text: Risk Management and Strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our information and cybersecurity policies, processes, and practices. We maintain a Cybersecurity Incident Response Plan that establishes an incident response team led by our Head of Information Technology and describes our response protocol for cybersecurity incidents. To help protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Assessment of cybersecurity threats is included as part of our overall risk management processes.

companyName: IO Biotech, Inc.

ticker: IOBT


text: We have engaged consultants and other third parties to assist in our assessment of risks from cybersecurity threats and to evaluate our cybersecurity prevention and response systems and processes. At times, we may engage third parties to assist in the management and mitigation of a particular threat.

secItem: Item 1C


text: We are requiring each of our significant third-party service providers to agree that it will implement and maintain appropriate security measures in connection with their work with us, and promptly report any suspected breach of its security measures that may affect our company.


text: Our board of directors, as a whole and through the Audit Committee, is responsible for the oversight of risk management, including oversight of risks from cybersecurity threats, and discusses with management our major risk exposures, including from cybersecurity threats, their potential impact on us, and the steps we take to manage them.


text: Our Head of Information Technology, reporting to our Chief Financial Officer, has day-to-day responsibility for preventing, detecting, mitigating and remediating cybersecurity risks. The individual currently serving in this role has over twenty years of experience in information technology and cybersecurity. Our Head of Information Technology leads an incident response team that includes members of executive management, including members of our legal team, and is charged with assessing and managing material cybersecurity risks, and with notifying our executive management committee and disclosure committee of potential material cybersecurity incidents. Executive management provides updates on our cybersecurity risk profile to our Audit Committee on at least a quarterly basis.


text: Cybersecurity Threats As of the date of this report, we have not identified cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition. We and our third-party service providers have, however, been the target of cybersecurity threats and we expect these threats to continue. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Cybersecurity Program We have implemented a cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of safeguards, such as: password protection; multi-factor authentication; monitoring and alerting systems for internal and external threats; and regular evaluations of our cybersecurity program.

companyName: Alaunos Therapeutics, Inc.

ticker: TCRT


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider. We also seek to include appropriate security terms in our contracts, where applicable as part of our oversight of third-party providers.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats We maintain an incident response program. In the event of a cybersecurity incident, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain an Incident Response Plan, which includes an Incident Response Process in the event of a significant cybersecurity incident. In the event of a significant cybersecurity incident, our head of administration will chair an incident response team to handle the incident. Such incident response team will include members of IT, finance (if applicable), legal, communications, human resources and any affected unit or department. IT, along with a designated forensic team, will use the Incident Response Process to guide the response.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by head of administration and our managed service provider. Our head of administration has over four years of experience addressing cybersecurity risks. Our head of administration is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. Our head of administration oversees the Incident Response Plan and briefs our board of directors on cybersecurity matters, including the nature and design of our cybersecurity program, and threats, events, and program enhancements.


text: In its oversight role, our Board of Directors is expected to specifically consider risks, including with respect to privacy, information technology and cybersecurity and threats to technology infrastructure.


text: On a regular basis, the head of administration reports to our Board of Directors on cybersecurity matters, including key risks, the potential impact of those exposures on our business, financial condition, results of operations, cash flows and prospects, and the programs and steps implemented by our management team to monitor and mitigate risks.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall approach to risk management. Given our nature and size, we do not have a dedicated enterprise risk function, but our management team regularly considers and evaluates risks. As part of that risk management process, our management team identifies, assesses and evaluates risks impacting our operations, including those risks related to cybersecurity, and raise them for internal discussion, and where it is determined to be appropriate, issues are also raised to our Board of Directors for consideration.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any previous cybersecurity incidents that have materially affected our business, financial condition, results of operations, cash flows and prospects or that are reasonably likely to have such a material effect. While we have implemented a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information regarding risks relating to privacy and cybersecurity, see "Item IA—Risk Factors—Risks Related to Our Business."


text: We recognize the critical importance of maintaining the trust and confidence of all our stakeholders. Our Board is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards, processes, and practices are fully integrated into our risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Velo3D, Inc.

ticker: VELO


text: Risk Management and Strategy As one of the critical elements of our overall risk management approach, our cybersecurity program is focused on the following key areas:


text: Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which receives, at a minimum, quarterly reports and presentations from our risk management function, our Information Technology department and other members of management. The Board and Audit Committee also receive prompt and timely information regarding material cybersecurity incidents as described below.


text: Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also executing controls and procedures that provide for the prompt escalation of certain material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such material incidents can be made by management in a timely manner.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans to address our response to cybersecurity incidents, and such plans are tested and reviewed on an as needed basis. Our cybersecurity program includes a dedicated security incident response team (the "SIRT") responsible for identifying, investigating, and mitigating cybersecurity threats. The SIRT follows a well-defined incident response process encompassing intake, investigation, mitigation, and recovery. This process leverages tools for threat detection and utilizes standardized protocols for containment, root cause analysis, and system restoration. By integrating security measures with a robust response process, we aim to minimize the impact of potential cyber incidents.


text: Incident Reporting and Communication: We have established protocols for reporting material cybersecurity incidents to management, stakeholders, and regulatory bodies as required. The Board is promptly informed and receives ongoing updates regarding material cybersecurity incidents as described below.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: We provide annual mandatory training for personnel regarding cybersecurity threats to equip our employees and contractors with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in an annual assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, focused on evaluating the effectiveness of our cybersecurity measures and planning.


text: Our Board, supported by the Audit Committee, oversees our risk management process. The Audit Committee receives, at a minimum, quarterly presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any material cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our IT personnel, in coordination with our executive management team, works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee basis and appropriate third-party contractors, as well as the management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report threats and incidents to the Audit Committee, as needed.


text: Our IT personnel oversees information technology ("IT") strategy, operations, cybersecurity, compliance, and business applications. They are dedicated to accelerating and scaling our company by implementing innovative technology across the company. Additionally, they are an accomplished IT expert with over 15 years of experience driving transformative change across diverse industries, including manufacturing, financial services, and software as a service.


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats in 2024 that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Risk Factors—Risks Related to Compliance Matters—Aspects of our business are subject to privacy, data use and data security regulations, which could increase our costs" and "—Risks Related to Our Business and Industry—We rely on our information technology systems to manage numerous aspects of our business and a disruption of these systems could adversely affect our business."


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our internal information technology policies which are inclusive of cybersecurity policies, processes, and practices. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our Cybersecurity Committee, which is comprised of representatives from our business operations and support functions, assesses risks based on current risks we are aware of, probability and potential impact to key business systems and processes. Risks that are considered high are incorporated into our overall risk management program. A mitigation plan is developed for each identified high risk, with progress reported to the Cybersecurity Committee and tracked as part of our overall risk management program overseen by the Audit Committee of our board of directors.

companyName: Biomea Fusion, Inc.

ticker: BMEA


text: We collaborate with third party vendors as deemed necessary to assess the effectiveness of our information technology environment, which is inclusive of our cybersecurity prevention and response systems and processes. These third party vendors include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have implemented a third-party cybersecurity risk management process to conduct due diligence on external entities that are determined to be of higher risk due to the Sensitive Information that they have access to, including those that perform cybersecurity services.


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company. Refer to the risk factor captioned "If our security measures are compromised, or the security, confidentiality, integrity, or availability of our information technology, software, services, communications, or data is compromised, limited, or fails, this could result in a material adverse impact" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on our Company.


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The Audit Committee of the board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, when applicable, and reports from the Chief Financial Officer on our enterprise risk profile on an annual basis. The Audit Committee reviews our information technology environment risk, which is inclusive of our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the prevention, detection, and mitigation efforts of our cybersecurity program, as well as our remediation of cybersecurity incidents, as applicable.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. Our Head of Information Technology, and the Cybersecurity Committee, is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. The current Head of Information Technology has over 20 years of experience in information security and possesses the education, skills, experience, and industry certifications expected by our company of an individual assigned to these duties. The Head of Information Technology provides periodic updates on our information technology environment risk, which is inclusive of our cybersecurity risk profile, to the Board of Directors, which includes the Audit Committee members.


text: Risk Management and Strategy Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. To mitigate these risks and protect sensitive customer data, financial transactions, and our information systems, the Company has implemented a comprehensive Information Security Program ("Program") which is a component of its overarching enterprise risk management program. The Program is achieved through a collaborative effort involving operations, technology, compliance, risk, and senior management. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential cyber threats.

companyName: EAGLE FINANCIAL SERVICES INC

ticker: EFSI


text: Key components of the risk management program include: • A risk assessment process that identifies and prioritizes material risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the Board of Directors. • Third-party managed detection and response service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting. • A patch management system that safeguards our environment by keeping software up-to-date and resilient against threats. • Internal and external penetration testing that is conducted and reviewed either by independent third parties or qualified employees. • A third-party risk management program that is designed to ensure our vendors meet our cybersecurity requirements. • A training and awareness program that educates employees about cybersecurity risks and how to protect themselves from cyberattacks. • An incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident, which is tested at least annually.


text: Governance and Oversight The Board of Directors, including its Risk Subcommittee provides oversight of Company cybersecurity risks. The Board of Directors receives periodic reports on cybersecurity threats, awareness training, and key risk indicators related to cybersecurity. Additionally, the Company's Audit Committee provides oversight as it relates to annual audits related to information technology and cybersecurity. Management promptly reviews results of these audits to initiate necessary remediation, which are then reviewed by the Audit Committee.


text: The Board of Directors has designated the Security Committee and Incident Response Team with responsibilities related to information security and cybersecurity.


text: The Security Committee is a management committee with representation from operations, technology, compliance, risk, and senior management. The Security Committee monitors, reviews, and makes necessary changes to the Information Security Program. This Committee provides accountability for policies and procedures and reviews incidents that may affect information security.


text: The Incident Response Team has overall authority and responsibility for preparing and responding to incidents and consists of various sub-teams including representation from operations, technology, risk, compliance, human resources, and marketing. While key personnel have identified roles, this team ensures appropriate reports, statuses, and decisions are presented to the Executive Management and the Board of Directors.


text: The Company's Chief Technology Officer ("CTO") oversees the Company's information technology programs and investments. The Company's CTO has over 30 years of information technology experience. The Company's Compliance and Security Officer, who oversees the Company's information security programs, has over 10 years of experience and reports to the Chief Operating Officer. The Compliance and Security Officer is designated as the program coordinator responsible for coordinating and overseeing the Information Security Program.


text: Material Effects of Cybersecurity Threats While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including because of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, refer to Item 1A, Risk Factors of this Form 10-K.


text: Risk Management and Strategy We recognize the critical importance of securing our information systems and protecting the confidentiality, integrity, and availability of our data. To achieve this, we have developed and implemented a comprehensive cybersecurity risk management program designed to identify, assess, and mitigate risks to our critical systems and data, including risks resulting from cybersecurity threats associated with our use of third-party service providers.

companyName: Galera Therapeutics, Inc.

ticker: GRTX


text: Our cybersecurity strategy is integrated into the company's broader enterprise risk management framework, ensuring that cybersecurity considerations are an integral part of decision-making at all levels of the organization. We collaborate with external experts, including cybersecurity assessors and vendors, to continuously evaluate and enhance our security posture and conduct regular risk assessments, penetration testing, and security audits.


text: Monitoring, Training and Incident Response We continuously monitor our information systems for potential cybersecurity threats. Our cybersecurity incident response plan outlines specific procedures for responding to incidents, minimizing damage, and recovering swiftly. We have implemented a comprehensive cybersecurity training program for all employees to ensure they are fully equipped to handle cybersecurity responsibilities. The training emphasizes making cybersecurity an integral part of our corporate culture. It covers a wide range of topics, including understanding the different types of malware and how to avoid them, recognizing social engineering tactics like phishing and pretexting, and the importance of creating strong passwords while using multi-factor authentication. Additionally, the program addresses the unique security risks associated with remote work, mobile device usage, and Wi-Fi connections, as well as best practices for securing email communications and ensuring physical security of devices. Employees also learn about the importance of information classification, securing sensitive data, and safeguarding mobile devices and USB drives from unauthorized access or attacks. The program highlights the risks associated with the dark web and emphasizes how employees can protect themselves and the organization from information exposure. Furthermore, the training ensures that employees understand how to effectively respond to cybersecurity incidents, including how to recognize, report, and address security threats in a timely manner. This training is regularly updated to reflect the latest security threats and trends, ensuring employees are always aware of evolving risks. Employee understanding is assessed through quizzes, and executive leadership plays a key role in reinforcing cybersecurity as a top priority by modeling strong security behaviors and emphasizing ongoing vigilance.


text: Cybersecurity Risks We have not experienced or identified risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: The Board of Directors (the Board), with oversight from the Audit Committee, is responsible for the governance of cybersecurity risks. The Audit Committee receives regular updates from management on cybersecurity risks and incidents, ensuring that the Board is kept informed. Management, led by the Chief Executive Officer (the "CEO"), is responsible for implementing the cybersecurity program, monitoring the company's risk posture, and reporting to the Audit Committee and the Board regarding cybersecurity-related risks. The CEO works closely with external consultants and vendors, including IntellectMap, to ensure that we stay current with industry standards and best practices.


text: Cybersecurity is a critical element of our information security program. Security controls are implemented in a manner that protects the confidentiality, integrity and availability of our information assets without hindering business operations. Management is responsible for the day-to-day administration of our cybersecurity policies, processes, and practices. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology (the "NIST") and management's knowledge of best practices in the cybersecurity industry. In general, we seek to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity and availability of our information systems or the information that we collect and store, by proactively monitoring for cybersecurity threats and assessing, identifying and managing cybersecurity issues as they occur.

companyName: Scilex Holding Co

ticker: SCLX


text: We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. Key elements of our cybersecurity risk management strategy include: • We require an annual Service Organization Control 2 Type 1 report from all third-party providers attesting to the presence of security processes. Additionally, we require that SaaS/PaaS providers perform risk assessments and manage the security risks associated with their services. • We have established and maintain a comprehensive incident response plan designed to address our response to a cybersecurity incident. We conduct regular training scenarios to test these plans and ensure personnel are familiar with their roles in a response scenario. • We provide regular, mandatory training for employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. • We use a third party to conduct a periodic assessment of our cybersecurity risk posture and maturity against the NIST Cybersecurity Framework. The results are evaluated by management and the Audit Committee and are used to adjust our cybersecurity policies, standards, processes and practices as necessary. • The Company studies and evaluates threats in cyber landscape and aims to regularly improve our risk posture by learning from those lessons.


text: Our Audit Committee receives quarterly presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by other public companies.


text: The Senior Director of IT acts as the Incident Manager and meets regularly with our Incident Response Team, including members of Financial Risk Management, IT Security and Human Resources senior management to discuss the necessary measures to take prior to and during an incident. In the event of an incident, the Incident Manager meets regularly with the executive leadership team and keeps them apprised of the status of any incident during the incident response. Our Board and the Audit Committee also receive prompt and timely information from the Senior Director of IT and executive leadership regarding any cybersecurity risks that meet certain reporting thresholds, as well as ongoing updates regarding any such risk. Finally, the Incident Response Manager briefs corporate leadership on lessons learned from the incident during or after the recovery phase.


text: The Senior Director of IT, in collaboration with a team of IT professionals, our legal counsel and Human Resources, are tasked with implementing a program designed to protect our information systems from cybersecurity threats and manage material risks. The Senior Director of IT has served in various roles in information technology and information security for over 20 years. The Senior Director of IT and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition as of December 31, 2024. For more information, please see the risk factor disclosures included in Item 1A of this Annual Report on Form 10-K.


text: (a) Cybersecurity Risk Management Strategy We have developed our cybersecurity risk management program (Cybersecurity Framework), including a cybersecurity incident response plan, based on the National Institute of Standards and Technology Cybersecurity Framework’s (NIST CSF) principles: Identify, Protect, Detect, Respond, and Recover, and our Cybersecurity Framework is intended to address current vulnerabilities and anticipate future cybersecurity threats and risks to our cyber ecosystem. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Aardvark Therapeutics, Inc.

ticker: AARD


text: Our Cybersecurity Framework is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response process that includes procedures for responding to cybersecurity incidents; and • a risk evaluation of our service providers, suppliers, and vendors of critical systems during contracting.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance, however, that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. For more information, see Part I, Item 1A, “Risk Factors—Risks Related to the Operation of Our Business—Significant disruptions of our information technology systems or data security incidents could result in significant financial, legal, regulatory, business and reputational harm to us” of this Annual Report.


text: (b) Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management’s implementation of our cybersecurity risk management strategy.


text: The Audit Committee receives periodic reports from management, including our IT Governance Team, on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our IT Governance Team is comprised of senior Aardvark leadership, including our Chief Financial Officer, Vice President, Head of Product Management and Strategy and Vice President, Quality, as well as third party advisors. Our IT Governance Team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The experience of our IT Governance Team encompasses leadership, development, and support of cybersecurity strategies, along with the implementation of policies and procedures.


text: Our IT Governance Team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy The Company relies on information systems and the data stored on them to conduct its operations. Our cybersecurity risk management program is designed to allow us to identify, assess, and manage cybersecurity risks. Our Chief Technology Officer, with the support of our IT Manager, assesses and manages cybersecurity risk, including preventing, mitigating, detecting, and addressing cybersecurity incidents, if any. Our Chief Technology Officer has 30+ years of experience leading and managing consumer facing services at scale. He has a Bachelor of Science in Computer Science and has led and managed both engineering and Enterprise IT teams across large scale organizations focused on delivering secure and performant consumer products. Our Chief Technology Officer also works closely with other management positions to ensure that the Company understands its cybersecurity risk management responsibilities.

companyName: Interactive Strength, Inc.

ticker: TRNR


text: To operate our business, we utilize third-party service providers to perform various functions, such as outsourced business-critical functions, professional services, SaaS platforms, cloud-based infrastructure, content delivery to third parties, and other functions. We engage reliable, reputable service providers that maintain cybersecurity programs and we conduct upfront cybersecurity reviews as part of our onboarding process for partners.


text: The Company reports on its information security program to the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee is responsible for overseeing the Company's cybersecurity and information security procedures. The Audit Committee reports matters to the Board of Directors as needed. Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing, and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats to and security incidents relating to our information systems. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. As an externally managed company, our business is highly dependent on the communications and information systems of our Advisor, its affiliates and third-party service providers. Our Advisor is an indirect subsidiary of Cantor, a diversified organization specializing in financial services and real estate for institutional customers operating in the global financial and commercial real estate markets. Cantor has a global cybersecurity process applicable to all subsidiaries and business lines, including our business.

companyName: Cantor Fitzgerald Income Trust, Inc.


text: Risk Management and Strategy Cantor's global cybersecurity processes form the comprehensive framework for planning, performing, managing, assessing, and improving our security controls as they relate to cybersecurity, and form part of our overall risk management system. Cantor aims to conduct its cybersecurity program in accordance with current recognized global policies and standards for cybersecurity and information technology. These processes are managed by Cantor's cybersecurity team and supported by its business continuity teams.


text: Cantor conducts periodic internal and external vulnerability audits and assessments and penetration testing and provides periodic cybersecurity training to employees. These measures include regular phishing simulations, annual general cybersecurity awareness training and data protection training. Cantor participates in industry-specific cybersecurity roundtables and professional groups to ensure it remains abreast of industry-wide cybersecurity developments and best practices and thereby enhances our threat identification processes and responses as necessary. Additionally, when engaging with and utilizing third-party vendors and partners for its business, Cantor conducts various oversight assessments, including due diligence and periodic monitoring to identify potential cybersecurity threats associated with conducting business with such vendors and partners and to ensure any corresponding risk exposure aligns with Cantor's business requirements and risk tolerances.


text: Cantor maintains an incident reporting and escalation process in the event of any observed, detected, or suspected events that it believes may qualify as a cybersecurity incident. Risks are identified based on a four-tier system, and tiers are assigned based on the service impact, user impact, financial impact, and security impact that a threat may pose. Cantor's processes include steps to recover our systems and information through established and tested system recovery plans and business continuity plans, each based on the appropriate response associated with the corresponding tier of the identified threat. Cantor's incident response process includes steps to notify key incident management team members who are responsible for communicating with regulatory and other governmental authorities about cybersecurity events as applicable and as required by law. Cantor determines the materiality of such incidents based upon a number of factors including if the incident had or may have a material impact on the respective business strategy, results of operations, or financial condition. This process involves a review of the nature of the incident by Cantor's cybersecurity team as well as other members of management and employees with specialized technological or financial knowledge, as applicable. In the event of a material breach, Cantor has a process for escalation to appropriate members of its senior management, who would, if appropriate, communicate with our management and board of directors or audit committee. These groups would also collaborate in determining the appropriate response to such events and disclosure of any material breach.


text: Cantor engages third parties from time to time that assist it in the identification, assessment, and management of cybersecurity risks. Cantor also engages cybersecurity specialists to complete assessments of its cybersecurity processes, program and practices, including data protection practices, as well as to conduct targeted attack simulations. The feedback from these assessments and guidance from external specialists informs Cantor's overall risk management system and the development and improvement of our processes to mitigate cybersecurity risks throughout the Company.


text: Governance and Management Our board of directors has responsibility for the direction and oversight of our risk management, which would include cybersecurity risk management. Our board of directors administers this oversight function directly, with support from its audit committee (the "audit committee"). In particular, the audit committee considers and discusses our major risk exposures and the steps our Advisor takes, or is required to take, to monitor and control these exposures. Our audit committee also monitors compliance with legal and regulatory requirements, in addition to overseeing the performance of our internal audit function.


text: The audit committee will engage in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, which will include those that result from material cybersecurity threats as necessary.


text: As an externally managed company, we rely on Cantor's information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by Cantor.


text: As of the date of this Annual Report on Form 10-K, we have not encountered risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial position. For more information about the cybersecurity risks we face, see the risk factor entitled "Malicious cyber-attacks and other adverse events affecting the Company's operational systems or infrastructure, or those of third parties, could disrupt the Company's business, result in the disclosure of confidential information, damage the Company's reputation and cause losses or regulatory penalties" in Item 1A- Risk Factors.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risk associated with cybersecurity threats. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such risks. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Seritage Growth Properties

ticker: SRG


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. As part of this process, we have elected to engage third-party managed service providers to maintain our network and to manage the monitoring, detection, mitigation, and prevention of cybersecurity threats. These service providers are responsible for managing our hosted services, all of the computer and computer-related hardware and software we use, and for managing our backup processes. Our primary managed service provider supplies management with weekly updates and activity reports related to network alerts, connectivity issues, and help desk tickets.


text: Our management team has taken additional steps to implement our cybersecurity risk management program. For example, we have implemented periodic management reviews of our controls related to provisioning of user access to certain third-party hosted applications that we use in connection with the business and risks posed by certain critical vendors; this includes reviewing System and Organizational Control audit reports of such vendors. We maintain insurance coverage intended to mitigate our financial exposure to certain cybersecurity threats, and we consult with external advisors regarding opportunities and enhancements to strengthen our cybersecurity processes and practices.


text: We are subject to risks from cybersecurity threats and incidents. As of December 31, 2024, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition. However, there can be no assurance that the Company will not be materially affected by such risks in the future. For additional information regarding risks from cybersecurity threats, refer to Item 1A, "Risk Factors", in this Annual Report on Form 10-K.


text: Our Board of Trustees considers cybersecurity risk as part of its risk oversight function. In February 2024, the Board delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Audit Committee will receive periodic reports from our Interim Chief Financial Officer or our Chief Legal Officer on our cybersecurity risks. In addition, our Interim Chief Financial Officer or our Chief Legal Officer will update our Audit Committee, as necessary, regarding any significant cybersecurity incidents impacting our information systems. Our entire Board will also receive briefings from our Interim Chief Financial Officer or Chief Legal Officer on our cybersecurity risk management program as part of our overall business risk updates.


text: Our management, represented by our Interim Chief Financial Officer, John Garilli, oversees the Company's cybersecurity risk management program. We have elected to engage third-party providers to maintain our network defenses and to manage and assess cybersecurity risk management and strategy for the Company. Our third-party providers update Mr. Garilli and other members of our executive management team with any network issues on a weekly basis and make recommendations for security upgrades as needed. The Interim Chief Financial Officer or the Chief Legal Officer will update the Audit Committee quarterly, or more frequently in the case of a significant cybersecurity incident impacting our information systems.


text: Our Cybersecurity Approach and Strategy Our cybersecurity approach includes consideration of information security controls in aspects of the business where unauthorized occurrences could adversely affect the confidentiality, integrity, or availability of our information systems as part of our overall risk management strategy, looking to the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF") as a guide in how we identify, assess, and mitigate material cybersecurity risks. Cyber risk management encompasses partnerships among teams that are responsible for cybersecurity governance, prevention, detection, and remediation activities within our Company's cybersecurity environment.

companyName: Leafly Holdings, Inc. /DE


text: We have engaged external cybersecurity professionals to help design and manage our security program. These experts conduct annual penetration testing and incident response tabletop exercises, make recommendations on how to continuously improve our cybersecurity program, and assist us in implementing their recommendations into our existing processes.


text: Accordingly, we have implemented processes for overseeing, detecting and identifying material risks from cybersecurity vulnerabilities and threats, and technical, process, and people related security controls designed to mitigate material cybersecurity risks. We also maintain an Incident Response Plan, which defines the procedures for evaluating, and reporting cybersecurity incidents to executive leadership. The Incident Response Plan also creates a framework and delegates tasks to appropriate personnel for responding to a cybersecurity incident based on the severity of an incident. These processes are integrated into our overall risk management strategy.


text: Our ongoing cyber risk management efforts include penetration testing to assess and manage cybersecurity risks and monthly reviews of our risk register, which are updated on an ongoing basis. From time-to-time, we also provide enterprise-wide cybersecurity training for employees to continuously improve our mitigation against human-driven vulnerabilities.


text: We have experienced security incidents in the past, which we believe were immaterial and were not reportable under applicable state law or our other obligations; however, there can be no assurance that our determinations were correct. We do not believe there are material risks from cybersecurity threats, including as a result of previous incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Oversight of Third-Party Service Providers We manage cybersecurity risks through our use of third-party service providers by integrating our mitigation strategies throughout various functional areas within the Company, including but not limited to the Company's business segments and information technology, engineering, infrastructure, and legal departments. These strategies include, as applicable, conducting technical assessments at the outset of any third-party service provider engagement, limiting the disclosure or transfer of information to an as-needed basis by way of technical infrastructure, and contractually requiring third parties to maintain security controls and protect our information and maintain established notification protocols in the event of any known material data breach using industry best practices.


text: Our Senior Vice President of Product, who has extensive cybersecurity knowledge from over 20 years of experience in leadership roles at technology companies ranging in maturity from various startups to Sony, a large billion dollar corporation, leads the team responsible for overseeing, managing, and assessing our material cybersecurity risks, and works in close coordination with other members of leadership, infrastructure, and information technology, and our external professional providers to maintain cybersecurity risk management and data protection.


text: Our Board oversees the risk management activities designed and implemented by our management. Our Board executes its oversight responsibility both directly and through its committees, and has delegated the responsibility of providing oversight of cybersecurity risks to its Audit Committee, including oversight over the steps management takes to monitor and control such exposures. Our Senior Vice President of Product and external cybersecurity professionals are responsible for overseeing, managing and assessing material cybersecurity risks, and periodically report to the Audit Committee on the ongoing development, status and health of our cybersecurity program and material cybersecurity risks or incidents, if any.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. Our share of Bitcoins mined from our pools are initially received by us in wallets we control. We currently sell the majority of the Bitcoin we mine and utilize hot wallets to hold this Bitcoin immediately prior to selling for working capital purposes. We hold any remainder of our Bitcoin in cold storage. Bitcoins we mine or hold for our own account may be subject to loss, theft or restriction on access. Hackers or malicious actors may launch attacks to steal, compromise or secure Bitcoins, such as by attacking the Bitcoin network source code, exchange miners, third-party platforms (including Gemini), cold and hot storage locations or software, or by other means. We may be in control and possession of substantial holdings of Bitcoin, and as we increase in size, we may become a more appealing target of hackers, malware, cyber-attacks or other security threats.

companyName: LM FUNDING AMERICA, INC.

ticker: LMFA


text: Our management evaluates all cybersecurity matters, with the purpose of meeting at least semi-annually and providing recommendations with respect to our information technology use and protection, including, but not limited to, data governance, privacy, compliance and cybersecurity. We have implemented controls, policies, procedures and technological safeguards to maintain and protect the integrity, continuous operation, redundancy and security of our IT systems and data that we believe to be reasonably consistent with industry standards and practices, or as required by applicable regulatory standards. We are also required to comply with applicable laws, rules, regulations and contractual obligations relating to the privacy and security of our IT systems and data and to the protection of such IT systems and data from unauthorized use, access, misappropriation or modification.


text: To our knowledge there has been no security breach or incident, unauthorized access or disclosure, or other compromise of or relating to the Company or its subsidiaries hard wallets, cold wallets, information technology and computer systems, networks, hardware, software, data and databases, equipment or technology. We have not been notified of, and have no knowledge of any event or condition that could result in, any security breach or incident, unauthorized access or disclosure or other compromise to their IT systems and data, and we have implemented appropriate controls, policies, procedures, and technological safeguards to maintain and protect the integrity, continuous operation, redundancy and security of our IT systems and Data reasonably consistent with industry standards and practices, or as required by applicable regulatory standards. We are presently in material compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal policies and contractual obligations relating to the privacy and security of IT systems and data and to the protection of such IT systems and data from unauthorized use, access, misappropriation or modification.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk and other information technology risks as part of its risk oversight function and meets at least quarterly to discuss matters involving cybersecurity risks. The Chief Executive Officer and Chief Financial Officer provide information to our Board of Directors regarding its activities, including those related to cybersecurity risks, and are responsible for notifying the Board of material cybersecurity incidents.


text: Management policies and procedures We recognize the need to protect our data, systems and technology. We have described related risks in Item 1A under the heading "Risks Related to our Technology and Data." We have previously assessed and periodically measure our security maturity using the US National Institute of Standards and Technology Cybersecurity Framework. ("NIST CSF") supported by other internal and third-party assessments. Gaps or perceived weaknesses in our NIST CSF score are highlighted to our Cybersecurity Risk Committee and subsequently to the Board of Directors. A reassessment of our maturity using NIST CSF was carried out in the early part of 2024, demonstrating ongoing improvement. These assessments allow us to prioritize investment into those areas which provide the greatest improvement in the CSF scoring and by implication, our ability to identify, protect, detect, respond and recover from information and cybersecurity incidents. Risks are recorded in OneTrust and are formally assessed monthly, considering likelihood and potential impact and mitigating actions are implemented where possible to reduce identified risks. Controls designed to reduce or eliminate risk are designed into our technology, processes and management of third parties. We conduct regular vulnerability scanning and use a third party for regular penetration testing designed to help us identify new weaknesses or vulnerabilities. In addition, we use the same third party to help us conduct cybersecurity incident simulation which is subsequently used to inform updates to our Cybersecurity Incident Response Plan. We also have procedures designed to assess risks related to the use of third-party suppliers.

companyName: Soho House & Co Inc.


text: In the previous 12 months, we have not identified any risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. For additional information about the cybersecurity risks we face, see the risk factors entitled, "A cybersecurity attack, 'data breach' or other security incident experienced by us or our third-party service providers may result in negative publicity, claims, investigations and litigation and adversely affect our business, results of operations and financial condition," and "If we fail to properly maintain the confidentiality and integrity of our data, including member and customer credit or debit card and bank account information and other PII, or if we fail to comply with applicable laws, rules, regulations, industry standards and contractual obligations relating to data privacy, protection and security, it may adversely affect our reputation, business and operations," in Item 1A Risk Factors.


text: We have implemented a governance program which facilitates senior management oversight of cybersecurity risk management. An operational risk group comprising senior SHCO Cyber Risk and third-party Cyber Risk professionals together with the IT Infrastructure lead meet monthly to review emerging risks, progress with mitigation of identified risk and prioritization of risk reduction activities. The output from this group is shared quarterly with the Cyber Security Risk Committee ("CSRC") a Board Sub-Committee which comprises the Chief Executive Officer (CEO), Chief Financial Officer (CFO), Chief Technology Officer (CTO), Chief Legal Officer (CLO) and Director of Information Security. The CSRC is responsible for reviewing the top strategic cyber risks, progress against cyber maturity improvement and recommending funding and resource requirements. The CSRC reports twice per year to the Audit Committee. The CSRC is also the body that collectively assesses materiality in the event of a cybersecurity incident and meets as required for this purpose.


text: Management's role and relevant experience in assessing and managing cybersecurity The NIST CSF is used to assess cybersecurity maturity. An initial baseline assessment has been used to inform our Cybersecurity Strategy and periodic assessments are used to update the NIST CSF scoring. These assessments are carried out by an independent third party to provide appropriate objectivity and challenge. In addition, we are progressing towards certification to the international information security management standard - ISO 27001 and the related standard ISO 27701 for privacy information management. Execution of our cybersecurity strategy is overseen by our Director of Information Security who is a qualified CSIM, CISA and a Fellow of the UK Chartered Institute of Information Security and has over 30 years of experience in cyber security. The Director of Information Security provides the CTO with periodic updates and also chairs the CSRC which provides a forum for senior management to discuss cyber risk management in greater detail.


text: Cybersecurity Risk Management and Strategy We have developed and maintained a Cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our Cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a Cybersecurity awareness campaign designed to identify, assess and manage material risks from Cybersecurity threats, including by engaging a third-party Cybersecurity service provider, which communicates directly with our management and compliance personnel. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our Cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving Cybersecurity threats. We may engage external experts, including Cybersecurity assessors, consultants, and auditors to evaluate Cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors, and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party Cybersecurity service provider, material risks from Cybersecurity threats associated with our use of such entities.

companyName: JFB Construction Holdings

ticker: JFB


text: Our Cybersecurity risk management methodology includes: • risk assessments designed to help identify material Cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • individuals, including employees and external third-party service providers, who are responsible for managing our Cybersecurity risk assessment processes, our security controls, and our response to Cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response personnel, and senior management; • a Cybersecurity incident response plan that includes procedures for responding to Cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known Cybersecurity threats, including as a result of any prior Cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from Cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board provides strategic oversight on Cybersecurity matters, including material risks associated with Cybersecurity threats. The Board has delegated to the Audit Committee oversight of Cybersecurity and other information technology risks. The Audit Committee oversees management’s implementation of our Cybersecurity risk management methodology. Our Board and the Audit Committee receives periodic updates from our Chief Financial Officer and more frequently as needed, regarding the overall state of our Cybersecurity preparedness, information on the current threat landscape, and material risks from Cybersecurity threats and Cybersecurity incidents. The Audit Committee and our management team are informed about and monitor the prevention, detection, mitigation, and remediation of Cybersecurity incidents, including through the receipt of notifications from third-party service providers and reliance on communications with our risk management, legal, and/or compliance personnel.


text: The Audit Committee reports to the full Board regarding Cybersecurity activities. The full Board also receives briefings from management on cyber risk issues and best practices. Our management team is responsible for assessing and managing our material risks from Cybersecurity threats. The team has primary responsibility for developing and maintaining our overall Cybersecurity risk methodology and supervises both our internal Cybersecurity personnel and our retained external Cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate Cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program, and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Adviser's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and are fully integrated into the Adviser's overall risk management processes. In general, the Adviser seeks to address material cybersecurity threats through a entity-wide approach that addresses the confidentiality, integrity, and availability of the Adviser's information systems or the information that the Adviser collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: TCW Direct Lending LLC


text: Cybersecurity Risk Management and Strategy The Adviser's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Adviser has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Adviser's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: The Adviser implements technical safeguards that are designed to protect the Adviser's information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as assistance from third party experts where necessary. • Incident Response and Recovery Planning: The Adviser has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Adviser's response to a cybersecurity incident. The Adviser conducts occasional tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Adviser maintains a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Adviser's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside consultants who advise on the Adviser's cybersecurity systems. • Education and Awareness: The Adviser provides regular, mandatory training for all levels of personnel regarding cybersecurity threats as a means to equip the Adviser's personnel with effective tools to address cybersecurity threats, and to communicate the Adviser's evolving information security policies, standards, processes, and practices.


text: The Adviser conducts periodic assessment and testing of its policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. This includes penetration testing of network infrastructure and phishing tests targeting the Adviser's employees. The results of such assessments and reviews are evaluated by management, and the Adviser adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments and reviews.


text: The Board receives annual updates and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by the Company'. The Board also receives prompt and timely information regarding any material cybersecurity risk, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Adviser discuss the Company's approach to overseeing cybersecurity threats.


text: The Adviser has established an internal working group that includes relevant representation from senior management including the CCO, COO and CISO who work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans.


text: The CISO has served in various roles in information technology and information security for many years and holds relevant professional certifications. The Adviser's COO and CCO each hold educational and professional degrees in their respective fields, and each has numerous years of experience managing risk at the Company and at similar companies, including assessing cybersecurity threats.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management and Strategy We are dedicated to protecting the integrity, confidentiality, and availability of our data, infrastructure and operating systems. As part of our commitment to safeguarding our operations against cybersecurity threats, we employ a comprehensive strategy for the assessment, identification, and management of cybersecurity risks. We engage a managed services provider ("MSP"), which provides wide-ranging services including risk assessments, threat detection, monitoring and response strategies, security audits and cybersecurity training.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: Cybersecurity Processes: We conduct robust cybersecurity processes aligned with the National Institute of Standards Technology ("NIST") and the Cybersecurity Maturity Model Certification ("CMMC") protocols. Our comprehensive approach includes: • An enterprise firewall; • Implementation of Multi-Factor Authentication (MFA); • Adherence to the Zero Trust model; • Utilization of Managed Detection and Response (MDR); • Endpoint Detection and Response (EDR) technologies; • 24x7 Security Operations Center (SOC); and • Employment of Security Information and Event Management (SIEM) systems to continuously monitor our network and respond to threats in real time.


text: Risk Assessment Procedures: We conduct periodic risk assessments to identify potential cybersecurity threats and vulnerabilities within our IT infrastructure. These assessments are conducted using various software tools and methodologies that enable us to evaluate our systems critically and comprehensively. Our risk assessment process includes, but is not limited to, the analysis of: • Hardware and software configurations; • Network and data access protocols; • Encryption standards; and • Compliance with relevant industry and regulatory standards.


text: Threat Identification: We utilize advanced threat detection tools and services that continuously monitor our network for signs of unauthorized access, anomalies, and potential breaches. Our third-party cybersecurity provider is equipped with sophisticated detection technologies that help to swiftly identify even the most subtle signs of compromise. We focus on: • Real-time monitoring of our networks; • Regularly updated intrusion detection systems (IDS); • Deployment of endpoint detection and response (EDR) solutions; and • Utilization of threat intelligence platforms to stay abreast of emerging threats.


text: Threat Management: Upon identification of a potential threat, our managed service provider's dedicated incident response team takes immediate action to mitigate any adverse impacts. Our threat management procedures include: • Immediate isolation of affected systems to prevent the spread of threats; • Application of appropriate remediation measures, such as patches and software updates; • Conducting a thorough investigation to understand the breach's nature and scope; and • Implementing enhancements to prevent future occurrences.


text: Our incident response plan provides a concise strategy of how we will respond to an incident, including who will respond and their roles and responsibilities, the facilities that are in place to help with the management of the incident, how decisions will be taken with regard to our response to an incident, how communication will be handled both internally and externally, and defining what will happen once the incident is resolved and how we can learn and improve from the situation.


text: Integration into Overall Risk Management: Our cybersecurity risk assessment processes are fully integrated into the broader risk management framework. Cybersecurity is positioned as a core component of our risk management strategy, with direct reporting to our President and COO, who is guided by our MSP firm. The MSP firm provides strategic direction on policy, procedures and best practice. The synergy between cybersecurity and risk management ensures a resilient posture against emerging cyber threats.


text: Engagement of Third Parties: These providers are selected based on stringent criteria for cybersecurity expertise, particularly their capability to implement and manage NIST and CMMC protocols.


text: Third-Party Service Provider Oversight: Our oversight processes include comprehensive due diligence checks for any new third-party service provider and continuous monitoring of our existing MSP firm's activities. We have established protocols for communication and incident response that align with our managed service provider's operations, and industry best practice, ensuring swift action in the face of cybersecurity threats. Furthermore, a scheduled series of meetings has been established to procure updates and deliberate upon cybersecurity strategy with our contracted third-party providers.


text: Impact of Cybersecurity Risks Material Effects from Cyber Threats: To date, our operations and financial condition have not been materially affected by cybersecurity threats, due in part to our proactive measures such as employee security training programs and advanced threat detection and response capabilities. Our defensive strategies have successfully mitigated the risks of cyber incidents.


text: Potential Risk Exposure: While we have not experienced significant disruptions from cyber threats, we recognize the evolving nature of cyber risks. We continually evaluate the likelihood of potential cybersecurity incidents that could materially impact our strategic direction, operational efficacy, and financial stability. Our investment in training, alongside our sophisticated SOC, SIEM, and Zero Trust architecture, positions us to identify and address potential cybersecurity challenges promptly.


text: Cybersecurity Governance Our executive team is actively involved in overseeing our cybersecurity operations to ensure that they meet industry standards. The executive team provides regular updates to the Board—specifically the audit committee—on the status of our cybersecurity efforts, including any potential risks, threats or incidents.


text: Our President and COO, with guidance from our third-party MSP, manages our cybersecurity risk management and strategy process. Collectively, our consultants have 50+ years' experience in the cybersecurity industry in various roles.


text: Processes for Informing the Board: The audit committee is regularly informed about cybersecurity risks through quarterly briefings from our President and COO. These briefings may include risk assessment reports, incident response updates, changes to the cybersecurity landscape, and other relevant information. In the case of a cybersecurity incident that meets reporting thresholds, the audit committee will be promptly notified and will receive continual updates until the situation is remedied.


text: Cybersecurity is critical to advancing our overall objectives and enabling our digital efforts. As a company operating in the technology and software sectors, we face a wide variety of cybersecurity threats that range from common attacks such as ransomware and denial-of-service, to more advanced attacks. Our customers, suppliers and other partners face similar cybersecurity threats, and a cybersecurity incident impacting these entities could materially adversely affect our operations, performance and results. These cybersecurity threats and related risks make it imperative that we maintain focus on cybersecurity and systematic risks. Below is a discussion of our risk management and approach to governance as it relates to cybersecurity. For additional information on the impact of cyber risks, refer to Part I, Item 1A. "Risk Factors", of this Form 10-K.

companyName: Phunware, Inc.

ticker: PHUN


text: Risk Management and Strategy Cybersecurity risk management is a core tenet of our information technology security program. We have implemented various cybersecurity technologies, controls, and processes to ensure the integrity and availability of our infrastructure, data, and operations. We periodically review and modify these technologies and policies to align with the latest in industry best practices and an ever-changing threat landscape.


text: As part of our cybersecurity risk management program: • Cybersecurity risk assessment is performed on all new products and product updates; • We e mploy internal staff with security certifications, and we work with third parties to perform security vulnerability testing; • Changes to data protection laws are closely monitored and necessary changes are implemented; • We provide routine security training to employees and communicate any emerging threats; • We review the security posture of all third parties that we engage; • We maintain a comprehensive incident response plan; and • We carry cybersecurity insurance to help mitigate any potential losses arising from cybersecurity incidents.


text: While we face a number of ongoing cybersecurity risks in connection with our business, such risks have no t materially affected us to date, including our business strategy, results of operations, or financial condition.


text: Our Vice President of Information Technology, who reports directly to the Chief Executive Officer, manages and monitors our cybersecurity program. Our board of directors, as a whole, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage and mitigate those risks, including cybersecurity risks. The board of directors receives regular updates on cybersecurity and information technology matters and related risk exposures from our executive team.


text: Cybersecurity Risk Management and Strategy Like many companies, we face significant and persistent cybersecurity risks. The small size of our organization and limited resources could exacerbate these risks. Our business strategy, results of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.

companyName: TuHURA Biosciences, Inc./NV

ticker: HURA


text: In the ordinary course of our business, we collect and store sensitive data, including intellectual property. To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management strategy, which is comprised of a wide array of policies, standards, architecture, processes, and governance. Under the guidance and supervision of our Chief Executive Officer, we further limit risk by delegating our information technology and cybersecurity to a leading third-party IT consultant to safeguard our networks. Additionally, as an added layer of security, all of our data is stored on the cloud.


text: Despite being a small organization, we are committed to maintaining governance and oversight of these risks and to implementing standard operating procedures ("SOPs") and training to help us assess, identify, monitor and respond to these risks. Employees are trained to avoid phishing emails, and our internal controls system is designed to mitigate the risk of payments of fraudulent invoices.


text: We aim to incorporate industry best practices for companies of our size and financial strength throughout our cybersecurity program. Our board of directors has ultimate oversight of cybersecurity risk. The Chief Executive Officer reports to our board of directors. Our Chief Executive Officer provides periodic updates to the board of directors on (1) any critical cybersecurity risks; (2) ongoing cybersecurity initiatives and strategies; (3) applicable regulatory requirements; and (4) industry standards. The Chief Executive Officer also notifies the board of directors of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate


text: Maintaining the safety and security of our systems and data is essential to the success of our company. As with other industries, there are several cybersecurity threats we encounter. These include phishing, ransomware, and denial of service, among others. Our suppliers, vendors, and other partners face similar threats. A cybersecurity incident impacting us or any of these entities could materially affect our operations, performance, or financial results. See Item 1A, Risks Related to Information Security for additional details.

companyName: J.Jill, Inc.

ticker: JILL


text: The governance of our risk management program is a partnership between our cross functional management team and our Board. This program includes both a cyber team led by our Chief Information Officer ("CIO"), as well as an Enterprise Risk Management ("ERM") program led by our head of compliance. Our CIO has over 30 years of information technology experience, including over 4 years of direct oversight of information security. Risk oversight for both our cyber and ERM programs is primarily the responsibility of the Audit Committee of the Board who receive quarterly updates, at a minimum, with additional updates shared to the full Board on a recurring basis.


text: Cyber Security Team Our cross functional cyber security team is responsible for the overall information security strategy, risk assessment, cyber threat detection and response, and execution of an ongoing cyber program. The goal of this team is to lower the impact and likelihood of persistent threats to the extent feasible, including safeguarding of key information and the integrity of key systems. We also partner with third-party vendors to enhance our program including monitoring, pen testing, and other assessments and programs. Additionally, the Company has implemented certain information security measures which include security reviews as well as internal training and testing programs.


text: Enterprise Risk Management (ERM) Program Our cyber risks are included in our ERM program. Our ERM program is led by our Senior Director of Compliance and Internal Audit and has oversight from our Audit Committee. This program includes a cross functional team including our senior leadership team and other key members of management. Risk reduction plans are developed and updates are regularly assessed by the team. Our Audit Committee provides oversight and is briefed quarterly, at a minimum. In the event a cyber incident should occur, there are additional steps taken to mitigate cybersecurity risks and incidents.


text: As of the date of this filing, we are no t aware of any current cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition.


text: Risk Management and Strategy We are committed to safeguarding the personal information of our customers and potential customers as well as our own sensitive data and information. The full Board of Directors (the "Board") is responsible for the Company's general risk oversight, including cybersecurity and data privacy risks. Members of the Company's senior management also have day-to-day responsibility for risk management and establishing risk management practices. The Board oversees senior management in their risk management capacities, regularly reviewing and analyzing the Company's risk levels and reviewing and analyzing inventory risk each quarter as part of their review of quarterly financial statements. Members of the Company's senior management have an open line of communication to the Board and have the discretion to raise issues from time-to-time in any manner they deem appropriate.

companyName: URBAN OUTFITTERS INC

ticker: URBN


text: The Audit Committee supports the Board by considering and reviewing the adequacy of the Company's internal controls with management and the Company's internal audit department, including the processes for identifying significant cybersecurity/data privacy risks or exposures, and elicits recommendations for the improvements to such procedures where desirable. The Audit Committee periodically reviews the Company's data security and privacy policies, procedures and risks. Members of management are expected to report matters to the Audit Committee or to the Board as a whole, as appropriate. Management's reporting on issues relating to risk management typically occurs through direct communication with directors or committee members as matters requiring attention arise.


text: We maintain a Data Privacy & Security working group that is responsible for setting data security and privacy policies, overseeing those policies, and tracking and reporting on data security and privacy performance. The working group is comprised of our Chief Information Security Officer, Global Data Privacy Officer, Chief Administrative Officer, and General Counsel. The working group reports to the Audit Committee at least annually. In addition, the Company has an Impact Committee that maintains functional working groups that focus on a number of issues, including Data Privacy & Security. The Impact Committee reports to the Board at least annually. The Company's Global Data Privacy Officer reports to the Audit Committee at least quarterly and provides the Audit Committee with updates regarding the Company's data privacy environment. We also have a Chief Information Security Officer who provides quarterly updates to management and reports to the Audit Committee at least annually regarding the Company's data security environment.


text: Our Chief Information Security Officer is certified as a Certified Information Systems Security Professional (CISSP) and has significant experience in monitoring, implementation and management within the disciplines of information and personal data security, disaster recovery, and asset management. He has over 10 years of service in U.S. Army Cyber Operations and within U.S. Army Cyber Command. Our Global Data Privacy Officer has served as our head of Internal Audit for nearly 10 years and has received privacy-related certifications from the International Association of Privacy Professionals (IAPP) including Certified Information Privacy Manager (CIPM) and Certified Information Privacy Professional / Europe (CIPP/e).


text: We perform an annual training exercise for all employees and hold several cybersecurity awareness campaigns throughout the year. Where deemed appropriate, we engage independent security professionals to evaluate the Company's security environment. For example, we comply with Payment Card Industry Standards and are audited annually by a third party to confirm compliance with those Standards. In addition, the Company employs third party penetration testers to identify potential security weaknesses for evaluation and remediation. We also partner with government organizations and industry associations to share intelligence and quickly respond to emergent threats.


text: In order to identify, assess, protect, detect, respond to and recover from cybersecurity threats, we seek to employ multiple industry best practices, processes and controls to minimize the personal information in our possession, including pseudonymization, anonymization, tokenization and encryption. In addition, the Company maintains technical and organizational measures to ensure that personal information is accessible only by authorized personnel. In the event of a data breach, the Company is committed to notifying impacted customers and/or appropriate government entities in accordance with applicable law without unreasonable delay and in all events within the time period specified by applicable law.


text: The Company plans to use reasonable, cost effective, and secure methods for notifications in the event of a data breach. While we have experienced and may continue to experience certain cybersecurity incidents, we do not believe any such incidents incurred to date have materially affected our Company, results of operations, or financial condition. Additional information about cybersecurity risks we face is discussed in Item 1A — "Risk Factors — Operational Risks — 'If we are unable to safeguard against security breaches with respect to our information technology systems, our business and our reputation may be adversely affected'," which should be read in conjunction with the information above.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including, without limitation, intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal data (including sensitive personal data such as biometric data and employment-related data) ("Information Systems and Data").

companyName: Veritone, Inc.

ticker: VERI


text: Our Chief Information Officer ("CIO"), our Vice President of Information Security (who serves as our Chief Information Security Officer ("CISO")), and the Company's information security function help identify, assess and manage the Company's cybersecurity threats and risks. This team identifies and assesses risks from cybersecurity by monitoring and evaluating our threat landscape and the Company's risk profile using various methods, including, for example, manual and automated tools in certain environments and systems, subscribing to threat intelligence reports and services, scanning our environment for certain threats, evaluating our risk exposure, evaluating and analyzing certain reported threats, collaborating with law enforcement on certain threat intelligence, conducting internal and external cybersecurity audits, performing threat assessments in certain environments and systems, conducting vulnerability assessments in certain environments and systems, and engaging third-party experts for red/blue team testing and tabletop incident response exercises.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan, vulnerability management, disaster recovery and business continuity planning, risk assessments, encryption of certain data, network security controls in certain environments and systems, data segregation of certain data, access controls for certain environments and systems, physical security, asset management, vendor risk management, employee cybersecurity training, cybersecurity insurance, and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the information security team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms (including legal counsel), cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, forensic investigators, and penetration testing firms.