text: Board Oversight of Cybersecurity Risks The audit committee of the board of trustees, or the Audit Committee, provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Audit Committee receives periodic updates from the FS Investments CISO and our Chief Compliance Officer, or the CCO, regarding the overall state of the FS Investments cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.


text: Management's Role in Cybersecurity Risk Management Our management, including our CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees our risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over 15 years of experience in actively managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as our CCO for over 10 years and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to us.

companyName: FS Specialty Lending Fund

ticker: FSEN

secItem: Item 1C

stage1Category: Management Role

stage1Method: majority


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, we have not identified any impact from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect us, including our business strategy, operational results, and financial condition.


text: Cybersecurity risk management is a critical part of our overall risk management efforts. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our key systems and information. This program leverages the security-control principles outlined by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0 and other industry-recognized standards, as applicable. Our program prioritizes detection, analysis, and response to known, anticipated or unexpected threats. Some of the processes in place to manage risks from cybersecurity threats include identity and access management, logging and monitoring, penetration testing, vulnerability scanning, security monitoring, employee awareness training, and professional services from third-party providers. As cybersecurity threats evolve, we assess our program and make enhancements as needed to address emerging risks, adopt best practices, and strengthen our overall security posture.

companyName: Karat Packaging Inc.

ticker: KRT

stage1Category: Risk Management Process

stage1Method: unanimous


text: Risk Assessment and Management At least annually, we conduct a cybersecurity risk assessment to identify key cybersecurity risks, assess the likelihood of the identified risks, and the potential business impact, and develop related mitigation and enhance plans. Our cyber risk management initiatives are integrated within the Company's overall risk management process.


text: The Company uses various techniques to identify cybersecurity risks, including but not limited to input from internal stakeholders, known and potential information security vulnerabilities identified through historical incidents and self-performed assessments, evaluations from third-party consultants, as well as external data including reported security incidents impacting other companies, and industry trends. The results of the assessment are used to drive alignment on prioritization of initiatives to enhance our security controls and measures, make recommendations to senior management, and if necessary, but at least annually, inform the Audit Committee and Board of Directors.


text: Incident Response and Recovery Planning We maintain a comprehensive Incident Response and Recovery Plan (IRR Plan) designed to guide our preparation for, detection, response to, and recovery efforts in the event of cybersecurity incidents. The IRR Plan establishes clear roles and responsibilities for a cross-functional team (IR Team) tasked with handling cybersecurity incidents. The plan outlines a structured approach to managing incidents from the technical perspective, including monitoring, identification, investigation, assessment, containment, remediation, and mitigation. Additionally, the IRR Plan also addresses compliance with legal and reporting obligations, including any required notifications to affected parties, regulatory agencies, or the public, and reporting requirements with the SEC. Cybersecurity incidents are evaluated based on their severity, potential impact, and likelihood of escalation, and are prioritized for response, remediation, and disclosure as necessary. The IRR Plan is regularly reviewed and updated as necessary to incorporate improvements and enhance the organization's overall incident response capabilities.


text: Should a cybersecurity event occur, the IR Team would review and assess the incident and determine whether further escalation and regulatory reporting is required. Any incident assessed as potentially being or becoming material is immediately escalated to the Audit Committee, and meetings of the Audit Committee and/or full Board of Directors would be held, as required.


text: We consult with our outside legal counsel as appropriate, including on materiality analysis and disclosure matters. Senior management makes the final materiality determination and disclosure decisions. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made in a timely manner.


text: We periodically engage third-party cybersecurity experts to assess and enhance our cybersecurity risk management program, and to ensure compliance with industry best practices and applicable standards. These partnerships enable us to stay ahead of evolving threats and implement robust strategies to protect critical systems and data in the event of cybersecurity incidents.


text: Internally, our cybersecurity initiatives are led by our Information Technology ("IT") team headed by our experienced IT Manager, who is a Microsoft Certified Professional and holds certifications in CompTIA Network+ and Cisco Networking. During 2024, we also onboarded a Director of IT Research & Development with over 15 years of experience in IT, systems development, and cybersecurity frameworks, including senior roles at Fortune 500 companies. Both these IT leaders play a key role in driving strategies and solutions for system protection and incident management.


text: We have also established an IT steering committee consisting of members from various key departments including IT, Finance, Operations, and Human Resources. The IT steering committee convenes regularly to review and align on IT strategic priorities, including the cybersecurity risk management program. This cross-functional approach ensures that cybersecurity efforts are integrated across the organization and that emerging risks are addressed proactively.


text: In addition, we emphasize a company-wide culture of cybersecurity awareness. Employees are required to participate in mandatory training sessions at least annually, covering topics such as phishing recognition and threat response protocols. Other regular and ongoing security communications are also provided to reinforce these lessons and ensure that cybersecurity remains a priority at every level of the organization.


text: Further, we work closely with third-party software as a service providers and other service partners to manage and mitigate security risks by implementing robust policies and procedures. Our process includes conducting thorough risk assessments during onboarding and requiring providers to maintain and implement strong security measures within their respective organizations. We mandate contractual obligations for timely notification of any material data breaches, enabling us to respond quickly to protect our data and operations.

stage1Category: Third-Party Risk


text: Cybersecurity is an important part of our risk management processes and an area of focus for senior management. Our Board of Directors has oversight of our strategic and business risk management, and has delegated cybersecurity risk management oversight to the Audit Committee. Members of the Audit Committee receive updates on an as-needed basis, but at least annually, from senior management. This includes existing and new cybersecurity risks, how management is assessing and addressing such risks, status on key information security initiatives, and cybersecurity incidents, if any, and responses. Members of our Board of Directors also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management program.


text: Impact of Cybersecurity Risks and Threats As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected our business, financial condition, results of operations or cash flows. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. There can also be no guarantee that our policies and procedures under our cybersecurity risk management program will be properly followed in every instance or that those policies and procedures will be effective. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Item 1A "Risk Factors" for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.

stage1Category: Strategy Integration


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as defined in Item 106(a) of Regulation S-K, and are integrating them into our overall risk management systems and processes by implementing and maintaining various technical, physical, and organizational safeguards, such as policies, standards, and practices relating to: • risk assessments; • incident detection and response; • vulnerability management; • internal controls within our IT, Security and other departments; • network security controls; • access controls; • physical security; • asset management; • system monitoring; • employee cybersecurity awareness and training; • phishing tests; • the use of the internet, social media, email and wireless devices; • firewalls and intrusion prevention systems; • endpoint detection and response systems; and • anti-malware functionality.

companyName: Bridger Aerospace Group Holdings, Inc.

ticker: BAER


text: As part of this process, we engaged external consultants who assessed our internal cybersecurity programs and alignment with applicable practices and standards, such as the Internal Control - Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission framework. We have also retained external service providers to monitor identified risk exposures, provide ongoing recommendations and software tools for their detection and mitigation, as well as evaluating the impact and coordinating the recovery from any incidents or breaches, should they occur.


text: Our risk management program also assesses third-party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of service providers when handling and/or processing our employee, business or customer data. Further, in February 2024, we formalized our policy of monitoring third-party cybersecurity risks by requiring its consideration and approval by the IT change control board as a part of vendor selection and solution procurement.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management.


text: Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. It receives updates on matters of cybersecurity from senior management during regular quarterly meetings and in the interim, if warranted. This includes existing and new cybersecurity risks, how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: TILLY'S, INC.

ticker: TLYS


text: Our cybersecurity risk management and strategy processes are coordinated by our Director of Technology. He maintains the Certified Information Systems Security Professional certification and has nine years of senior leadership experience in defensive cyber security in both the private sector and Department of Defense. He is supported by leaders from our Information Technology, Document Management and Compliance teams, as well as management's Disclosure Committee who have extensive work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. They draw on their knowledge of daily information technology operations, ongoing cybersecurity initiatives and various monitoring tools to ultimately report through the Director of Technology and Director of Internal Controls to the Audit Committee on the monitoring, prevention, mitigation, detection and remediation of cybersecurity incidents. In the event the Audit Committee determines that a cybersecurity incident has occurred, the Audit Committee will evaluate whether to escalate the cybersecurity incident to the full Board.


text: The processes described above have not indicated, as of the date of this Annual Report on Form 10-K, any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have materially affected us in the year ended December 31, 2024 or are reasonably likely to materially affect our company, including its business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see the section of this Annual Report on Form 10-K entitled "Risk Factors—We rely on our IT systems to manage numerous aspects of our business. A cyber-based attack of these systems could disrupt our ability to deliver services to our customers and could lead to increased overhead costs, decreased sales and harm to our reputation."


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential cyber threats. Our Information Security Officer ("ISO") is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Executive Officer.

companyName: Southern States Bancshares, Inc.


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. The information security program is periodically reviewed with the goal of addressing changing threats and conditions.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain a Business Continuity Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees. The Business Continuity Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Business Continuity Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. To date, risks from cybersecurity threats have not materially affected our company.


text: Cybersecurity risk management is an integral part of the Company's overall enterprise risk management framework. Our technology team, together with third-party information security experts, has designed our cybersecurity risk management program with industry best practices in mind and to provide a roadmap for handling cybersecurity threats and incidents, including threats and incidents associated with our use of third-party service providers, and facilitate cross-functional coordination within the Company. This roadmap includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents.

companyName: Ranpak Holdings Corp.

ticker: PACK


text: Our ISO is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense program. This endpoint program is monitored 24/7 and would notify IT staff of an incident. Most incidents would be mitigated by monitoring staff of the endpoint program, but IT staff would have to be involved in more severe incidents. This mitigation is resolved from an always updating database. In severe cases, the device that triggers the incident would be locked down and a plan of action would be put in place. The second line of defense is a monitored firewall. This would also notify IT staff of an incident. Last line of defense is IT Staff. The department is augmented by an information security specialist that is on a monthly retainer. Individuals within the department are generally subject to professional education requirements.


text: Our board of directors has approved a committee comprised of directors and management called the Information Technology Committee. This committee provides oversight and governance of the technology program and the information security program. This committee meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings may occur from time to time in accordance with the Business Continuity Plan in order to facilitate timely informing and monitoring efforts. The ISO reports summaries of key issues, including significant cybersecurity and/or privacy incidents.

stage1Category: Board Governance


text: The ISO has served in various roles in information technology and information security for over 21 years and holds a Bachelor of Science degree in Management Information Systems from Auburn University. The ISO is also a graduate of the Alabama Banking School of the University of South Alabama. The ISO also holds multiple professional certifications, including specialized certifications in vendor risk management and community banking technology.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Commercial Vehicle Group, Inc.

ticker: CVGI


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.


text: Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service provider risks when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches and other disruptions could compromise our information systems and expose us to liability, which could cause our business and reputation to suffer" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates periodically from senior management regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are overseen by our CFO and CLO. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: Our audit committee of the board of directors is responsible for ensuring that management has processes in place designed to identify and evaluate risks, including cybersecurity risks, to which the company is exposed and implements processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Our board of directors and/or our audit committee receive regular updates throughout the year on cybersecurity risks. At least annually, each of our board of directors and/or our audit committee receives reports on cybersecurity matters and related risk exposures from our Chief Technology Officer, or CTO. When covered during an audit committee meeting, the audit committee reports on its discussion of cybersecurity risks to the full board of directors.


text: Management, together with third-party information security service providers, is responsible for assessing material cybersecurity risks on an ongoing basis, ensuring processes are established to monitor and respond to such potential cybersecurity risks, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our CTO, who receives reports from our third-party information security service providers and technology team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents as well as resource levels, technology trends and third-party provider risks. Our CTO and technology team are experienced information systems security professionals and information security managers with many years of experience. Management, including the CTO and our technology team, periodically update the audit committee on the company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports annually that cover, among other topics, third-party assessments of the company's cybersecurity programs, developments in cybersecurity and updates to the company's cybersecurity programs and mitigation strategies.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – General Risk Factors – Cyber risk and the failure to maintain the integrity of our operational or security systems or infrastructure, or those of third parties with which we do business, could have a material adverse effect on our business, financial condition or results of operations." in this annual report on Form 10-K.


text: The security of personal data is of the utmost importance to GoPro and our customers, vendors, suppliers, and employees. As such, we have implemented industry-standard administrative, technical, and physical security measures to protect against the unauthorized access, destruction, or alteration of our confidential and proprietary information and customer and employee information.

companyName: GoPro, Inc.

ticker: GPRO


text: Our Chief Information Security Officer (CISO) oversees our information security program and is responsible for leading and implementing, with a cross functional team, our cybersecurity strategy, policy, architecture, and risk management processes. Our CISO has over 20 years of experience in cybersecurity, serving as a security consultant to Fortune 100 companies, and a subject matter expert in computer forensics to law firms and U.S. Government agencies.


text: The Audit Committee of our board of directors (Audit Committee) has oversight responsibility for our cybersecurity program and reviews with management the Company's policies and procedures for identifying, assessing, managing, and monitoring information security and cybersecurity risks.


text: The CISO provides regular updates to the Audit Committee on cybersecurity and other risks relevant to our information technology environment, including developments in the cybersecurity space and evolving standards, the results of periodic exercises and response readiness assessments and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews. Our cybersecurity program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Audit Committee.


text: Risk Management and Strategy Our periodic assessment and testing of policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, simulated attacks and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness.


text: We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. We regularly train all employees on cybersecurity risks, such as phishing attacks, and employees are required to acknowledge our cybersecurity policy annually through our Code of Conduct.


text: Risks from Cybersecurity Threats No previous cybersecurity incidents have materially affected us, including our business strategy, results of operations or financial condition. Future cybersecurity threats or incidents may materially affect our business strategy, results of operations or financial condition. For further detail on the potential risks, see Part I, Item 1A of this Annual Report on Form 10-K for the year ended December 31, 2024.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, or Information Systems and Data.

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: Our cybersecurity risk management program includes a risk assessment methodology designed to escalate cybersecurity risks to the appropriate channels within our organization in order to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment. The information technology and legal departments help identify, assess and manage Sangamo's cybersecurity threats and risks. The information technology department, in coordination with the legal department, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and Sangamo's risk profile using various methods including, for example, evaluating threats reported to us, conducting audits, performing threat assessments, and conducting vulnerability assessments to identify vulnerabilities.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan that includes procedures for responding to cybersecurity incidents and escalating cybersecurity incidents to cross-functional teams, management and our board of directors, business continuity plans, encryption of data, network security controls, systems monitoring, employee training, and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our risk management protocols. Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas, including the involvement of cross-functional teams and, depending on the nature and severity of an incident, an escalation path to notify our executive and senior management teams and our board of directors. For example, the information technology department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact on our business.


text: We use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms, including legal counsel, cybersecurity software providers and managed cybersecurity service providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations and supply chain resources. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors included in Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K, including "Risk Factors—If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm and other adverse consequences."


text: Our board of directors addresses Sangamo's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Associate Director of IT, who has over 25 years of technology experience which includes extensive cybersecurity implementation and oversight.


text: Our Vice President of Finance & Corporate Controller is responsible on an interim basis for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Associate Director of IT is responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our Chief Financial Officer is responsible for approving budgets related to the foregoing.


text: Our cybersecurity risk management program includes a number of components, including information security program assessments and continuous monitoring of critical risks from cybersecurity threats using automated tools. We periodically engage third parties to conduct risk assessments on our systems, including penetration testing on an annual basis. We also conduct cybersecurity simulation exercises, including in connection with our disaster recovery procedures.

companyName: Absci Corp

ticker: ABSI


text: Our cybersecurity incident response and vulnerability management protocol are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the executive leadership team. The executive leadership team works with the incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management protocol include reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.


text: The Audit Committee of our Board of Directors receives periodic reports from the Associate Director of IT concerning Sangamo's significant cybersecurity threats and risk and the processes we have implemented to address them. The Board of Directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: The Company's management is responsible for the day-to-day management of risk, and our Board of Directors, including through its committees, is responsible for understanding and overseeing the various risks facing the Company.

companyName: Getty Images Holdings, Inc.

ticker: GETY


text: Cybersecurity Risk Management and Strategy Increased global cybersecurity vulnerabilities, threats and more sophisticated and targeted cyber-related attacks pose an ongoing risk to the security of our information systems and networks. Getty Images seeks to manage cybersecurity risks consistent with its general approach to enterprise risk management.


text: Getty Images engages third parties to conduct assessments to help it identify, categorize and manage cyber risks and to confirm compliance with applicable legal and regulatory requirements. Additionally, management and third parties conduct ongoing vulnerability scanning and performs penetration testing from time to time to help Getty Images identify and reduce the threat of known and emerging cybersecurity risks.


text: Board Oversight and Governance Getty Images' Board of Directors has delegated the oversight of cybersecurity risks to the Audit Committee. The Audit Committee assists Getty Images' Board of Directors in its oversight of the policies and practices used by Getty Images to identify, assess and manage key risks facing Getty Images, including cybersecurity risks. Members of management, including the Company's Chief Technology Officer ("CTO"), provide the Audit Committee with updates on cybersecurity and information technology matters. In turn, the Audit Committee and management also provide updates to Getty Images' B oard of Directors. In addition to reporting to the Audit Committee and Getty Images' Board of Directors, the CTO provides periodic reports to our Chief Executive Officer and other members of our senior management as appropriate. The Audit Committee, or Getty Images' Board of Directors, is notified of cybersecurity incidents, as appropriate, in accordance with the Company's incident response processes.


text: Cybersecurity Oversight Management plays an important role in assessing and managing Getty Images' material risks from cybersecurity threats. The CTO is responsible for oversight of the design and implementation of the security program and strategy. Getty Images' current CTO has served in various roles in technology for over 25 years, and has had had oversight of information technology and information security for both Getty Images (7+ years) and other organizations.


text: At the employee level, we maintain an experienced information technology team who is tasked with implementing our privacy and cybersecurity program and support the CTO in carrying out reporting, security, and mitigation functions.


text: As part of the Getty Images cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the CTO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and escalate such threats and incidents as appropriate through the processes described in more detail below.


text: Management's cybersecurity risk management strategy and processes focus on several key areas, including: • Incident Response Planning: Getty Images has a global Information Security Incident Response Plan (the "Plan") for identifying and managing cyber and data security threats. The Plan defines the roles and responsibilities of Company stakeholders involved in responding to cyber and data security events, severity levels and incident categories, and it outlines a process for incident management, including escalation and communication procedures. A cross-functional working group of security, privacy, and legal personnel review significant incidents to determine if further escalation is appropriate. If an incident could be deemed material, it is escalated to the CTO and other members of the executive team, and we consult with outside counsel during this assessment as appropriate. • Technical Safeguards: Getty Images seeks to continuously improve technical safeguards that are designed to protect its information systems. Standards include controls for identity and access management, cyber threat and incident management, data security, encryption, human resource security, network and device security, secure asset management, secure system development, security operations and third-party security. While Getty Images seeks to maintain adequate cybersecurity controls, it may not always be effective. See "Item 1A. Risk Factors—Our failure to protect the proprietary information of our customers and our networks against cyberattacks, security breaches or unauthorized access could adversely affect our business and results of operations, damage our reputation and expose us to liability" and "We collect, store, process, transmit and use personal information, which subjects us to governmental regulation and other legal obligations in many jurisdictions related to privacy, information security and data protection" for more information as well as related risks. • Education and Awareness: We require annual employee trainings on privacy and cybersecurity, records and information management, and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population. • Third-Party Risk Management: We rely on certain third-party computer systems and third-party service providers in connection with providing some of our services. We also depend upon various third parties to process payments for our transactions around the world. These third-party business partners, service providers, and consultants need to access our customer and other data and in some cases connect to our computer networks. We define expected security and privacy requirements through our contracting processes with third parties and we perform third-party cyber risk assessments to monitor the cyber risk management efforts of third parties as needed. • Threat Intelligence: Our security teams engage in threat intelligence, predictive modeling, and penetration testing to understand the Company's threat landscape and reduce the risk and impact of cybersecurity incidents.


text: Material Effects of Cybersecurity Incidents As of the date of this Annual Report, we have experienced cybersecurity incidents and threats, including malware, phishing, partner and customer account takeover attacks, and denial-of-service attacks on our systems. We do not believe these cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations or financial condition. To learn more about risks from cybersecurity threats, review the risk factors included in "Item 1A. Risk Factors" in this Annual Report, as updated by Getty Images' subsequent SEC filings. The risks described in such filings are not the only risks facing Getty Images. Additional risks and uncertainties not currently known or that may currently be deemed to be immaterial may materially adversely affect Getty Images' business, financial condition, or results of operations.


text: We recognize the crucial importance of identifying, assessing, and managing material risks from cybersecurity threats. We are committed to implementing and maintaining a comprehensive information security program to manage such risks and safeguard our systems and data, including the data of our customers.

companyName: Community West Bancshares

ticker: CWBC


text: Information Security Risk Management and Strategy We manage our cybersecurity risk in accordance with our Information Security Program, which is applicable to all users of our information technology assets, information assets, and facilities, including our directors, officers, employees, temporary workers, business partners, contractors, vendors, service providers, and individuals affiliated with third parties. The Information Security Program includes a dedicated Cybersecurity Incident Response Plan (the "CIRP"), which sets forth the rules and requirements for detecting, investigating, containing, eradicating, and resolving information security incidents, and addresses the response portion of security monitoring. The Information Security Program also includes: (i) a collection of Security Incident Forms, which delineate the processes for reporting, classifying, investigating, documenting, and communicating information security incidents and (ii) Security Guidelines and Baseline Protections, that establish the rules and requirements for enabling, logging, alerting, and monitoring real time security alerts and security logs (automated or manual) in connection with security incidents.


text: Potential information security incidents are identified in a number of ways, including, but not limited to: users reporting security violations, system weaknesses, violations of our Acceptable Use Policy which addresses the boundaries of acceptable use of our information technology assets, automated system alerts, and monitoring of both system generated and manually generated logs. Our Information Security Program mandates that any potential information security incident be reported to a member's direct supervisor, IT Management, or the Information Security Officer, to initiate the internal communication and investigation stage, during which such events undergo initial investigation for validation, including related to the scope and depth of such incident and to ensure that it has not resulted from a false positive. Internal communications regarding the potential incident are led by the Information Security Officer and the Incident Response Team ("IRT") in accordance with the CIRP.


text: Following this initial stage, we gather and update impact information and related documentation for such incidents. We use an incident classification matrix to determine the initial classification of a potential information security incident, which considers users, customers, and systems affected, the sensitivity of data at risk, and the potential business impacts to the Company including financial, legal, regulatory, operational, and reputation. The resulting classification of severity level "One," "Two," or "Three" identifies next steps for escalation and communication following the initial investigation of the potential incident. Upon escalation of an incident, per our Information Security Program, the IRT and ISO review and validate the initial determination of the priority of the incident prior to entering into subsequent investigative and response stages. Upon validation, the IRT and ISO will engage the Company's technology service provider to respond to the incident and notifications or communications are made to either additional personnel or any external entities. Depending on the specific details of any such incident, we may notify additional members of our management team, our board of directors, the Audit Committee, state and federal regulators, technology service providers, or the SEC. The timing of such communications varies based on the details of a particular incident and applicable regulations governing such disclosure. Following this classification and communication stage, we enter the recovery stage to determine containment and a response to the incident, the Company's technology service provider assigns technical staff to address such incident, implement containment, eradicate the incident source, and recover from such incident. Following any such incident and as determined by the Security Incident Forms, we engage in predefined follow-up activities to communicate with law enforcement and notify impacted third parties and customers, as appropriate, in addition to further investigating the cause of the incident, documenting takeaways, and engaging in remediation.


text: Our Information Security Officer ("ISO") coordinates with other members of our Incident Response Team identified in our Information Security Program to document, validate, respond, and manage actual or potential security incidents according to their threat classifications as described above, and report to our board of directors and the Audit Committee on an ad hoc basis. The ISO also provides annual reports on the status of our Information Security Program and its compliance with regulatory requirements to our board of directors in connection with our board's general risk management oversight role, as described in further detail below. The ISO is responsible for overseeing day-to-day operations of the Information Security Program, coordinating or contributing to reviews, audits, risk assessments, and other risk management material, development of departmental policies and procedures for board approval, and periodic updates to our Information Technology Steering Committee and the Board of Directors Technology Committee. The ISO reports to the Senior Risk Officer.


text: The ISO has over 15 years of industry experience including management of cybersecurity, enterprise telecommunications infrastructure, and vendor relationships as well as possessing both undergraduate and graduate level degrees, including a Bachelor of Science Information Security and Assurance and Master of Science Information Security and Assurance. Additionally, the ISO was previously certified in 18 industry niches to foster in-depth understanding of technology and its associated risks, including certification as a Certified Ethical Hacker, Certified Computer Hacking Forensics Investigator, Database Design, Web Design, CCNA Routing, Switching, and Security, and is currently enrolled in the International Information System Security Certification Consortium's official Certified Information Systems Security Professional curriculum. Furthermore, the ISO must effectively collaborate with business leaders, executives, and stakeholders. To bolster the collaboration, communication, and business skills necessary to effectively analyze risk holistically, the ISO has undertaken additional graduate level curriculum, including a Master of Business Administration degree program, while maintaining active membership in the National Society of Leadership and Success Honors Society.


text: Cybersecurity Governance Related to Cybersecurity Risks Our Board considers cybersecurity risk as part of its overall risk oversight, and has delegated to the Audit, Finance and Risk Committee ("AFRC") responsibility for oversight of major risk exposures, including in relation to security, cybersecurity and privacy. At the management level, we have also established an Executive Risk and Compliance Committee ("ERCC"), which oversees the development and implementation of our risk oversight and management processes, including in relation to cybersecurity. The ERCC is comprised of members of our executive leadership from across the organization. Our CISO reports to the ERCC on identified material cyber risks (if any) and on the implementation of cybersecurity priorities. The members of the ERCC, in turn, are responsible for updating the AFRC, and, where required, our Board on key milestones and progress regarding identified material cyber threats.

companyName: AlTi Global, Inc.

ticker: ALTI


text: With the approval of Audit Committee, we also engage third party assessors, consultants, and auditors in connection with the Company's Information Security Program and in accordance with our Audit Program, including to conduct external and internal penetration testing, independent audits, and risk assessments. The ISO performs information security assessments for third party service providers that store or process our confidential data. These information security assessments, include a review of any service organization controls ("SOC") reports, and proof of the vendor's independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes, and third party data protection controls (which can include, but are not limited to: access reviews and controls, backups, monitoring, encryption standards, and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor. In addition, we use a combination of technology, policies, procedures, training, and monitoring to promote security awareness and prevent security incidents.


text: Cybersecurity Risk Oversight Our executive management team is responsible for the development of our policies and procedures and for managing any exception to the same. In particular, our ISO, nonmember of the executive management team, oversees information security compliance, as described above. The board of directors of the Company has ultimate oversight of cybersecurity-related risk and activities, including the review and approval of our policies and procedures related to cybersecurity. The Information Security Program is approved on an annual basis. Cybersecurity risk management is also incorporated into our overall enterprise risk management model, which is updated on an annual basis and subject to oversight by our board of directors.


text: In the ordinary course of business, our board of directors receives annual updates from the ISO regarding the Information Security Program and compliance with relevant regulations, as described above. Our Information Technology Steering Committee consists of members of the Executive Management Team and department heads with relevant technology experience, and meets on a bimonthly cadence with minutes, reports, and presentations flowing up to the Board of Directors Technology Committee which also meets on a bimonthly cadence. If an incident occurs, depending on its priority as identified through the procedures described above, management may inform our board of directors via the Directors Technology subcommittee or Audit Committee sooner than its next bimonthly update.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected us. For further discussion of risks from cybersecurity threats, see the section captioned "A failure in or breach of our operational or security systems, or those of our third-party service providers, including as a result of cyber-attacks, could disrupt business, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, increase costs and cause losses" in Item 1A of this Annual Report.


text: Relevant Regulations As a regulated financial institution, the Bank is also subject to financial privacy laws, and our cybersecurity practices are subject to oversight by the federal banking agencies. In addition, in 2023 the SEC recently enacted rules requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance.

stage1Category: None/Other


text: Cybersecurity Risk Management and Strategy The Company has implemented a cybersecurity risk management program that is designed to identify, respond to, protect against and manage cybersecurity threats and incidents. Our cybersecurity risk management processes include regular assessments of our cyber threat detection and response capabilities.


text: We have established cybersecurity risk assessment processes, which include annual risk assessments using third-party consultants. Our Chief Information Security Officer ("CISO") has oversight over our information security policies and works with our internal IT resources and third-party managed IT support providers to facilitate the implementation of our cybersecurity risk assessment and management processes. Our cybersecurity risk management processes are designed to protect systems and data and contain preventive and detective controls, including internal and external testing. We also provide cybersecurity awareness training to our employees during onboarding and periodically thereafter, including through simulated phishing attacks.


text: We maintain processes designed to evaluate the security practices and controls of our critical third-party vendors that have access to our confidential information, which includes security questionnaires and third-party information security assessments, as applicable.


text: We maintain policies regarding our information security practices, including an incident response plan to coordinate response and mitigation efforts in the event we experience a cybersecurity incident. These policies require notification of cybersecurity incidents to our information security team, and if warranted based on the perceived level of severity of the incident, to members of our executive leadership. We have not identified any cybersecurity incidents or threats that have materially affected us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please consult "ITEM 1A. RISK FACTORS."


text: We also engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes to assist us in our design and implementation of our cybersecurity policies and procedures and in our assessment and testing of our security safeguards. This includes a third-party managed detection and response team (MDR) to conduct ongoing network monitoring and to support incident management and threat assessment. Additionally, as a public company, we are subject to regulatory requirements and undergo audits of our financial statements, which include a review of related cybersecurity controls and information technology systems.


text: We maintain a cybersecurity awareness training program for employees, which is provided during onboarding and on an annual basis thereafter. Our training program includes simulated phishing campaigns, which are designed to increase awareness and detection and to equip our personnel with effective tools to identify and address cybersecurity threats.


text: Although risks from cybersecurity threats have not materially affected, and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our and our third-party vendors' information systems. For more information about the cybersecurity risks we face, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor titled "Cybersecurity incidents, data breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."


text: Under the ultimate direction of our chief executive officer, or CEO, and our executive management team (including our Chief Legal Officer who serves as our Chief Compliance Officer), with oversight from our audit committee of the board of directors (Audit Committee), our Head of Information Technology (Head of IT) has primary responsibility for assessing, operating and managing our cybersecurity threat management program. Our Head of IT meets periodically with our Chief Legal Officer to discuss current developments in the cybersecurity landscape and our cybersecurity risk management program, including providing updates regarding the sources and nature of critical risks we face and how the IT department assesses those risks, including the likelihood of such risks, the severity of impact, and progress on vulnerability remediation.


text: As we are in the process of hiring a new Director of Information Technology, our Chief Legal Officer is fulfilling these functions in the interim with assistance from third-party information technology and cybersecurity experts. Although our Chief Legal Officer does not have direct cybersecurity expertise obtained through certifications, her experience as a member of our company's senior management team and overseeing enterprise risks, which includes consulting and coordinating as necessary with third-party information technology and cybersecurity experts, enables her to assess and manage material risks from cybersecurity threats. We maintain an established process to notify management of identified cybersecurity incidents and to provide an assessment of the potential criticality and impact of such incidents. We have also implemented procedures for response and containment efforts to address the actual or potential impact of identified cybersecurity incidents, as applicable.


text: As part of our board of directors' enterprise risk management program, our board of directors has responsibility for oversight of cybersecurity risk management. Our board of directors has delegated to our Audit Committee oversight of our cybersecurity risk management program, including oversight of information security and cybersecurity threats and related compliance and disclosure requirements. On an annual basis, our Chief Legal Officer provides an update to our Audit Committee regarding our cybersecurity risk management program, including as relates to critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards. The Audit Committee periodically reports on cybersecurity risk management to the full board of directors.


text: Risk Management and Strategy The AIR Operating Partnership takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. We regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and tests those systems according to our cybersecurity policies, standards, processes, and practices, which are integrated into our overall approach to enterprise risk management. To protect its information systems from cybersecurity threats, We use various security tools that help it identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our cybersecurity program is designed to align with the National Institute of Technology Standards Cybersecurity Framework 2.0, which provides a structured approach for governing, assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Apartment Income REIT, L.P.


text: Leveraging our cybersecurity risk management processes, cybersecurity risk factors were identified, which are inherent to our business and industry. The risk factors discussed in this section should be considered together with information included elsewhere in this Annual Report on Form 10-K and should not be considered the only risks to which we are exposed. Additionally, mitigation of these risk factors is tracked by management as part of our cybersecurity maturity roadmap.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: P3 Health Partners Inc.

ticker: PIII


text: The AIR Operating Partnership's technology team, under the leadership of our Senior Vice President of Technology and Chief Technology Officer, who has over 30 years of technology management experience, defines an annual work plan designed to maintain strong cybersecurity maturity, set improvement objectives of key controls and systems, including feedback from third-party assessments, and identify and implement on-going investments to replace or upgrade systems or technologies and proactively maintain strong security. As part of our annual planning, management conducts regular tabletop testing of our incident response plan to increase awareness, establish key decision-making criteria, ensure effective communication among key stakeholders, and comply with our disclosure obligations. We also partner with third-party experts to assess the effectiveness of our cybersecurity prevention and response systems and processes (e.g., periodic penetration testing and assessments of IT general controls). We also engage vendors to enhance cybersecurity safeguards and improve incident response and updates or replaces systems and applications as appropriate to improve data processing and storage management and enhance security. To further protect our information systems, we structure and monitor our relationships with third-party service providers and periodically conduct due diligence on their cybersecurity architecture and process design.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us and we believe are not reasonably likely to have a material adverse effect on us, including its business strategy, results of operations, or financial condition. For additional information on cybersecurity risks and potential related impacts on AIR Operating Partnership, refer to "Our business and operations would suffer in the event of significant disruptions or cyberattacks of our information technology systems or our failure to comply with laws, rules and regulations related to privacy and data protection." in Part I, Item 1A, Risk Factors.


text: Our Senior Vice President of Technology and Chief Technology Officer, in coordination with other members of AIR Operating Partnership's management, is responsible for leading the assessment and management of cybersecurity threats. AIR Operating Partnership has implemented a governance program for its cybersecurity efforts. This includes regularly updating privacy notices, terms of use, and lease documents, as well as identifying responsible teammates to facilitate the implementation of cybersecurity priorities. These teammates report regularly to senior management on risk identification, safeguards, and mitigation steps. AIR Operating Partnership has developed and implemented policies to identify and mitigate cybersecurity risks and provides training to teammates at onboarding and annually thereafter. Updates are communicated to all teammates, and actionable guidance is provided when new risks arise. Our Board of Directors (i.e., the Board of Directors of AIR, with AIR as the sole member of the sole member of the General Partner) will receive updates on the AIR Operating Partnership's cybersecurity profile risk assessment and technology environment and the broader technology landscape as and when appropriate.


text: Cybersecurity Risk Management and Strategy We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. We invest in cybersecurity to protect intellectual property, customer and employee data, manage reputational risk, and maintain business continuity across our environment. We strive to ensure ongoing compliance with the requirements under applicable standards including the Payment Card Industry Data Security Standards and relevant data privacy and protection laws and regulations. Additionally, our teams reference the standards, guidelines, and practices from the NIST Cybersecurity Framework (CSF) to align our cybersecurity program and risk management practices. The foundation of our cybersecurity framework is based on written policies that govern different cybersecurity process areas.


text: Identifying and assessing cybersecurity risk is part of our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a combination of third party assessments, IT Security Risk reviews, external audits and assessments, penetration tests, vulnerability scans, security monitoring activities and recurring review from our internal cybersecurity working group. We respond to cybersecurity incidents and address identified cybersecurity risks through our internal cybersecurity working group and report any material findings and incidents to the audit committee of our board of directors.


text: The cybersecurity incident response process is governed by our Incident Response Plan ("IRP") and overseen by leaders from our IT security and legal teams. The IRP guides how security events are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.


text: We also conduct tabletop exercises annually, to simulate responses to cybersecurity incidents and ensure accuracy and continuous improvement of the incident response plan. Our team of cybersecurity professionals then collaborate with other stakeholders across our organization to further analyze the risk to the Company and form detection, mitigation and remediation strategies.


text: We are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents.


text: • Disruptions in the Company's supply chain could result in an adverse impact on results of operations. • Network compromise or equipment sabotage could impact the operations of the fulfillment center sites which could impact the revenue. • Cybersecurity incidents, including breaches of confidential information, sensitive data, personal information, or intellectual property could damage the company's reputation, disrupt operations, increase costs, and impact revenues.


text: As part of the above processes, we regularly engage external advisors and consultants to assess our internal cybersecurity programs and compliance with applicable regulatory requirements and industry standards. Our external advisors also act as an extension of our teams to support on daily related security activities, by working closely with our Chief Information Officer and the leader of IT Operations.


text: Our cybersecurity risk management program evaluates the risk associated when selecting third-party service providers. In addition to new vendor onboarding, critical vendors are reviewed annually to ensure we understand their cybersecurity posture, and their responsibility in protecting our assets appropriately.


text: As of the date of this filing, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information, see Part I, Item 1A, Risk Factors-Risks Related to Our Business.


text: Cybersecurity Governance Cybersecurity is an area of focus for our board of directors, audit committee, and management. As part of our board of directors' overall responsibility for oversight of management's general risk identification and management activities, the audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats. Members of the audit committee review and discuss with management and our auditors quarterly the Company's cybersecurity risks and the steps that management has taken to protect against threats to the Company's information systems and security and review risk and mitigation steps taken by management related to data privacy.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our IT Security, external advisors, and legal teams. These individuals are informed about, and monitor the identification, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above.


text: We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Specifically, we engage a third-party cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic penetration testing and tabletop exercises to inform our risk identification and assessment of material cybersecurity threats.

companyName: American Strategic Investment Co.

ticker: NYC


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: • Monitor emerging data protection laws and implement changes to our processes to comply; • Conduct periodic data handling and use requirement training for our employees; • Conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; and • Conduct regular phishing email simulations for all employees.


text: Our incident response plan coordinates the activities that we and our third-party cybersecurity providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations.


text: As part of the above processes, we engage with third party providers to review our cybersecurity program and help identify areas for continued focus, improvement, and compliance.


text: Our processes also include assessing cybersecurity threat risks associated with our use of third-party services providers in normal course of business use, including those in our supply chain or who have access to our tenant and employee data or our systems. Third-party risks are included within our cybersecurity risk management processes discussed above. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.


text: Employee Training and Awareness: We provide cybersecurity training to employees to raise awareness of the latest threats and best practices for protecting sensitive information. This includes training on how to recognize phishing attempts, handling secure data, and reporting security incidents.

companyName: BlueOne Card, Inc.

ticker: BCRD


text: During the reporting period of this Annual Report on Form 10-K, we have not encountered risks from cybersecurity threats that have materially affected us, or are reasonably likely to materially affect, our business strategy, results of operations or financial position. However, we cannot assure you that we will not experience any such threats or incidents in the future. See "Item 1A. Risk Factors" in this Annual Report on Form 10-K, for additional discussion about cybersecurity-related risks.


text: As an externally managed company, our day-to-day operations are managed by our Manager and our executive officers under the supervision of our board of directors and its committees. Our executive officers are senior investment professionals provided to us through our Manager pursuant to our management agreement with our Manager. Our business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. Our Manager is an affiliate of ORIX USA, a diversified financial company and subsidiary of ORIX and participates in and is subject to ORIX USA's cybersecurity program. Accordingly, we rely and Manager relies on ORIX USA and its cybersecurity risk management program to identify, assess and manage material risks to our business from cybersecurity threats.

companyName: Lument Finance Trust, Inc.

ticker: LFT


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected nor, are they reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats affect our business see, "Part I. Item IA. Risk Factors - the occurrence of cyber-incidents, or a deficiency in our Manager's Cybersecurity or those of any of our third party service providers, could negatively affect our business by causing a disruption to our operations, a compromise of our confidential information or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Our board of directors is responsible for directing and overseeing our risk management. Our board of directors administers this oversight function directly, with support from its committees. In particular, the audit committee of our board of directors (the "Audit Committee") has the responsibility to consider and discuss our major financial risk exposures and the steps our Manager should take, or is required to take, to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken. Our Audit Committee also monitors compliance with legal and regulatory requirements, in addition to overseeing the performance of our internal audit function. Pursuant to the Management Agreement, our Manager is responsible for identifying, assessing, and managing our material risks from cybersecurity threats. Our Manager relies on ORIX USA and ORIX USA Information Technology and Cybersecurity Team, including the ORIX USA Chief Technology Officer ("CTO"), to provide us with a comprehensive cybersecurity risk management program.


text: Periodically, at least annually, ORIX USA's CTO and/or other members of the ORIX USA Information Technology and Cybersecurity Team will present to the Audit Committee on various topics relating to ORIX USA's technology risks, including ORIX USA's cybersecurity program (including the results of cybersecurity tabletop exercises), cybersecurity issues (including those relating to data protection, insider threats, regulatory changes and geopolitical cyber threat management) and risk management (including the results of periodic technology audits).


text: Cybersecurity Risk Management and Strategy ORIX USA has engaged HCLTech ("HCL") to manage all infrastructure and cybersecurity services for ORIX USA and its subsidiaries, under the governance of the ORIX information and cybersecurity leadership team. HCL has over twenty-five years' experience in cybersecurity, nine cybersecurity delivery centers strategically placed across the globe, and employs over 7,000 cybersecurity professionals. The ORIX information and cybersecurity leadership team and HCL are considered the "ORIX USA Information Technology and Cybersecurity Team".


text: HCL will deliver the managed security services to ORIX USA from its Offshore Management Center (OMC) and Cybersecurity Fusion Centers (CSFC) providing 24x7 operations that cover ORIX USA's cybersecurity landscape including network security, email security, endpoint security, data security, application security, cloud security, privileged access management, vulnerability management, cybersecurity incident response, cybersecurity third-party risk, cybersecurity awareness training, phishing simulations and identity and access management.


text: The ORIX USA CTO, leads the ORIX USA Information Technology and Cybersecurity Team responsible for managing information security at ORIX USA's asset management business, including its cybersecurity strategy and program, which encompasses annual employee training about cybersecurity risks and new employee onboarding about ORIX USA's security policies. The ORIX USA Information Technology and Cybersecurity Team's responsibilities cover three main areas: (i) operations and engineering, (ii) threat detection and response, and (iii) governance. The ORIX USA CTO leads the cybersecurity team with over four years of experience at ORIX USA and 18 prior years of experience at a large asset management firm. This cybersecurity program is aligned with the NIST Cybersecurity Framework ("NIST CSF"), emphasizing training and development.


text: 9. Regulatory and Legal Compliance Risks The Company is subject to global cybersecurity regulations, including: • SEC cybersecurity disclosure requirements for material incidents and risk management. • Data privacy laws such as CCPA (California Consumer Privacy Act) and GDPR (General Data Protection Regulation). • Automotive cybersecurity standards for protecting connected vehicle systems.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: ORIX USA employs a 'defense in depth' cybersecurity strategy and program based on the NIST CSF, which includes multiple layers of security policies, protections, and controls designed to safeguard the confidentiality, integrity, and availability of infrastructure, network and information assets from malware and threats. This includes the deployment of next generation firewalls, web application firewalls, email protection technologies, DLP technologies, internet proxy, and next generation antivirus and endpoint detection and response ("EDR") systems.


text: Our firewalls (intrusion detection systems and intrusion prevention systems) are designed to secure the organization's perimeter complemented by an antivirus and EDR platform designed to detect malware and threats on systems. Web application firewalls are designed to protect external facing applications, while our email security gateway utilizes machine learning and multilayered detection techniques designed to filter malicious emails.


text: The ORIX USA Information Technology and Cybersecurity Team monitors security events via a SIEM (security information and event management) and SOAR (security orchestration, automation, and response) platform. Mobile device management software is employed with the objective of protecting corporate email and data on mobile devices and is designed to prevent unauthorized data transfer.


text: ORIX USA maintains a cybersecurity incident response capability that includes detailed policies, plans and modular run books and maps designed around different types of cybersecurity incidents. The plan and run books are tested annually through cybersecurity tabletop simulations where incident response technical, and executive team members go through real-world scenarios focused on current cybersecurity threats. ORIX USA's cybersecurity incident response plan provides for escalation of identified cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to our Company, and evaluation of the adequacy of our cybersecurity program, including risk mitigation, compliance and controls. ORIX USA has established a notification decision framework to determine when to send notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notification to different recipient groups, including our Manager and officers of LFT.


text: Cybersecurity Risk Management and Strategy We regularly face cybersecurity threats from malicious third parties that could obtain unauthorized access to our internal systems, networks, and data. It is virtually impossible for us to entirely mitigate the risk of these and other security threats we face, and the security, performance, and reliability of our products may be disrupted by third parties, including nation-states, fraudsters, criminal syndicates, competitors, hackers, disgruntled employees, former employees, or contractors. While we have implemented security measures internally and have integrated security measures into our systems, network, and products, these measures may not always function as expected and may not always detect or prevent all unauthorized activity, prevent all security breaches or incidents, mitigate all security breaches or incidents, or protect against all attacks or incidents.

companyName: Bakkt, Inc.

ticker: BKKT


text: Particularly in light of the extensive cybersecurity risks facing our company and the fact that we provide crypto digital asset products to our clients, we recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to protect our internal systems and our clients' data. We have established a multi-layered approach to manage our cybersecurity risks with preventative and detective capabilities enabled in our network and internal systems that are designed to protect against identified cyber threats. This approach to cybersecurity includes, among other things, annual and periodic risk assessments; ongoing collaboration with our product and engineering teams for the purpose of securing our products, systems, and data; a vulnerability management program focused on proactively identifying, triaging and mitigating security vulnerabilities within our systems, penetration tests and other simulations; regularly required security training for all employees; and a comprehensive incident response process to identify, contain, and remediate cybersecurity incidents. We also engage with external cybersecurity assessors and consultants in evaluating and testing the design and operating effectiveness of controls.


text: To identify and assess material risks from cybersecurity threats, our Enterprise Risk Management program considers cybersecurity risks alongside other company risks as part of our overall risk assessment process. We perform specific cybersecurity risk assessments at least annually to identify and assess material cybersecurity threat risks, their severity, and potential mitigations. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to further identify risks.


text: We are aware of risks associated with our use of third-party service providers, including those who have access to our systems, data, or facilities. We have implemented processes to help manage these risks. We conduct security assessments of third-party providers who may have access to sensitive information as part of our selection and onboarding process. We also conduct ongoing monitoring in the form of periodic reviews conducted by our security team based on the business criticality of the third-party service.


text: Risk Management and Strategy Cybersecurity risk management is a major component of our overall risk management systems and processes. We have a cybersecurity program and governance structure designed to identify and manage cybersecurity risks and threats.

companyName: Lazydays Holdings, Inc.

ticker: GORV


text: As of the date of this Form 10-K we do not believe that these risks or any previous cybersecurity events or incidents have materially affected or are reasonably likely to materially affect us. We face risks from cybersecurity threats, including those associated with cyberattacks and security breaches and incidents, in the future. For additional information regarding whether and how risks from identified cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition refer to "Item 1A. Risk Factors" and "Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations" of this Form 10-K, which disclosures are incorporated by reference herein.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for the Board and management. The Board is responsible for monitoring and assessing strategic risk exposure, and our cybersecurity program and strategy are overseen by our Chief Information Security Officer (CISO). Our CISO, who joined us in 2022, has over 25 years of prior work experience in various roles managing enterprise risk and information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications, including Certified Information Security Manager, Certified Information Systems Auditor, and Certified Information Systems Security Professional. The CISO provides regular updates to the executive management team and provides the quarterly Board updates, as discussed below. The executive management team allocates resources to support the cybersecurity program through allocation of budget.


text: The Board administers its cybersecurity risk oversight function directly as a whole, as well as through its Audit and Risk Committee, which is responsible for oversight of risks from cybersecurity threats. At least quarterly, the entire Board receives an update from the CISO of our cybersecurity program covering topics such as results from third-party assessments, progress toward strategic goals, compliance with regulatory requirements, and certain cybersecurity threat risks or developments, as well as the steps management has taken to respond to such risks. Members of the Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Avalo's management and Board of Directors recognize the importance of information security and managing cybersecurity risks across the enterprise. We have strategically designed our robust Information Security Program (the "Program") to assess, identify, and manage these cybersecurity risks, protect the Company from such risks, and respond to, and recover from, cybersecurity incidents.

companyName: Avalo Therapeutics, Inc.

ticker: AVTX


text: The Company's Information Security Working Group ("ISWG") is actively engaged in managing cybersecurity risks and overseeing the design, implementation, and evaluation of the Program. The purpose of the ISWG is to define cybersecurity risk tolerance, guide implementation of the Program, monitor Program development and effectiveness, and validate investments in cybersecurity measures and infrastructure. Members of the ISWG include: the Chief Financial Officer, the Chief Legal Officer, the head of the Company's Human Resource department, the Senior Vice President of Program Management and Corporate Infrastructure, the Senior Vice President of Regulatory and Quality Assurance, and the Company's head of Information Technology. The group meets semi-annually to review the effectiveness of the Program, discuss any new developments and potential improvements to the Program, and evaluate internal and external security-related events to determine how Avalo can take appropriate steps to mitigate such risks.


text: The Audit Committee (the "Committee") is primarily responsible for oversight of the Program. The Committee is composed of directors with expertise in technology, audit, finance, and compliance, equipping them to effectively oversee the program. Yingping Zhang serves as our Vice President of Information Technology, and she also helps oversee the implementation and effectiveness of the Program as a member of the ISWG. Ms. Zhang graduated from the University of Pittsburgh with a Master of Science in Electrical Engineering and has over thirty years of experience as an information technology professional. Prior to Avalo, Ms. Zhang worked as an Executive Consultant for Insightful Group, the Vice President of Information Technology at Horizon, and the Vice President of Informational Technology and Information Services at Viela Bio, among other positions within biopharma companies. Ms. Zhang reports to Lisa Hegg, Senior Vice President of Program Management and Corporate Infrastructure. Ms. Hegg provides information technology and cybersecurity reports as necessary at meetings of management's Disclosure Committee, which is communicated quarterly to the Audit Committee, with greater frequency as necessary. Ms. Zhang regularly informs Ms. Hegg, our Chief Executive Officer (CEO) and other members of the leadership team, about the Program, best practices, current cybersecurity threats, the risk landscape, and mitigation strategies. These reports include the following on an as-needed basis: updates on the Program; assessment of the Program; emerging risks or concerns; policies, procedures, and training; and risk mitigation strategies.


text: The underlying controls of our Program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). Ms. Zhang is responsible for developing enterprise-wide cybersecurity strategy, architecture, policies, processes, and controls, and is directly responsible for our cybersecurity program.


text: Cybersecurity Governance Our board of directors oversees risks from cybersecurity threats and has delegated responsibility for such oversight of cybersecurity matters to the audit committee. The audit committee receives periodic updates from TIAA's cybersecurity leadership regarding the overall state of TIAA's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.

companyName: Nuveen Global Cities REIT, Inc.