text: In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a third-party information technology team, which reports to our Senior Vice President of Human Resources and Administration, and includes mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data while also maintaining a stable information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, contract research organizations, and other contractors and suppliers. We have an incident response plan designed to mitigate and remediate identified cybersecurity incidents and escalate certain incidents as appropriate to management and the Audit Committee. We also conduct periodic employee trainings on cyber and information security, among other topics. As needed, we consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks in order to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: Assertio Holdings, Inc.

ticker: ASRT


text: Our Senior Vice President of Human Resources and Administration, who reports directly to our interim Chief Executive Officer, is responsible for overseeing the assessment and management of cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have no identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Data breaches and cyber-attacks can compromise our intellectual property or other sensitive information and cause significant damage to our business."

secItem: Item 1C


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board of Directors to oversee cybersecurity risks. The Audit Committee receives, at a minimum, quarterly updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President of Human Resources and Administration as well as other members of the senior leadership team, including, if necessary, the Chief Financial Officer. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Risk Management and Strategy In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks arising from internal and external cybersecurity threats and vulnerabilities from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a third-party information technology team, which reports to our Senior Vice President of Human Resources and Administration, and includes mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data while also maintaining a stable information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors. We have an incident response plan designed to mitigate and remediate identified cybersecurity incidents at both Assertio and our customers and vendors and escalate certain incidents to management and, as appropriate, the Audit Committee. We also conduct periodic employee trainings on cyber and information security, among other topics. As needed, we consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks in order to anticipate future threats and trends, and their impact on the Company's risk environment. Cybersecurity risks and threats are integrated into our enterprise risk management ("ERM") program, which establishes a risk management framework that seeks to identify and assess risks that could materially impact our business and operations.


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Board oversees the ERM program and oversees an enterprise-wide approach to risk management, including risks related to cybersecurity.


text: The Audit Committee, which is comprised solely of independent directors, has been designated by our Board of Directors to oversee cybersecurity risks. The Audit Committee receives, at a minimum, quarterly updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President of Human Resources and Administration as well as other members of the senior leadership team, including, if necessary, the Chief Financial Officer. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Our Senior Vice President of Human Resources and Administration, who reports directly to our Chief Executive Officer and has been responsible for overseeing the assessment and management of cybersecurity risks at Assertio for approximately a year and a half.


text: Since the beginning of the last fiscal year, there were no identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Business interruptions, including data breaches and cyber-attacks can compromise our intellectual property or other sensitive information and cause significant damage to our business, can limit our ability to operate our business, and adversely impact the success of our commercialization partners."


text: Risk management and Strategy We have implemented a set of comprehensive cybersecurity and data protection policies and procedures placing special interest in addressing cybersecurity threats and effectively managing associated risks. Our cybersecurity program is designed to identify, assess, and proactively manage material risk from cybersecurity threats, which are integrated into our overall risk management systems, as overseen by the Company's Board of Directors, primarily through its Audit Committee. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system. Our information technology, or IT, program is led by our Director of Information Technology, who strives to monitor and mitigate risks from cybersecurity threats and provides reporting to the Audit Committee.

companyName: American Outdoor Brands, Inc.

ticker: AOUT


text: Our approach to cybersecurity is not a one-time effort but an ongoing process. We engage in monitoring, risk assessments, and robust security measures designed to ensure the confidentiality, integrity, and availability of our information systems, including critical computer networks, hosted services, communication systems, hardware, and software and to protect critical data, including our employees' and customers' data, intellectual property, confidential and proprietary data, and strategic competitive information. We address cybersecurity challenges and enhance our overall risk management efforts by adopting and working to integrate recognized best practices, standards, and controls utilizing guidelines from the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) for our protection and prevention of cybersecurity, risk management, data backup, and disaster recovery.


text: Our cybersecurity program includes some key aspects such as (i) a Cybersecurity Leader who oversees our day-to-day program, (ii) outsourced information technology firm and consultants with significant expertise in cybersecurity (iii) an incident response team comprised of a cross-section of management with oversight over our programs, (iv) incident detection and response policies, and (v) ongoing security awareness training programs for all employees.


text: We maintain a practical approach to cybersecurity. Our cybersecurity risk management program (an integral part of our overall Enterprise Risk Management Program) is designed to incorporate guidance from NIST CSF and other industry best practices. Within our program, we conduct internal and external security-based activities, including reviews and assessments of our third-party service providers and vendors. Our employees receive a formal cybersecurity awareness training on an annual basis, including specific topics related to social engineering and email frauds.


text: Detailed activities include: • Continuous Monitoring and Detection: Leveraging industry leading technologies to detect and alert on any suspicious activity across the enterprise to prevent and minimize cybersecurity attacks; • Information Security Assessments: Collaborating with internal and external partners to evaluate our data and network security; • Vulnerability Scanning and Penetration Testing: Engaging third-party service providers to assess internal and external vulnerabilities and potential threats; • Cyber Risk Register Reviews: Regularly reviewing our internal risk register to remain fully informed and prepared to address potential and identified risks; • Risk Prioritization: Prioritizing and addressing risks through our dedicated cybersecurity risk management program and cybersecurity council; • Annual Third-Party SOC Reviews: Ensuring that our financially critical service partners maintain effective internal controls, including access controls, change management, backup, and disaster recovery planning; and • Tabletop Exercises and Event Simulations: Engaging all employees across the company to build awareness, education, and enhance our cyber response posture and the collective team decision-making processes. For more information about these risks, see the risk factor titled "Our business is subject to the risk of terrorism, cyberattacks, or failure of key information technology systems," "Breaches of our information systems could adversely affect our reputation, disrupt our operations, and result in increased costs and loss of revenue," and "If our efforts to protect the security of personal information related to any of our customers, consumers, vendors, or employees are unsuccessful and unauthorized access to that personal information is obtained, or we experience a significant disruption in our computer systems or a cyber security breach, we could experience an adverse effect on our operations, we could be subject to costly government enforcement action and private litigation, and our reputation could suffer" under Item 1A.


text: Our Board of Directors has assigned oversight of cybersecurity risk management to the Audit Committee. The Audit Committee regularly receives reports from management, including IT leadership, and third parties on cybersecurity matters. In addition, our full Board of Directors receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates. We periodically engage third-party audit and legal firms with industry-recognized expertise on cybersecurity matters to review specific aspects of our cybersecurity enterprise risk management framework and controls.


text: IT leadership is responsible for developing appropriate cybersecurity programs, including as may be required by applicable law or regulation. This includes the coordination and creation of an Incident Response Policy, Incident Response Team, and Incident Response Plan in the event of a cybersecurity event. The AOB Incident Response policy covers our internal program and guidelines. The incident response team is composed of various stakeholders from all necessary aspects of the business, and the plan includes the steps to follow and communications necessary if/when a cybersecurity event occurs. The individual incident response team members represent expertise in IT, cybersecurity, finance, and operations that has been obtained generally from a combination of education and awareness, including relevant degrees and/or certifications, and work experience. The Director of IT has served in various roles in information technology and information security for 30 years, including serving in technical management and leadership positions in multiple verticals. The Director of IT holds undergraduate and graduate degrees in computer science and has attained several recognized network and security certifications throughout their career. The individual incident response team members are informed by their respective cybersecurity teams regarding the monitoring, prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.


text: Information regarding cybersecurity risks may be elevated by IT leadership through a variety of channels, including discussions between or among key leaders and our management and reports to the Company's Board of Directors and/or certain Board committees. When a cybersecurity incident is detected, we conduct an immediate assessment, determine materiality, and take appropriate actions as described above. This process is also followed when we are notified that a supplier has a cybersecurity incident. As noted above, the Audit Committee regularly receives reports on cybersecurity matters from senior IT leadership.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Alight recognizes the importance of developing, implementing and maintaining robust cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity and availability of the data in our care. The Company utilizes a cross-functional group of colleagues representing various stakeholders including technology, security, finance, internal audit, legal and others to identify and manage risks across the organization, including risks relating to cybersecurity.

companyName: Alight, Inc. / Delaware

ticker: ALIT


text: The Company's cybersecurity program is focused on continuous improvement and takes a layered approach to cybersecurity to include prevention, detection, and response-based controls. Our preventative measures include network-based controls, malware defenses, email security, encryption for data in motion and at rest, continuous vulnerability testing and mitigation, and multi-factor authentication. Our detection and response measures include comprehensive logging and continuous monitoring utilizing both in-house and Managed Security Services, forensics capability, and an enterprise crisis management function. Alight employees are assigned data privacy and security training upon on-boarding and annually thereafter. The training is designed in collaboration with a third-party service provider and is designed to raise awareness of security practices and to educate employees on how to protect information and infrastructure.


text: To support the overall cybersecurity program, Alight maintains an incident management team that tracks and logs privacy and security incidents across Alight, our vendors, and partners to better manage remediation and resolution of any such incidents. Significant incidents are promptly reviewed by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is escalated for further review, and then reported to designated members of our executive leadership team where needed. We consult with outside counsel and forensics firms as appropriate, including on materiality analysis and disclosure matters, and members of our executive leadership team make the final materiality determinations and, if appropriate, disclosure to law enforcement, regulators or clients. Our executive leadership team apprises Alight's Board of Directors and our independent public accounting firm of significant matters and any relevant developments.


text: Our cybersecurity frameworks are informed by third-party standards relevant to our industry such as the National Institute of Standards and Technology, the Center for Internet Security and the International Standards Organization. We regularly test our cybersecurity defenses through both automated and manual testing to identify, prioritize and remediate risk. Alight also engages third parties to examine and report on the effectiveness of our controls relating to our systems, including those used in the cybersecurity frameworks.


text: Our Chief Technology Officer, Chief Information & Security Officer and Chief Legal Officer provide periodic reports on our cybersecurity and risk management efforts, including with respect to information security practices, to the Audit Committee of our Board of Directors (the "Audit Committee"), as well as to other members of our executive leadership team, as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Where appropriate, the Audit Committee then periodically reports to the full Board of Directors regarding the Company's assessment of potential risk exposures and the steps management has taken to monitor and control such risks, which includes the Company's cybersecurity program designed to prevent, detect, and rapidly respond to any potential incident. In addition to our scheduled meetings, the Audit Committee and executive leadership team maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on significant developments in cybersecurity to facilitate proactive and responsive oversight. The Audit Committee is apprised of strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement helps drive integration of cybersecurity considerations into our Company's broader strategic objectives.


text: Additionally, because Alight partners with a number of third parties in the ordinary course of business, our management team has developed and implemented processes to oversee and manage significant risks associated with use of third-party service providers. We conduct thorough security assessments of critical third-party providers before engagement and periodically monitor vendor compliance with our security standards. The monitoring includes periodic assessments by our vendor management team and use of an independent vendor risk rating service that alerts Alight when there is a change in a service providers security posture. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Our Chief Information & Security Officer has over 30 years of experience in the cybersecurity industry, including, prior to joining Alight in 2021, as the SVP, Chief Information Security Officer at a multinational health insurance and health services company in the Fortune 100, and as head of cybersecurity for a U.S.-based financial services company in the Fortune 500, as well as for a federal banking institution and for a professional services company in the Fortune 500 specializing in information technology services. Our Chief Information & Security Officer reports directly to the Chief Technology Officer and meets regularly with other members of senior management and the Audit Committee.


text: Our program is regularly evaluated by internal stakeholders and external parties with the results of those reviews reported to the executive leadership team and the Audit Committee, as appropriate. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. Our results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future incidents. To further preemptively mitigate the potential financial impact of cybersecurity incidents, we maintain liability insurance that includes cyber coverage. However, our insurance may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our insurance may not cover any or all incidents that occur or claims made against us, and addressing an incident or defending a suit, regardless of its merit, could be costly and divert management's attention from our business and operations. For more information on our cybersecurity related risks, see the Risk Factors in Item 1A. of this Annual Report.


text: Cybersecurity Risk Management and Strategy We have established and implemented a cybersecurity risk management program and information privacy program (collectively, our "Cybersecurity and Privacy Programs") that are collectively intended to protect the confidentiality, integrity, and availability of our critical information systems and the information residing therein. These programs are integrated into, and form a part of, our overall enterprise risk management program, and share similar methodologies, reporting channels and governance processes to those that apply across the broader enterprise risk management framework.

companyName: GoodRx Holdings, Inc.

ticker: GDRX


text: Our Cybersecurity and Privacy Programs include: • Teams responsible for managing security and privacy controls, risk assessments, and responding to cybersecurity incidents; • Security and privacy awareness training of our employees; • Privacy and security risk assessments designed to identify material privacy and/or cybersecurity risks to our systems, processes, and assets; • The use of external service providers to assist with privacy and security controls, including vulnerability management; • An incident response plan with trained personnel and personnel that are trained to execute the plan; and, • A third-party risk management process for service providers and vendors.


text: We are subject to an evolving threat landscape that could pose various risks to our business, and such risks are regularly evaluated and managed via our Cybersecurity and Privacy Programs by internal and external experts. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information regarding risks related to cybersecurity matters, please see Part I, Item 1A, "Risk Factors—We depend on our information technology systems, and those of our third-party vendors, contractors and consultants, and any failure or significant disruptions of these systems, security breaches or loss of data could materially adversely affect our business, financial condition and results of operations."


text: Cybersecurity Governance Our Board and its committees have an active role in overseeing risk management and they have delegated to the Compliance Committee oversight over our cybersecurity and data privacy risks. The Compliance Committee oversees management's implementation of our Cybersecurity and Privacy Programs, except to the extent direct oversight by the Board is required by the FTC Order.


text: The Compliance Committee receives periodic reports from management regarding cybersecurity and privacy risks, any material updates thereto and a summary of any cybersecurity and/or privacy events or incidents that have occurred, in each case, since the most recent update provided to the Compliance Committee. The Compliance Committee reports to the full Board regarding its activities, including those related to cybersecurity and privacy. In addition, at least once every twelve months and promptly after the occurrence of certain specified cybersecurity/data privacy incidents, the Board and our Interim Chief Executive Officer receive the written Cybersecurity and Privacy Program materials, which include the results of the most recent cybersecurity and privacy risk assessment and any evaluations thereof or updates thereto (collectively, the "Reporting Materials"). On an annual basis, management also leads the Board through a comprehensive review of the Reporting Materials, including, among other things, a review of the identified material cybersecurity and privacy risk exposures and the safeguards implemented to control such risk exposures.


text: Our Security Team is responsible for assessing and managing our material risks from cybersecurity threats and is primarily responsible for our overall Cybersecurity and Privacy Programs and collaborates with other employees and third parties to identify and mitigate applicable risks. The Security Team's experience includes various industry certifications (e.g., CISSP, CISM, CCSP, CISA, etc.), and industry experience (e.g., healthcare, technology, critical infrastructure, etc.).


text: Under the Cybersecurity and Privacy Programs, our Security Team monitors, prevents, detects, mitigates, and remediates cybersecurity risks and incidents via various means, including monitoring threat intelligence from various sources, internal and external vulnerability management, and alerts and reports produced by security tools. Reporting of such risks is regularly provided to the Board and the Compliance Committee, as applicable.


text: Cybersecurity Risk Management and Strategy We have established and implemented a cybersecurity risk management program and information privacy program (collectively, our "Cybersecurity and Privacy Programs") that are collectively intended to protect the confidentiality, integrity, and availability of our critical information systems and the information residing therein. These programs are integrated into, and form a part of, our overall risk management program, and share similar methodologies, reporting channels and governance processes to those that apply across the broader risk management framework.


text: Key elements of our Cybersecurity and Privacy Programs include, bu t are not limited to the following: • Teams responsible for managing security and privacy controls, risk assessments, and responding to cybersecurity incidents; • Security and privacy awareness training of our employees; • Privacy and security risk assessments designed to identify material privacy and/or cybersecurity risks to our systems, processes, and assets; • The use of external service providers to assist with privacy and security controls, including vulnerability management; • An incident response plan with trained personnel and personnel that are trained to execute the plan; and, • A third-party risk management process for service providers and vendors.


text: We are subject to an evolving threat landscape that could pose various risks to our business, and such risks are regularly evaluated and managed via our Cybersecurity and Privacy Programs by internal and external experts. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. For more information regarding risks related to cybersecurity matters, please see Part I, Item 1A, "Risk Factors—We depend on our information technology systems, and those of our third-party vendors, contractors and consultants, and any failure or significant disruptions of these systems, security breaches or loss of data could materially adversely affect our business, financial condition and results of operations."


text: Cybersecurity Governance Our Board and its committees have an active role in overseeing risk management and they have delegated to the Audit and Risk Committee oversight over our cybersecurity and data privacy risks, including oversight of management's implementation of our Cybersecurity and Privacy Programs, except to the extent direct oversight by the Board is required by the FTC Order. The Audit and Risk Committee oversees management's implementation of our Cybersecurity and Privacy Programs, except to the extent direct oversight by the Board is required by the FTC Order.


text: The Audit and Risk Committee receives periodic reports from management regarding cybersecurity and privacy risks, any material updates thereto and a summary of any cybersecurity and/or privacy events or incidents that have occurred, in each case, since the most recent update provided to the Audit and Risk Committee. The Audit and Risk Committee reports to the full Board regarding its activities, including those related to cybersecurity and privacy. In addition, at least once every twelve months and promptly after the occurrence of certain specified cybersecurity/data privacy incidents, the Board and our Chief Executive Officer and President receive the written Cybersecurity and Privacy Program materials, which include the results of the most recent cybersecurity and privacy risk assessment and any evaluations thereof or updates thereto (collectively, the "Reporting Materials"). On an annual basis, management also leads the Board through a comprehensive review of the Reporting Materials, including, among other things, a review of the identified material cybersecurity and privacy risk exposures and the safeguards implemented to control such risk exposures.


text: Our Security Team is responsible for assessing and managing our material risks from cybersecurity threats and is primarily responsible for our overall Cybersecurity and Privacy Programs and collaborates with other employees and third parties to identify and mitigate applicable risks. Our Security Team is composed of certified cybersecurity professionals responsible for assessing and managing cybersecurity risks, led by the Senior Director of Information Security & Compliance. The qualifications of our Security Team include the following industry-recognized certifications: ISC2 Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (C|EH), Certified Incident Handler (GCIH), Certified Intrusion Analyst (GCIA), GSEC, CompTIA Security+, A+ Network+, CISM, CCSK, MCSA, MCSE, MCP, MCT, and Cisco Certified Network Associate (CCNA). The Senior Director of Information Security & Compliance reports to our Chief Technology Officer, who has over 19 years of experience in information technology. The Senior Director of Information Security & Compliance brings over 13 years of experience in risk management, cybersecurity and compliance. The Security Team's experience in information security and cybersecurity spans across various industries, including healthcare, technology, and critical infrastructure.


text: Under the Cybersecurity and Privacy Programs, our Security Team monitors, prevents, detects, mitigates, and remediates cybersecurity risks and incidents via various means, including monitoring threat intelligence from various sources, internal and external vulnerability management, and alerts and reports produced by security tools. Reporting of such risks is regularly provided to the Board and the Audit and Risk Committee, as applicable.


text: We are materially dependent upon our networks, information technology infrastructure and related technology systems to provide services to our customers, manage our internal operations and support our strategic objectives. Cyber-attacks have become prevalent in our industry, and the techniques used to sabotage or obtain unauthorized access to systems are constantly expanding and evolving. Malicious actors are increasingly sophisticated in their methods, tactics, techniques and procedures, seeking to steal money, gain unauthorized access to, destroy or manipulate data, and disrupt operations.

companyName: Rackspace Technology, Inc.

ticker: RXT


text: As of the date of this report, we have not identified any cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably anticipated to have a material adverse effect on our business. However, we have experienced and expect to continue to experience cybersecurity threats and cybersecurity incidents. As an example, in December 2022, we previously disclosed a ransomware incident that caused service disruptions for our Hosted Exchange customers. We are committed to maintaining robust governance and oversight of cybersecurity risks and implementing recognized industry best practices to help prevent, detect, mitigate and respond to these risks; however, we cannot provide assurance that cybersecurity risks will not materially affect our business in the future, including our business strategy, results of operations, or financial condition or that our controls, processes and procedures will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems.


text: Cybersecurity threats, whether or not successful, could result in our incurring significant costs related to rebuilding our internal systems, writing down inventory value, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We have seen an increase in cyberattack volume, frequency and sophistication.


text: See "Risk Factors - Security breaches, cyber-attacks and other interruptions to our or our third-party service providers' infrastructure have disrupted and may continue to disrupt our internal operations and we may be exposed to claims and liability, lose customers, suffer harm to our reputation, lose business-critical compliance certifications and incur additional costs." for more information on our cybersecurity risks.


text: Risk Management and Strategy Cybersecurity risk management is a component of the company's broader enterprise risk management program and we have established cybersecurity policies and procedures to protect against and mitigate harm from cybersecurity incidents. We respond to cybersecurity incidents in accordance with our cybersecurity policies and procedures and applicable law. Rackspace maintains a cross-functional approach to cybersecurity risk, which is designed to help prevent, identify, assess, manage, mitigate, and respond to cybersecurity threats.


text: Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, manage and address material cybersecurity risks. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our operations, systems, network, data, products and/or services, and have processes to assess those issues for potential cybersecurity impact or risk.


text: We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. Our cybersecurity policies and procedures include incident response plans which guide our employees, senior management, the Audit Committee and the Board on our response to cybersecurity incidents, including escalation processes, as appropriate.


text: Our team engages with external cybersecurity advisors and experts, including outside counsel and outside cybersecurity firms, assessors, auditors and consultants as necessary or appropriate. We also maintain numerous industry-related compliance certifications for various aspects of our business, such as International Organization for Standardization ("ISO") 27001, Service Organization Controls ("SOC 1, 2, 3") and Payment Card Industry ("PCI"), Federal Information Security Management Act ("FISMA"), Federal Risk and Authorization Management Program ("FedRAMP") and Health Information Trust Alliance ("HITRUST") in the U.S., Information Security Registered Assessors Program ("IRAP") in Australia and Public Services Network ("PSN") in the U.K.


text: Our cybersecurity policies and procedures are designed to vet key third-party providers and provide for oversight and cooperation regarding cybersecurity incidents. In addition, our cybersecurity policies and procedures require our third-party providers to meet appropriate security requirements and we investigate security incidents that have impacted our third-party providers, as appropriate; however, our ability to monitor our third-party service providers' data security is limited.


text: The Audit Committee of our Board of Directors (the "Board") oversees our cybersecurity risk. The Audit Committee receives regular cybersecurity specific updates from management (including our Chief Security Officer ("CSO") and/or other key personnel), typically on a quarterly basis, about the prevention, detection, mitigation, and remediation of cybersecurity threats and cybersecurity incidents, as well as the evolving cybersecurity landscape, recent program enhancements and other relevant topics. The Audit Committee reports to our Board and a number of our Audit Committee and Board members have experience in assessing and managing cybersecurity risks. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated to the Audit Committee and/or the Board on an as-needed basis.


text: Management's Role Our CSO leads our overall cybersecurity function and supervises our cybersecurity team's efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents. She provides regular updates directly to the Audit Committee, typically on a quarterly basis. She has over 20 years of experience in information security leadership positions, including with large technology and healthcare companies as well as several large financial institutions. She holds a BS from Arizona State University and has been with us since 2019.


text: Our CSO reports to our President – Artificial Intelligence, Technology and Sustainability, who has been a CIO or CTO of two other large publicly traded companies. He provides overall leadership and guidance for the company's technology department, including the cybersecurity team. He holds an MBA in international business from The Ohio State University, an MCA in computer science from the University of Mumbai, a BS in physics from the University of Madras and has been with us since 2021.


text: Key security, risk, and compliance personnel across a cross-functional group of internal stakeholders, including senior management, meet regularly to develop and continually evaluate our cybersecurity policies and procedures, including discussions of the following: • cybersecurity strategies for preservation of the confidentiality, integrity and availability of company and customer information; • identification, prevention and mitigation of cybersecurity threats and incidents; and • effective response to cybersecurity incidents (including escalation procedures of certain cybersecurity incidents so that decisions regarding public disclosure and other required reporting can be made by the appropriate personnel in a timely manner).


text: The Audit Committee of our Board oversees our cybersecurity risk. The Audit Committee receives regular cybersecurity specific updates from management (including our CSO and/or other key personnel), typically on a quarterly basis, about the prevention, detection, mitigation, and remediation of cybersecurity threats and cybersecurity incidents, as well as the evolving cybersecurity landscape, recent program enhancements and other relevant topics. The Audit Committee reports to our Board and a number of our Audit Committee and Board members have experience in assessing and managing cybersecurity risks. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated to the Audit Committee and/or the Board on an as-needed basis.


text: Management's Role Our CSO leads our overall cybersecurity function and supervises our cybersecurity team's efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents. She provides regular updates directly to the Audit Committee, typically on a quarterly basis. She has over 20 years of experience in information security leadership positions, including with large technology and healthcare companies as well as several large financial institutions. She holds a Bachelor of Science from Arizona State University and has been with us since 2019.


text: Our CSO reports to our President – Artificial Intelligence, Technology and Sustainability, who has been a Chief Information Officer or Chief Technology Officer of two other large publicly traded companies. He provides overall leadership and guidance for the company's technology department, including the cybersecurity team. He holds a Master of Business Administration in international business from The Ohio State University, a Master of Computer Applications in computer science from the University of Mumbai, a Bachelor of Science in physics from the University of Madras and has been with us since 2021.


text: We are committed to our privacy and security programs, and our security team strives to protect our customer and employee data from cybersecurity risks. From time to time, and at least annually, we review and update if necessary our privacy standards and policies in response to evolving regulatory requirements and internal Unity requirements. Unity personnel are provided annual privacy training, with additional targeted training for key participants in our privacy program. We have procedures in place to address suspected personal-data breaches and notify users determined to be affected and applicable regulator of a breach where we are legally required to do so.

companyName: Unity Software Inc.

ticker: U


text: We have a security policy which outlines mandatory security requirements for all of our employees, contractors or other agents. This policy is supported by internal standards, directives and procedures. The security program includes implementation of software security throughout the development life cycle, vulnerability and configuration management software across certain data infrastructure, products and services. Our risk management process includes employee education and annual analysis of risks from across the company, which are then prioritized for remediation. Our approach to cybersecurity is integrated into our overall company-wide approach to risk management, including that our management team, including our Chief Security Officer and Data Privacy Officer, evaluates material risks from cybersecurity threats against our overall business objectives and regularly reports to both the Audit Committee of our board of directors and to our internal audit function which evaluates our overall enterprise risk.


text: We engage third party services in connection with our processes for vendor security reviews and incidents. We are continuing to develop our processes to oversee and identify the risks from cybersecurity threats associated with our use of any third-party service provider.


text: Because our business involves the collection, use, storage, and transmission of personal information, we are subject to numerous federal, state, local, and foreign laws, regulations, and other obligations relating to privacy and data security. Countries around the world have adopted or are proposing similar laws and regulations relating to privacy and data security, and we may become subject to them as we expand our operations into new geographic markets.


text: Our Chief Security Officer and Data Privacy Officer oversee our assessment, prevention, detection and management of cybersecurity risks, and report to our executive team, including our Chief Information Officer, Chief Financial Officer and Chief Legal Officer. Collectively, they have expertise in cybersecurity, privacy law and regulation, and governance, and their teams comprise personnel with a broad range of experience across the private and public sectors, the technology industry, and in different geographic regions. Our Chief Security Officer Security has over 25 years of experience in multiple business verticals and has led security organizations and managed global practices for Fortune 500 technology companies. He became our Chief Security Officer earlier this year after previously serving in that role at ironSource, prior to its merger with us.


text: Our security team follows an incident response process which we are continuing to evaluate and enhance. Pursuant to this process, incidents which may result in economic loss to the company, reputational harm or require notifications to individuals and government authorities are reported to our executive team as they are occurring. Our Chief Security Officer also provides a quarterly summary of investigations given to an executive data council, and our Data Privacy Officer reports on our compliance posture with respect to new and pending laws and regulations.


text: The Audit Committee of our board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats. Additionally, the Audit Committee of our board of directors meets on a quarterly basis with our Chief Security Officer about our cybersecurity risk management and strategy, including any significant investigations, and biannually with our Data Privacy Officer about our privacy program.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. Refer to "Item 1A. Risk Factors" for a description of the risks from cybersecurity threats that may materially affect the Company, including the risk factor titled, "If we or our third-party service providers experience a security breach or unauthorized parties otherwise obtain access to our customers' data, our data, or our platform, our platform may be perceived as not secure, our reputation may be harmed, our business operations may be disrupted, demand for our solutions may be reduced, and we may incur significant liabilities". Unity Software Inc.


text: We are committed to our privacy and security programs, and our security team strives to protect our customer and employee data from cybersecurity risks. From time to time, and at least annually, we review and update if necessary our privacy standards and policies in response to evolving regulatory requirements and internal Unity requirements. Unity personnel are provided annual privacy training, with additional targeted training for key participants in our privacy program. We have procedures in place to address suspected security breaches and notify users determined to be affected and applicable regulators of a breach where we are legally required to do so.


text: We have a security policy which outlines mandatory security requirements for all of our employees, contractors or other agents. This policy is supported by internal standards, directives and procedures. The security program includes implementation of software security throughout the development life cycle, vulnerability and configuration management software across certain data infrastructure, products and services. Our risk management process includes employee education and annual analysis of risks from across the company, which are then prioritized for remediation. Our approach to cybersecurity is integrated into our overall company-wide approach to risk management. Our management team, including our Deputy Chief Security Officer and our Data Privacy Officer, evaluates risks from cybersecurity threats against our overall business objectives and regularly reports to both the Audit Committee of our board of directors and to our internal audit function which evaluates our overall enterprise risk.


text: We engage third party services in connection with our processes for vendor security reviews and incidents. We are continuing to refine our processes to oversee and identify the risks from cybersecurity threats associated with our use of any third-party service provider.


text: Because our business involves the collection, use, storage, and transmission of personal information, we are subject to numerous federal, state, local, and foreign laws, regulations, and other obligations relating to privacy and data security. Countries around the world have adopted or are proposing similar laws and regulations relating to privacy and data security, and we may become subject to them as we expand our operations into new geographic markets. Unity Software Inc.


text: Our Deputy Chief Security Officer and Data Privacy Officer oversee our assessment, prevention, detection and management of cybersecurity risks, and report to our executive team, including our Chief Information Officer, Chief Financial Officer and Chief Legal Officer. Collectively, they have expertise in cybersecurity, privacy law and regulation, and governance, and their teams comprise personnel with a broad range of experience across the private and public sectors, the technology industry, and in different geographic regions. Our Deputy Chief Security Officer Security has over 25 years of experience in multiple business verticals and has led security organizations and managed global practices for Fortune 500 technology companies. He became our Deputy Chief Security Officer after previously serving in that role at ironSource, prior to its merger with us.


text: Our security team follows an incident response process which we are continuing to evaluate and enhance. Pursuant to this process, incidents which may result in economic loss to the company, reputational harm or require notifications to individuals and government authorities are reported to our executive team. Our Chief Security Officer also provides a quarterly summary of investigations given to an executive data council, and our Data Privacy Officer reports on our compliance posture with respect to new and pending laws and regulations.


text: In 2024, we did not identify any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents. Refer to "Item 1A. Risk Factors" for a description of the risks from cybersecurity threats that may materially affect the Company, including the risk factor titled, "If we or the third parties with whom we work experience a security breach or unauthorized parties otherwise obtain access to our customers' data, our data, or our platform, our platform may be perceived as not secure, our reputation may be harmed, our business operations may be disrupted, demand for our solutions may be reduced, and we may incur significant liabilities".


text: We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted substantial financial and personnel resources to implement and maintain security measures to meet regulatory requirements, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Our risk factors, which can found be found in Item 1A. "Risk Factors," include further detail about the material cybersecurity risks we face. We have had no cybersecurity incidents to date, and can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Texas Pacific Land Corp

ticker: TPL


text: We employ a risk-based approach to cybersecurity which aligns with corporate strategy, risk management and governance, and adaptable information technology ("IT") infrastructure. Our cybersecurity program consists of policies, procedures, systems, controls and technology designed to help prevent, identify, detect and mitigate cybersecurity risk and is based on the National Institute of Standards and Technology ("NIST") Cybersecurity framework.


text: We have integrated cybersecurity risk management into our overall risk management framework by (i) maintaining disaster recovery, business continuity and security incident recovery plans, (ii) conducting annual enterprise and IT risk assessments, (iii) implementing periodic key risk indicator tracking, and (iv) holding regular cross-departmental meetings to address cybersecurity risks.


text: Our risk management activities and cybersecurity strategy include IT policies, standards, procedures and systems to address and mitigate risks for critical system availability, network integrity, information protection, and operational continuity.


text: We perform vulnerability and threat monitoring mitigation activities on a regular basis and perform a cybersecurity risk assessment at least annually. Our cybersecurity risk assessment program includes the following assessments and activities: • ensure program alignment with the NIST Cybersecurity framework; and, • prioritize, remediate and ensure effectiveness of critical applications, infrastructure, and information.


text: We regularly collaborate with the Company's internal audit department and third parties with security and infrastructure expertise for review and evaluation of the Company's cybersecurity risk program and the associated IT control environment. We engage third-party service providers to perform annual external penetration testing, disaster recovery testing, and security incident simulations.


text: Infrastructure; Network and Physical Security Our IT infrastructure is secured and continually monitored using a number of tools to effect physical and logical security. We strictly regulate and limit access to servers and networks. Network access is controlled by the network firewall and restricted by stringent access control lists. We also employ (i) network and endpoint intrusion prevention and detection throughout our infrastructure, (ii) systems that monitor our infrastructure and alert our management of potential cybersecurity issues and vulnerabilities, and (iii) a seasoned process for managing and installing patches for third-party applications.


text: We have also implemented the following protective and preventative measures: • identity management and access control safeguards; • encryption of data in transit and at rest; • system and network security and monitoring; • information protection and governance; and, • ongoing systems and equipment maintenance.


text: Incident Response and Recovery Planning We have instituted cybersecurity event detection systems, methods, and supporting processes to perform continuous monitoring, identify and classify events and anomalies, take appropriate actions when necessary and report incidents to the appropriate parties. Our response and recovery capabilities are designed to, among other things, contain any impacts, analyze and mitigate events, track events to resolution, provide effective stakeholder communication, recover and resume operations, and evaluate and improve systems and methods.


text: Third-Party Risk Management We have implemented and continue to maintain the Company's IT policies, standards, procedures, and controls to oversee, identify and manage cybersecurity risks associated with all third-party service providers. These include, but are not limited to, an IT acceptable use policy, a records and information management policy, change control procedures, risk and control registry, attestation report reviews, and configuration standards.


text: Education and Awareness Our policies require each of our employees to complete annual information security training, in addition to other training requirements. The result is an educated, informed, and prepared workforce, with an awareness of potential cybersecurity threats, how they may occur, and how to report and escalate such matters. These training efforts are supplemented with regular corporate-led communications and outreach initiatives to facilitate cybersecurity awareness and ensure employees remain vigilant and informed about cybersecurity threats and trends.


text: Both management and the Board are actively involved in the oversight of risks from cybersecurity threats. TPL's information security program is designed to ensure that management and the Board are adequately informed about, and provided with the tools necessary to monitor, (i) material risks from cybersecurity threats and (ii) the Company's efforts related to the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of the Board The Board has delegated to the Audit Committee of the Board (the "Audit Committee") primary responsibility for overseeing enterprise risk management, including oversight of risks from cybersecurity threats. The Audit Committee periodically reviews TPL's policies and practices, including incident response plans, for managing cybersecurity risks to ensure that such policies and practices are appropriately tailored to TPL's risk framework. Throughout the year, the Audit Committee receives quarterly IT and cybersecurity updates unless there is a notable event that requires immediate communication. These quarterly updates include cybersecurity risk assessment updates from TPL's Director of Information Technology, including key risk indicators, the steps management has taken to monitor and control such cybersecurity risk exposure, and continuous improvement efforts. In addition to the risk management experience of the Audit Committee members, Ms. Duganier holds the CERT Cybersecurity Oversight Certification from Carnegie Mellon University.


text: Role of Management TPL's cybersecurity risk is managed utilizing a multi-tiered approach by the Company's Director of Information Technology. In addition to the Director of Information Technology, the Company also engages the services of a third party chief information security officer ("CISO"). The qualifications of the Director of Information Technology include over 30 years of IT management, cybersecurity, and information governance experience. The CISO, who reports to the Director of Information Technology, has 21 years of cybersecurity, IT management, and infrastructure consulting experience and is a certified CISO. The Director of Information Technology is regularly informed about the latest developments in cybersecurity, including potential threats, vulnerabilities, and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: The Director of Information Technology oversees risk management and strategy through (i) an IT operating committee ("the IT Operating Committee") made up of the Director of Information Technology, the CISO, and the Company's department heads, which is responsible for the establishment and review of the Company's IT governance, risk management and compliance, and (ii) an IT steering committee (the "IT Steering Committee") made up of the Company's executives, which provides guidance and oversight to support and achieve TPL's IT objectives, including cybersecurity. Both the IT Operating Committee and the IT Steering Committee meet on a quarterly basis. The IT Operating Committee reviews monthly reports on cybersecurity incident prevention, mitigation, detection, and remediation and reviews the Company's plans and policies related to IT processes on an annual basis. The Director of Information Technology also coordinates with the Company's internal audit department and the Audit Committee to ensure cybersecurity is represented and addressed within the Company's enterprise risk management strategy.


text: We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted substantial financial and personnel resources to implement and maintain security measures to meet regulatory requirements, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. Despite these efforts, our policies and procedures may not be properly followed in every instance and may not always be effective. Our risk factors, which can found be found in Part I, Item 1A. "Risk Factors," include further detail about the material cybersecurity risks we face. We have had no cybersecurity incidents or other risks from cybersecurity threats to date that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition.


text: We employ a risk-based approach to cybersecurity which aligns with our corporate strategy, risk management and governance, and adaptable information technology ("IT") infrastructure. Our cybersecurity program consists of policies, procedures, systems, controls and technology designed to help prevent, identify, detect and mitigate cybersecurity risk and is based on the National Institute of Standards and Technology ("NIST") Cybersecurity framework.


text: We regularly collaborate with the Company's internal audit department and third parties with security and infrastructure expertise for review and evaluation of the Company's cybersecurity risk program and the associated IT control environment. We engage third-party service providers to perform annual external and internal penetration testing, disaster recovery testing, and security incident simulations.


text: Infrastructure: Network and Physical Security Our IT infrastructure is secured and continually monitored using a number of tools to effect physical and logical security. We strictly regulate and limit access to servers and networks. Network access is controlled by the network firewall and restricted by stringent access control lists. We also employ (i) network and endpoint intrusion prevention and detection throughout our infrastructure, (ii) systems that monitor our infrastructure and alert our management of potential cybersecurity issues and vulnerabilities, and (iii) a seasoned process for managing and installing patches for third-party applications.


text: We have also implemented the following protective and preventative measures: • identity management and access control safeguards; • encryption of data in transit and at rest; • system and network security and monitoring; • information protection and governance; and • ongoing systems and equipment maintenance.


text: Incident Response and Recovery Planning We have instituted cybersecurity event detection systems, methods, and supporting processes to perform continuous monitoring, identify and classify events and anomalies, take appropriate actions when necessary, and report incidents to the appropriate parties. Our response and recovery capabilities are designed to, among other things, contain any impacts, analyze and mitigate events, track events to resolution, provide effective stakeholder communication, recover and resume operations, and evaluate and improve systems and methods.


text: Third-Party Risk Management We have implemented and continue to maintain our IT policies, standards, procedures, and controls to oversee, identify and manage cybersecurity risks associated with all third-party service providers. These include, but are not limited to, an IT acceptable use policy, a records and information management policy, change control procedures, risk and control registry, attestation report reviews, and configuration standards.


text: Both management and the Board are actively involved in the oversight of risks from cybersecurity threats. Our information security program is designed to ensure that management and the Board are adequately informed about, and provided with the tools necessary to monitor, (i) material risks from cybersecurity threats and (ii) our efforts related to the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of the Board The Board has delegated to the Audit Committee primary responsibility for overseeing enterprise risk management, including oversight of risks from cybersecurity threats. The Audit Committee periodically reviews TPL's policies and practices, including incident response plans, for managing cybersecurity risks to ensure that such policies and practices are appropriately tailored to our risk framework. Throughout the year, the Audit Committee receives quarterly IT and cybersecurity updates unless there is a notable event that requires immediate communication. These quarterly updates include cybersecurity risk assessment updates from our Director of Information Technology, including key risk indicators, the steps management has taken to monitor and control such cybersecurity risk exposure, and continuous improvement efforts. In addition to the risk management experience of the Audit Committee members, Barbara J. Duganier, a member of the Audit Committee, holds the CERT Cybersecurity Oversight Certification from Carnegie Mellon University.


text: Role of Management Our cybersecurity risk is managed utilizing a multi-tiered approach by our Director of Information Technology. In addition to the Director of Information Technology, we also engage the services of a third-party chief information security officer ("CISO"). The qualifications of the Director of Information Technology include over 30 years of IT management, cybersecurity, and information governance experience. The CISO, who reports to the Director of Information Technology, has 21 years of cybersecurity, IT management, and infrastructure consulting experience and is a certified CISO. The Director of Information Technology is regularly informed about the latest developments in cybersecurity, including potential threats, vulnerabilities, and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: The Director of Information Technology oversees risk management and strategy through (i) an IT operating committee (the "IT Operating Committee") made up of the Director of Information Technology, the CISO, and our department heads, which is responsible for the establishment and review of our IT governance, risk management and compliance, and (ii) an IT steering committee (the "IT Steering Committee") made up of our executives, which provides guidance and oversight to support and achieve our IT objectives, including cybersecurity objectives. Both the IT Operating Committee and the IT Steering Committee meet on a quarterly basis. The IT Operating Committee reviews monthly reports on cybersecurity incident prevention, mitigation, detection, and remediation and reviews our plans and policies related to IT processes on an annual basis. The Director of Information Technology also coordinates with our internal audit department and the Audit Committee to ensure cybersecurity is represented and addressed within our enterprise risk management strategy.


text: Risk Management and Strategy The Company considers cybersecurity to be an important part of its overall business strategy and risk management. UTMD continuously monitors its information systems to assess, identify and manage risks from both inside and outside forces. Functional modules are fully-integrated, which provides for transaction checks and balances. Software systems have been validated for effectiveness of intended uses. Policies and procedures have been implemented which all employees acknowledge in writing, and agree to follow as a condition of employment. Access is documented and controlled by business function. Regular employee user training is conducted to promote awareness of outside threats and the importance of following procedures.

companyName: UTAH MEDICAL PRODUCTS INC

ticker: UTMD


text: UTMD utilizes state-of-art cybersecurity devices and software to timely identify and prevent intrusion from external actors. The corporate information systems operations manager continuously monitors activity, and reports weekly to the CEO. Additional sources for assessing security effectiveness are annual outside audits of the information technology environment, risk and performance assessments provided by vendors of the routers and firewalls used by the Company and the news media.


text: There have been no events in at least the last thirty years that have been considered material enough to warrant changes to systems, processes or controls.


text: The Governance Committee of the Board of Directors maintains overall responsibility to oversee and assess the effectiveness of the Company's cybersecurity strategy. The Board meets quarterly and any potential threats are reviewed and discussed at that time, unless the information systems team and/or the CEO decide earlier notification is warranted.


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Barings Capital Investment Corp


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company and assists as necessary with the oversight of other third party service providers and their cybersecurity programs as discussed further below. The Adviser's cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Adviser's risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on its Chief Compliance Officer ("CCO") and the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with its use of such entities.


text: Board Oversight of Security Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO and the Chief Information Security Officer of the Adviser ("CISO") regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, and the CISO of the Adviser, manage the Company's cybersecurity program. The CCO of the Company oversees the Company's compliance program and relies on the Adviser's CISO and the Adviser's CCO to assist with assessing and managing material risks from cybersecurity threats. The Adviser's CISO has 10 years of experience in actively managing cybersecurity and information security programs for financial services companies with complex information systems. The Company's CCO has been responsible for this oversight function as CCO to the Company for 1 year and has worked in the regulatory and financial services industry for over 30 years, during which the CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company and assists as necessary with the oversight of other third-party service providers and their cybersecurity programs as discussed further below. The Adviser's cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with its use of such entities. The Company's Chief Compliance Officer ("CCO") also plays an oversight role in the area of cybersecurity preparedness with respect to these entities.


text: Board Oversight of Security Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Adviser's Chief Information Security Officer ("CISO") regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management and the CISO of the Adviser manage the Company's cybersecurity program. The CCO of the Company oversees the Company's compliance program and relies on the Adviser's CISO to assist with assessing and managing material risks from cybersecurity threats. The Adviser's CISO has 15 years of experience in actively managing cybersecurity and information security programs for financial services companies with complex information systems.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any impact from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Cybersecurity Processes and Risk Assessment We rely on the cybersecurity program implemented by Blue Owl, the indirect affiliate of our Adviser. Blue Owl has implemented a cybersecurity program, which i is focused on (i) protecting the confidentiality of business, client, investors in its funds and its employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: Blue Owl Credit Income Corp.


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").


text: Blue Owl's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed by Blue Owl IT Management for remediation. When Blue Owl engages vendors and other third party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.


text: Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate.


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess and manage cybersecurity events. The framework is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by an internal team that is responsible for enterprise-wide cybersecurity strategy, policies, engineering and processes. The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.


text: Our Board of Directors has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: Impact of Cybersecurity Risks In 2023, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Internal and external cybersecurity threats and risks, as well as other disasters, may adversely affect our business or the business or our portfolio companies by impairing the ability to conduct business effectively." and "Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business."


text: Cybersecurity Processes and Risk Assessment We rely on the cybersecurity program implemented by Blue Owl, the indirect affiliate of our Adviser. Blue Owl has implemented a cybersecurity program, which is focused on (i) protecting confidential business, client, investor and employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing proactive and reactive measures, including Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. Blue Owl's cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks. Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").


text: Blue Owl's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed and addressed by Blue Owl IT Management. When Blue Owl engages vendors and other third party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.


text: Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate. Blue Owl has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess, manage and report cybersecurity events, which is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The incident response framework determines when the C-ROC should provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including senior members of Blue Owl's management, Blue Owl's Audit Committee or Blue Owl's Board of Directors. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by IT Management as part of its responsibility for enterprise-wide cybersecurity strategy, policies, implementing Blue Owl's monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes and various other technological and administrative safeguards. The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.


text: The Audit Committee is primarily responsible for oversight and review of guidelines and policies with respect to risk assessment and risk management. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: Impact of Cybersecurity Risks In 2024, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "ITEM 1A. Risk Factors - Internal and external cybersecurity threats and risks, as well as other disasters, may adversely affect our business or the business or our portfolio companies by impairing the ability to conduct business effectively." and "Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business."


text: Management is responsible for mitigating the Company's risks, including cybersecurity. The Board of Directors has the oversight responsibility for the Company's risk management and has delegated its responsibility over cybersecurity to the Audit Committee.

companyName: Abacus Global Management, Inc.

ticker: ABX


text: The Audit Committee periodically reviews the Company's cybersecurity policy and programs established by management to mitigate cybersecurity and data risks. The periodic reviews take place on a quarterly basis and include reports from the Company's cybersecurity team led by the Company's Chief Information Security Officer ("CISO") who has over 10 years of data security experience. The quarterly report provides an overview of cybersecurity threats, key measures in place to mitigate cybersecurity threats and vulnerabilities, provides a status of ongoing security projects to strengthen the Company's cybersecurity posture, as well as plans and resource needs for addressing possible future cybersecurity threats and vulnerabilities. The Company's cybersecurity policy is centered on mitigating risks related to cybersecurity, privacy, physical security, and information security risk management.


text: The Company's cybersecurity risk management approach is reviewed for alignment with the Company's overall risk tolerance. The Company has a dedicated cybersecurity team led by the CISO who is responsible for executing the risk strategy and policies developed in coordination with the Company's Chief Executive Officer, Chief Financial Officer, General Counsel, Presidents, and the Vice Presidents of Finance and Capital Markets.


text: The Company's cybersecurity policy outlines every level of protection put in place to safeguard sensitive data as well as company technology assets, including threats and vulnerabilities posed from our interactions with suppliers and third-party service providers. These layers of protection include physical, local, and network layers as prescribed by standard information technology guidelines. The cybersecurity policy also contains procedures for responding to incidents that may threaten the security of Company systems and/or network, which include multiple layers of protections using current security measures and applications. The effectiveness of our security policy and procedures are tested frequently with periodic effectiveness reports shared with senior management and the Audit Committee to facilitate their risk oversight responsibilities.


text: No risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.


text: Risk management and strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: LENZ Therapeutics, Inc.

ticker: LENZ


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, as necessary, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Financial Officer, to manage the risk assessment and mitigation processes.