Bank's board of directors.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: Our objective for managing cybersecurity risk is to avoid or minimize the impact of external threat events or other efforts to penetrate, disrupt or misuse Peapack-Gladstone Bank systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Peapack-Gladstone Bank's Information Security Officer and Chief Information Officer, who reports directly to the Chief Operating Officer, along with other key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of Peapack-Gladstone Bank's efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of Peapack-Gladstone Bank infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and Peapack-Gladstone Bank's supply chain. We also actively monitor our email gateways for malicious phishing e-mail campaigns and monitor remote connections as a significant portion of Peapack-Gladstone Bank's workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to Peapack-Gladstone Bank's information security program, to assess their design and operating effectiveness and make recommendations to strengthen the Bank's risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the Bank's Information Technology Steering Committee as well as the board of directors. The Incident Response Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of Peapack-Gladstone Bank's organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Peapack-Gladstone Bank's internal systems,processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected the Company, including its business strategy, results of operations, or financial condition.


text: Peapack-Gladstone Bank's Chief Information Officer, Chief Technology Officer, and Information Security Officer are accountable for managing and ensuring compliance with the Bank's information security program. Included in the responsibilities of this management team is the oversight and the administration of the cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience.


text: Peapack-Gladstone Bank's board of directors has approved management committees including the Information Technology Steering Committee, which focuses on technology and cyber related business impact. This committee provides oversight and governance of the technology program and the information security program. The committee is chaired by managers within the enterprise information technology department and include the Chief Information Officer, Chief Technology Officer, and Information Security Officer. The committee meets quarterly to provide oversight of the risk management strategy,standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings may occur to facilitate timely informing and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Bank's board of directors.


text: The Bank's board of directors are responsible for overseeing Peapack-Gladstone Bank's information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Peapack-Gladstone Bank's Information Security Officer, Chief Information Officer, and Chief Technology Officer provide reports to the Bank's board of directors regarding the information security program, technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The board of directors reviews and approves Peapack-Gladstone Bank's information security program, technology budgets, and strategies annually.