text: Our EVP, Information Technology and Global Security has over 40 years of global information technology leadership experience, including hands-on management and technology innovation experience. He provides strategic direction for the design, implementation strategy, and Governance of Concentrix Global Infrastructure, Information Security and Application development. Our SVP, Information Systems and Global Security has an undergraduate degree in Information Technology and over 24 years of global experience in cybersecurity strategy and risk management in various leadership roles at large companies and within government, with extensive experience in the development of and enforcement of security policies, protection of sensitive data, responding to cyber and fraud incidents, and integrating security across operations. Our SVP, IT Infrastructure has over 29 years of experience in managing a large, geographically dispersed team that designs, plans, implements, and maintains a complex IT infrastructure and operations. He has also played a critical role in the development of security technologies at Concentrix. Our GVP, Governance, Risk, and Compliance has over 22 years of global experience in information security with specialization in risk management, security tools and technologies, compliance, and privacy. His experience in information security spans advisory and consulting, policy, processes and standards, engineering, and operational support for clients and the internal organization.


text: We take a holistic, multi-layered approach to management and oversight of cybersecurity risks. Our board of directors has ultimate oversight responsibility but has delegated to the board's Care, Compliance, & Cybersecurity Committee focused and pertinent oversight duties, which have been integrated into our overall enterprise risk management program, as described below. Our Chief Information Officer provides quarterly reports on our cybersecurity program to the Care, Compliance, & Cybersecurity Committee. These reports include details and metrics on, among other things, our routine vulnerability assessments, internal and external threat intelligence, company-wide phishing exercises and training, device encryption, device patching, routine resilience efforts including quarterly disaster recovery exercises, tabletop incident response and business continuity exercises. The chairperson of the Care, Compliance, & Cybersecurity Committee briefs the full board of directors on such quarterly reports.

companyName: Enhabit, Inc.

ticker: EHAB

secItem: Item 1C

stage1Category: Board Governance

stage1Method: unanimous


text: The Chief Information Officer and our Chief Information Security Officer also serve on management's Enterprise Risk Committee, along with our executive management team, the Chief Compliance Officer, and internal audit personnel. The Enterprise Risk Committee meets regularly during the year to assess various significant risks—including cybersecurity risks—and receives cybersecurity updates in connection with those assessments and the development and implementation of any risk mitigation plans. Our President and Chief Executive Officer presents the report of the Enterprise Risk Committee quarterly to the full board of directors.

stage1Category: Risk Management Process

stage1Method: majority


text: We also maintain an inter-departmental privacy and security committee which oversees programs and initiatives to protect and secure patient information as well as our data and information systems. This committee reports to our executive management team and has responsibility for our IT-security incident response plan and various training and awareness programs that promote patient privacy and system security practices by employees.


text: We have structured our cybersecurity program around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and processes to assess, identify and manage cybersecurity risks. Key components of our strategy include annual and ongoing security awareness training for employees, advanced detection and monitoring systems, and robust incident response and containment. We actively monitor and investigate both internally discovered and externally reported issues that may compromise our information systems, permitting quick and decisive action when necessary. We also have engaged third-party service providers and have implemented cybersecurity risk management protocols for such parties. For example, all vendors are required to complete our Ongoing Monitoring Assessment Questionnaire, which helps monitor each vendor's continuing compliance, and we subject our technology vendors to a separate vetting and approval process formally assessing each vendor from a cybersecurity perspective.


text: Our Chief Information Security Officer, who reports to our Chief Information Officer, brings to bear more than two decades of experience implementing NIST cybersecurity frameworks, including most recently five years as chief information security officer for a Fortune 200 company. He also holds multiple certifications including the globally recognized Certificate Information Systems Security Professional designation since 2006. The Chief Information Security Officer leads a dedicated team of internal IT employees, along with multiple long-term third-party security vendors. Our board of directors, and the Care, Compliance, & Cybersecurity Committee of the board, supports our Chief Information Officer and Chief Information Security Officer by leveraging members' experience with information technology and management, including information technology strategy and risks associated with cybersecurity matters, as part of its oversight function.

stage1Category: Management Role


text: Our policies and procedures concerning cybersecurity matters apply to all employees. These policies and procedures address encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information, and the use of the internet, social media, email and wireless devices.


text: We have experienced threats to our data and systems, including malware and computer virus attacks from time to time. To our knowledge, these threats have not materially affected us, our business, financial position, results of operations or cash flows to date. For more information about the cybersecurity risks we face, see Item 1A, "Risk Factors—Other Operational and Financial Risks."

stage1Category: Strategy Integration


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our Technology Risk Management Committee, which is comprised of representatives from our business operations and support functions (e.g., legal, finance, internal audit, commercial, privacy), assesses risks based on probability and potential impact to key business systems and processes. Risks that are considered high are incorporated into our overall risk management program. A mitigation plan is developed for each identified high risk, with progress reported to the Technology Risk Management Committee and tracked as part of our overall risk management program overseen by the Audit Committee of our board of directors.

companyName: REGENERON PHARMACEUTICALS, INC.

ticker: REGN


text: We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services.


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company. Refer to the risk factor captioned "Significant disruptions of information technology systems or breaches of data security could adversely affect our business" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on our Company.


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The Audit Committee of the board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, and reports from the Chief Audit Executive on our enterprise risk profile on an annual basis. The Audit Committee reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. The Company's Chief Information Security Officer ("CISO"), in coordination with the Chief Information Officer and the Technology Risk Management Committee, is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. The current CISO has over 35 years of experience in information security and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. The CISO provides periodic updates on our cybersecurity risk profile to management's Technology Risk Management Committee, the Audit Committee of our board of directors, and the Audit Committee chair.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our Technology Risk Management Committee, which is comprised of representatives from our business operations and support functions (e.g., legal, finance, internal audit, commercial, privacy), assesses cybersecurity risks based on probability and potential impact to key business systems and processes. Cybersecurity risks that are considered high are incorporated into our overall risk management program. A mitigation plan is developed for each identified high risk, with progress on risk mitigation reported to the Technology Risk Management Committee and tracked as part of our overall risk management program, which is overseen by the Audit Committee of our board of directors.


text: We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a process to conduct due diligence on third parties with which we work to oversee and identify material risks from cybersecurity threats associated with our use of those third parties' services, including those that perform cybersecurity services.


text: We are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: MediaAlpha, Inc.

ticker: MAX


text: To date, the Company is not aware of risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to the risk factor captioned "Significant disruptions of information technology systems or breaches of data security could adversely affect our business" in Part I, Item 1A. "Risk Factors" for additional information regarding cybersecurity risks and potential related impacts on our Company.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. The Company's Chief Information Security Officer ("CISO"), in coordination with the Chief Information Officer and the Technology Risk Management Committee, is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. The current CISO has over 35 years of experience in technology and information security, including operating in the role of the CISO for several large companies in the pharmaceutical and healthcare industries, and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. The CISO provides periodic updates on our cybersecurity risk profile to management's Technology Risk Management Committee and the Audit Committee of our board of directors.


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated into our broader Information Security Management System ("ISMS"), which is designed to identify, assess, prioritize, and mitigate risks across the organization and to enhance our resilience and support the achievement of our strategic security objectives. Our cybersecurity risk management program includes a cybersecurity incident response plan. The audit committee of our board of directors oversees enterprise risk management as an integral and continuous part of its oversight role. Integrated into our overall enterprise risk management framework are processes dedicated to the identification, assessment and management of material risks from cybersecurity threats. Our approach to cybersecurity risk management is both proactive and defensive, and includes the following elements: • a team dedicated solely to cybersecurity and managed by our interim chief security officer ("CSO"), who reports directly to our Chief Product Officer. The interim CSO and his team are responsible for leading enterprise-wide cybersecurity strategy, policies, standards, architecture and processes. Our interim CSO has over 25 years of information technology ("IT") and cybersecurity, including the cybersecurity architecture at 23andMe, principle cybersecurity engineering at CA Technologies, and corporate IT management, with nearly seven years in security at 23andMe. He holds industry-recognized certifications in CCSK, CCFE, and ITIL v3. • an information technology vulnerability assessment process that includes internal testing, as well as engages with outside security researchers, for identification, evaluation and management of cybersecurity risks. For example, we conduct tests to identify potential vulnerabilities, such as penetration tests, manage a bug bounty program, conduct table top and red team/purple team exercises to evaluate the effectiveness of our ISMS and cybersecurity practices. • a Security Incident Response plan pursuant to which our interim CSO and his team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents in accordance with our defined Privacy and Security Incident Response plan, which is reviewed along with other plans relevant to our cybersecurity risk management on an annual basis. • an information technology request review process that includes cybersecurity assessments of third-party products and systems proposed to connect to our information systems environment or access our data. • a training program pursuant to which we provide staff with timely relevant security topics, which include social engineering, phishing, password protection, protecting personal data, appropriate use of assets, and • an annual certifications program by an accredited third-party auditor for compliance with ISO/IEC 27001:2013 for an ISMS, ISO/IEC 27701:2019 for a PIMS as well as the requirements and control implementation guidance within ISO/IEC 27018:2019 for cloud computing.

companyName: Chrome Holding Co.

ticker: MEHCQ


text: Cybersecurity Team and Strategy — The cybersecurity team, led by the interim CSO, is responsible for managing the day-to-day cybersecurity strategy of the organization. Including oversight of our cybersecurity tools and controls to protect company assets. We have implemented an iterative and multi-layered cybersecurity strategy that incorporates both proactive review of the evolving cybersecurity threat landscape and reactive management of cybersecurity threats. Our proactive management of cybersecurity risks includes zero trust access, data loss prevention programs, correction of potential cybersecurity risks, and programs for employee education regarding cybersecurity risks. Our reactive management of cybersecurity risks includes continuous logging and alerting, utilization of enterprise cybersecurity technology, and personnel dedicated to incident response.


text: Third-Party and Vendor Management Review Processes — We have implemented processes that establish a systematic approach to assessing the cybersecurity controls while on-boarding new third-party vendors. Additionally, we have implemented annual reviews of the cybersecurity controls for third-party vendors that provide essential services and/or store data that presents a business risk to us and/or our customers.

stage1Category: Third-Party Risk


text: Cybersecurity Incident Response Plan — In October 2023, we experienced a cybersecurity incident in which certain information of our users was accessed and downloaded from individual 23andMe.com accounts without the account users' authorization. Following this incident, we implemented certain changes to our information systems and processes meant to provide additional protections to our environment, including enhancements to our Security Operations, reset customer passwords, required two-factor verification for new and existing customers, detection tools and capabilities, and implementation of new tools and processes, among others. However, we continue to face a heightened risk of cybersecurity threats which may materially impact our operations. For more information about our cybersecurity related risks, see "We have experienced a criminal cyber incident and could in the future experience other security breaches, disruption to our business, or reputational harm" in Part 1, Item 1A, Risk Factors of this Form 10-K.

stage1Category: Incident Disclosure


text: Board Oversight — Our board of directors has identified the oversight of cybersecurity risks to be one of its priorities, and it receives regular reports from management, including the interim CSO, on various cybersecurity matters, including the security of the company's information systems, anticipated sources of future material cyber risks and how management is addressing any significant potential vulnerability. The board's audit committee reviews our cybersecurity program at least annually and receives regular updates on cybersecurity threats and other matters. In addition to regular updates to the audit committee, we have protocols by which we escalate certain cybersecurity incidents and, where appropriate, report on them in a timely manner to the board and the audit committee.


text: Management Oversight — We have implemented a cross functional ISMS governance committee that drives awareness and alignment across broad governance and stakeholder groups for effective cybersecurity risk management. The interim CSO and interim Data Privacy Officer ("DPO") co-chair the ISMS Governance Committee. The ISMS Governance Committee acts in alignment with the Data Protection Governance Committee, another cross-functional governance committee, which provides strategic direction and oversight over the company's program related to data protection. These governance committees have responsibility for oversight, resource allocation, capabilities and planning. Members of the ISMS committee review newly identified cybersecurity risks, evaluate the appropriate treatments, monitor the on-going status of risk remediation. The interim CSO and DPO regularly report to the audit committee on these matters.


text: At Eos, we leverage a cybersecurity model that focuses on four key areas: prevention, detection, assessment, and remediation through an array of internal and external systems, along with the expertise of third-party service providers. This model is supported internally by Eos' Information Technology Department ("ITD"), along with expertise of external cybersecurity experts. Our model is also supported through security awareness training for all employees during the onboarding process and on a regular basis thereafter.

companyName: Eos Energy Enterprises, Inc.

ticker: EOSE


text: Our Board of Directors has overall oversight responsibility for our cybersecurity model. Our overarching cybersecurity programs are under the direction of the Eos leadership team, and directly supported by the efforts of the ITD. The ITD, led by the Director of ITD, reports to the Chief Financial Officer ("CFO") of the Company. With over 7 years of experience leading cybersecurity teams and programs, our Director of ITD leverages a combination of internal and external systems and security experts to keep our CFO informed of potential risks to the organization. The Director of ITD is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs and systems. Management reports material cybersecurity risks to our Board of Directors on an annual basis. In addition, our management follows a risk-based escalation process to notify the Board of Directors outside of the regular reporting cycle when they identify an emerging risk or material issue.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Part I, Item 1A- Risk Factors in this Annual Report on Form 10-K.


text: Our Board of Directors has overall oversight responsibility for our cybersecurity model. Our overarching cybersecurity programs are under the direction of the Eos leadership team and directly supported by the efforts of the ITD. The ITD, led by the Director of ITD, reports to the Chief Financial Officer ("CFO") of the Company. With over 8 years of experience leading cybersecurity teams and programs, our Director of ITD leverages a combination of internal and external systems and security experts to keep our CFO informed of potential risks to the organization. The Director of ITD is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs and systems. Management reports material cybersecurity risks to our Board of Directors on an annual basis. In addition, our management follows a risk-based escalation process to notify the Board of Directors outside of the regular reporting cycle when they identify an emerging risk or material issue.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Part I, Item 1A- Risk Factors in this Annual Report on Form 10-K.


text: Cybersecurity Risk Management and Strategy Safeguarding information by securing our systems, data, and networks is a key priority for our business. Rocket Companies relies on our technology networks and systems, as well as those of certain third parties and affiliates, to collect, process, transmit and store information. We require the secure, efficient, and uninterrupted operation of those networks and systems to provide our clients with the best possible experience. With this in mind, we maintain an Information Security Program to protect the confidentiality, integrity, and availability of client information.

companyName: Rocket Companies, Inc.

ticker: RKT


text: The Rocket Companies Information Security Program ("Program") is managed by the Rocket Companies Chief Information Security Officer ("CISO"), who is responsible for the creation and execution of our information security strategy. The CISO has more than 30 years' experience managing business risk and developing and implementing information security strategy.


text: Rocket Companies aligns its Program to the National Institute of Standards (NIST) Cyber Security framework. The Program is reviewed and updated by regular risk assessments, which identify reasonable and foreseeable internal and external risks. Rocket performs ongoing assessments of its Program to measure both the sufficiency of the safeguards to control risk and the design and operating effectiveness of our security requirements and controls. We implement information security policies throughout our operations, and our enterprise risk management ("ERM") process considers information security risks alongside other company risks as part of our overall risk assessment process.


text: The Rocket Companies Vendor Risk Management Program extends our safeguards to third-party service providers. Our Vendor Risk Management Program includes a robust due diligence process to review and affirm on an initial and periodic basis that our third-party service providers protect our information with the same rigor we require of ourselves.


text: As far as internal training and compliance, we spend significant time and resources to communicate the Program to all team members via annual trainings, ongoing communications, and periodic testing of team member capabilities.


text: The CISO is charged with the continuous evolution of the Program to address emerging threats and new technologies, ensuring that we can adapt to the everchanging risk environment and those who seek to compromise our information. As such, the Program is regularly evaluated by both internal and external assessors to ensure its effectiveness by measuring its ability to prevent risk realization.


text: Cybersecurity Governance Our Board oversees our Information Security Program and cybersecurity risks, this includes receiving periodic management reports on cybersecurity and information security trends and regulatory updates, technology risks, and the implications for our business strategy.


text: On a periodic basis, the CISO provides reports and presentations to the Board, Audit Committee, and Rocket Senior Leadership, including the Rocket Risk Council. These CISO updates include recent industry developments, evolving standards, vulnerability assessments and technological trends. During 2023, the CISO updates included information regarding areas of increasing cybersecurity threats, the ongoing enhancements to our information security framework, processes to mitigate threats, and the results of a simulated cybersecurity incident tabletop exercise.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect Rocket Companies. However, there is no guarantee that we will not be subject to future threats or incidents. We deploy a monitoring program to detect potential threats and keep an incident response plan in place to respond if a security incident occurs. Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.


text: Our cybersecurity program includes some key aspects such as (i) a Cybersecurity Leader who oversees our day-to-day program, (ii) outsourced information technology firm and consultants with significant expertise in cybersecurity (iii) an incident response team comprised of a cross-section of management with oversight over our programs, (iv) incident detection and response policies, and (v) ongoing security awareness training programs for all employees.

companyName: American Outdoor Brands, Inc.

ticker: AOUT


text: Rocket Companies aligns its Program to the National Institute of Standards (NIST) Cyber Security framework. The Program is reviewed and updated by regular risk assessments, which identify reasonable and foreseeable internal and external risks. The Company performs ongoing assessments of its Program to measure both the sufficiency of the safeguards to control risk and the design and operating effectiveness of our security requirements and controls. We implement information security policies throughout our operations, and our enterprise risk management ("ERM") process considers information security risks alongside other company risks as part of our overall risk assessment process.


text: The Rocket Companies Vendor Risk Management Program performs initial and ongoing information security safeguards of our third-party service providers. Our Vendor Risk Management Program includes a robust due diligence process to review and affirm on an initial and periodic basis that our third-party service providers protect our information with the same rigor we require of ourselves.


text: On a periodic basis, the CISO provides reports and presentations to the board of directors, Audit Committee, and Rocket Senior Leadership, including the Rocket Risk Council. These CISO updates include recent industry developments, evolving standards, vulnerability assessments and technological trends. During 2024, the CISO updates included information regarding areas of increasing cybersecurity threats, the ongoing enhancements to our information security framework, deployment of security tools, processes to mitigate threats, and the results of a simulated cybersecurity incident tabletop exercise.


text: Cybersecurity Risk Management and Strategy We identify and assess cybersecurity risk in connection with our enterprise risk management ("ERM") process, which is directly tied to our management's strategic planning process.

companyName: Open Lending Corp

ticker: LPRO


text: We have implemented a variety of measures to assess, identify and manage material risks from cybersecurity threats. These measures include automated source code testing to help align our security infrastructure with application security best practices, and automated scanning and alerts to assess compliance against established security baselines. Our cybersecurity risk management process also includes defined timeframes for addressing vulnerabilities or other gaps identified by our automated detection and scanning tools. We also perform an annual evaluation of our alignment with the U.S. Commerce Department's National Institute of Standards and Technology framework. In addition, our Information Security team, which reports directly to our Chief Information Officer ("CIO"), performs regular internal vulnerability scans across our information technology systems, and we use an independent third-party service provider for the completion of bi-annual penetration testing to maintain our SOC II compliance.


text: Our employees are a key element of our cybersecurity and data privacy defenses. We administer mandatory and regular awareness programs for employees on cybersecurity. We require all new employees to complete security awareness training upon hire, and existing employees must complete security awareness training annually thereafter. We also conduct internal incident response tests, phishing test campaigns and other security-enhancing exercises throughout the year. In addition, we established measures to help mitigate the risk of exposure of personally identifiable information ("PII"). We have also implemented phishing protection and data loss prevention tools designed to enhance our cybersecurity throughout our information technology systems.


text: As part of our cybersecurity risk management processes, we regularly engage third-party service providers to assess our internal cybersecurity programs and compliance with applicable practices and standards.


text: Proactive Defense: We utilize industry-standard mechanisms to assess, identify, and address potential threats from cybersecurity incidents. Our dedicated information technology (IT) team continuously monitors the evolving cybersecurity landscape and develops robust response processes to swiftly and effectively handle emerging threats.

companyName: SES AI Corp

ticker: SES


text: Our cybersecurity risk management processes include assessing third-party risks and we regularly perform third-party risk assessments to help us identify and mitigate risks arising from our use of or partnership with third parties, such as vendors, suppliers, and other business partners. Third-party cybersecurity risks are also evaluated as part of our initial due diligence assessments upon engaging third-party providers, inclusive of potential fourth-party risks related to the handling and processing of employee, business, or customer data. In addition to due diligence procedures conducted during onboarding of new third-party providers, we perform annual risk assessments of key third-party providers, along with real-time assessments in accordance with our Incident Response Plan and procedures, as needed, to help us determine any potential impact to the Company from third-party cybersecurity incidents that come to our attention.


text: Our business necessitates the collection and storage of consumers' PII. As such, cybersecurity and data privacy are a top concern for us. As a preventative measure, we have implemented certain policies and procedures that guide our day-to-day operations in these areas.


text: To date, the Company is not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business, business strategy, results of operations or financial condition. For additional information, see "Item 1A—Risk Factors—Risks Related to Our Business—Cyber-attacks and other security breaches could have an adverse effect on our business" and "Item 1A—Risk Factors—Risks Related to Our Business—Disruptions in the operation of our computer systems and third-party data centers could have an adverse effect on our business."


text: Cybersecurity Governance Cybersecurity is an area of focus for our Board of Directors and our management. The Audit Committee of our Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats and is informed about cybersecurity risks through presentations from our CIO and our Chief Technology Officer ("CTO"), and other members of our management responsible for day-to-day management and mitigation of cybersecurity risks, as well as through its direct participation in our ERM process, which holistically addresses risks faced by us, including cybersecurity risk.


text: Our cybersecurity risk management processes are led by members of our management team, including our CIO and our CTO, who hold degrees in Management Information Systems and Computer Science, respectively, along with an average of 21 years of prior work experience in various roles involving information technology, including cybersecurity, compliance, systems, and programming. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategic processes described above, including the operation of our Incident Response Plan. The CIO and CTO report and provide updates to the Audit Committee on risks from cybersecurity threats quarterly or as needed.


text: We have implemented a variety of measures to assess, identify and manage material risks from cybersecurity threats. These measures include automated source code testing to help align our security infrastructure with application security best practices, and automated scanning and alerts to assess compliance against established security baselines. Our cybersecurity risk management process also includes defined timeframes for addressing vulnerabilities or other gaps identified by our automated detection and scanning tools. We also perform an annual evaluation of our alignment with the U.S. Commerce Department's National Institute of Standards and Technology framework. In addition, our Information Security team performs regular internal vulnerability scans across our information technology systems, and we use an independent third-party service provider for the completion of bi-annual penetration testing to maintain our SOC II compliance.


text: GoHealth's cybersecurity risk management program is based on industry standards and best practices, aligning with the Center for Internet Security and the National Institute of Standards and Technology (NIST) Cybersecurity Frameworks. The Company conducts control self-assessments and risk assessments in collaboration with assigned control owners and risk owners to evaluate the maturity and effectiveness of its cybersecurity processes. Based on prior third-party assessments, GoHealth has completed the majority of its Governance, Risk and Compliance (GRC) roadmap initiatives and is currently deploying various comprehensive security tools and programs to further strengthen its cybersecurity posture.

companyName: GoHealth, Inc.

ticker: GOCO


text: Cybersecurity Governance Cybersecurity is an area of focus for our Board of Directors and our management. The Audit Committee of our Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats and is informed about cybersecurity risks through presentations from members of our management responsible for day-to-day management and mitigation of cybersecurity risks, as well as through its direct participation in our ERM process, which holistically addresses risks faced by us, including cybersecurity risk.


text: Our cybersecurity risk management processes are led by members of our management team, who are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through management of, and participation in, the cybersecurity risk management and strategic processes described above, including the operation of our Incident Response Plan. Our management team reports and provides updates to the Audit Committee on risks from cybersecurity threats quarterly or as needed.


text: Cybersecurity Processes and Risk Assessment We rely on the cybersecurity program implemented by Blue Owl, the indirect affiliate of our Adviser. Blue Owl has implemented a cybersecurity program, which is focused on (i) protecting the confidentiality of business, client, investors in its funds and its employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: Blue Owl Capital Corp III


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").


text: Blue Owl's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed by Blue Owl IT Management for remediation. When Blue Owl engages vendors and other third party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess and manage cybersecurity events. The framework is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by an internal team that is responsible for enterprise-wide cybersecurity strategy, policies, engineering and processes. The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.


text: Our Board of Directors has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: Impact of Cybersecurity Risks In 2023, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Internal and external cybersecurity threats and risks, as well as other disasters, may adversely affect our business or the business or our portfolio companies by impairing the ability to conduct business effectively." and "Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business."


text: GoHealth's services involve the collection, processing, use, storage and transmission of confidential and personal information of consumers and employees. Maintaining the integrity, confidentiality and availability of this information as well as the information technology systems in which the information resides is critical to the Company's operations and business strategy.

stage1Category: None/Other


text: The Company takes a comprehensive, cross-functional approach to developing strategies for identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents. The Company maintains a business continuity and disaster recovery plan as well as a cybersecurity insurance policy.


text: Risk Management and Strategy Cybersecurity risk management is integrated into the Company's broader enterprise risk management ("ERM") program. The ERM program, led by the Company's Internal Audit and Legal teams, consolidates the collective input of executive management to prioritize enterprise-level risks, develop risk mitigation initiatives and establish monitoring functions. The Internal Audit and Legal teams perform an enterprise risk assessment annually and present the results to the Audit Committee of the Board of Directors. Further, our Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO") actively participate in the ERM program, including through diligence conducted as part of the broader ERM program.


text: Our CISO, who reports to our CTO, leads the cybersecurity program, strategy, policy, standards and processes. Our CISO has over a decade of experience working in information technology and security and earned a Certified Information Security Manager (CISM) certification. Our CTO has over twenty-five years of experience working in engineering and technology. The CISO is supported by a cybersecurity team comprised of experienced information security professionals. The CISO provides the CTO with bi-weekly updates on security and compliance risks and initiatives. Each quarter, the CTO presents a cyber risk and incident review to GoHealth's internal Compliance Committee, comprised of cross-functional senior leadership members including C-suite level executives and personnel from the Legal, Compliance and Internal Audit teams.


text: The Company's cybersecurity risk management program is based on industry standards and best practices and aligns with the Center for Internet Security and National Institute of Standards and Technology ("NIST") cybersecurity frameworks. On an annual basis, GoHealth engages a third-party vendor to assess the maturity of its cybersecurity processes, which assigns the Company an NIST Cyber-Security Framework implementation tier score upon completion of the assessment. A third-party vendor is also currently conducting a qualitative assessment of GoHealth's cybersecurity controls, policies and programs, the output of which will be a comprehensive report issued to the Company.


text: GoHealth engages with a range of additional third-party cybersecurity service providers, assessors and auditors to evaluate and enhance the effectiveness of its cybersecurity program. Services provided by these third parties include endpoint and network monitoring, vulnerability scanning, penetration testing and security and compliance posture assessments. To mitigate risks associated with third-party sources, the Company requires third parties with access to personal, confidential or proprietary information to implement and maintain cybersecurity practices consistent with applicable legal standards and industry best practices and to enter into business associate agreements containing contractual provisions with respect to the handling of such information. GoHealth also conducts information security assessments of these third parties prior to engaging with them.


text: The Company has established cybersecurity and information security awareness training programs. Formal training on topics relating to the Company's cybersecurity, data privacy and information security policies and procedures is mandatory at least annually for all employees and contractors with access to the Company's network. In addition to the annual security training requirement, employees participate in monthly phishing tests, and where appropriate, additional security awareness follow-up training in response to such tests. Training is supplemented through periodic Company communications encouraging all employees and contractors to promptly report security events, incidents and abnormal system behavior.


text: As of the date of this 2023 Annual Report on Form 10-K, the Company is not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, its business strategy, results of operations or financial condition; however, we cannot provide assurance that these threats will not result in such an impact in the future, as discussed in the risk factors entitled "Risks Related to Our Business" and "Risks Related to Our Intellectual Property and Technology" in Part I, Item 1A. of this 2023 Annual Report on Form 10-K.


text: The Board of Directors recognizes the importance of cybersecurity in safeguarding the Company's sensitive data. The Board of Directors is responsible for overseeing overall risk management for the Company, including review and approval of the ERM approach and processes implemented by management to identify, assess, manage and mitigate risk. The Audit Committee is central to the Board of Director's oversight of cybersecurity risks and bears the primary responsibility for assessing and managing the Company's material risks from cybersecurity threats.


text: Cybersecurity risk oversight is also a key area of focus for management. As discussed above, the CISO is the primary management team member responsible for the cybersecurity program, strategy, policy, standards and processes. On a quarterly basis, or more frequently if a need arises, the CTO and CISO present a briefing to the Audit Committee regarding the Company's cybersecurity program. The presented topics include, but are not limited to, the status of ongoing cybersecurity initiatives, incident reports and compliance with industry standards. Potentially material cybersecurity matters are escalated to the Audit Committee and/or the full Board of Directors, as appropriate, for risk oversight.


text: Risk Management and Strategy Cybersecurity risk management is integrated into the Company's broader enterprise risk management ("ERM") program. The ERM program, led by the Company's Internal Audit and Legal teams, consolidates the collective input of executive management to prioritize enterprise-level risks, develop risk mitigation initiatives and establish monitoring functions. The cybersecurity program includes the development of a structured control framework and risk taxonomy that aligns with anticipated business risk. The Internal Audit and Legal teams perform an enterprise risk assessment annually and present the results to the Audit Committee of the Board of Directors. Further, our Chief Technology Officer ("CTO") actively participates in the ERM program, including through diligence conducted as part of the broader ERM program.


text: Our CTO has direct responsibility for cybersecurity and overseeing the Company's cybersecurity strategy, policies, standards and processes. Our CTO has more than 25 years of experience developing user-centric consumer marketplaces and artificial intelligence products and has held various leadership roles in product development, product design and data science. The CTO is supported by two senior risk, compliance, and security leaders who engage regularly with the CTO to manage cybersecurity and compliance risks. Additionally, the Company's cybersecurity team is comprised of experienced information security professionals dedicated to protecting the company's assets. The CTO receives regular updates on security, compliance risks and initiatives and provides a quarterly cybersecurity risk and incident review to GoHealth's Internal Compliance Committee. This committee includes cross-functional senior leadership members, including C-suite executives and personnel from legal, compliance and internal audit.


text: GoHealth engages with a range of additional third-party cybersecurity service providers, assessors and auditors to evaluate and enhance the effectiveness of its cybersecurity program. Services provided by these third parties include endpoint and network monitoring, vulnerability scanning, penetration testing and security and compliance posture assessments. To mitigate risks associated with third-party sources, the Company requires third parties with access to personal, confidential or proprietary information to implement and maintain cybersecurity practices consistent with applicable legal standards and industry best practices and to enter into business associate agreements containing contractual provisions with respect to the handling of such information. GoHealth also conducts risk-based information security assessments of these third parties prior to engaging with them.


text: As cybersecurity incidents occur, the Company's cybersecurity team focuses on responding to and containing the threat and minimizing any business impact, as appropriate. In the event of an incident, the cybersecurity team assesses, among other factors, safety impact, data and personal information loss, business operations disruption, projected cost and potential for reputational harm, with support from external technical, legal and law enforcement support, as appropriate.


text: As of the date of this 2024 Annual Report on Form 10-K, the Company is not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, its business strategy, results of operations or financial condition; however, we cannot provide assurance that these threats will not result in such an impact in the future, as discussed in the risk factors entitled "Risks Related to Our Business" and "Risks Related to Our Intellectual Property and Technology" in Part I, Item 1A. of this 2024 Annual Report on Form 10-K. GoHealth, Inc.


text: Cybersecurity risk oversight is also a key area of focus for management. As discussed above, the CTO is primarily responsible for the cybersecurity program, strategy, policy, standards and processes. On a quarterly basis, or more frequently if a need arises, the CTO presents a briefing to the Audit Committee regarding the Company's cybersecurity program. The presented topics include, but are not limited to, the status of ongoing cybersecurity initiatives, incident reports and compliance with industry standards. Potentially material cybersecurity matters are escalated to the Audit Committee and/or the full Board of Directors, as appropriate, for risk oversight.


text: In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a third-party information technology team, which reports to our Senior Vice President of Human Resources and Administration, and includes mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data while also maintaining a stable information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, contract research organizations, and other contractors and suppliers. We have an incident response plan designed to mitigate and remediate identified cybersecurity incidents and escalate certain incidents as appropriate to management and the Audit Committee. We also conduct periodic employee trainings on cyber and information security, among other topics. As needed, we consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks in order to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: Assertio Holdings, Inc.

ticker: ASRT


text: Our Senior Vice President of Human Resources and Administration, who reports directly to our interim Chief Executive Officer, is responsible for overseeing the assessment and management of cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have no identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Data breaches and cyber-attacks can compromise our intellectual property or other sensitive information and cause significant damage to our business."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board of Directors to oversee cybersecurity risks. The Audit Committee receives, at a minimum, quarterly updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President of Human Resources and Administration as well as other members of the senior leadership team, including, if necessary, the Chief Financial Officer. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Risk Management and Strategy In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks arising from internal and external cybersecurity threats and vulnerabilities from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a third-party information technology team, which reports to our Senior Vice President of Human Resources and Administration, and includes mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data while also maintaining a stable information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors. We have an incident response plan designed to mitigate and remediate identified cybersecurity incidents at both Assertio and our customers and vendors and escalate certain incidents to management and, as appropriate, the Audit Committee. We also conduct periodic employee trainings on cyber and information security, among other topics. As needed, we consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks in order to anticipate future threats and trends, and their impact on the Company's risk environment. Cybersecurity risks and threats are integrated into our enterprise risk management ("ERM") program, which establishes a risk management framework that seeks to identify and assess risks that could materially impact our business and operations.


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Board oversees the ERM program and oversees an enterprise-wide approach to risk management, including risks related to cybersecurity.


text: The Audit Committee, which is comprised solely of independent directors, has been designated by our Board of Directors to oversee cybersecurity risks. The Audit Committee receives, at a minimum, quarterly updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President of Human Resources and Administration as well as other members of the senior leadership team, including, if necessary, the Chief Financial Officer. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Our Senior Vice President of Human Resources and Administration, who reports directly to our Chief Executive Officer and has been responsible for overseeing the assessment and management of cybersecurity risks at Assertio for approximately a year and a half.


text: Since the beginning of the last fiscal year, there were no identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Business interruptions, including data breaches and cyber-attacks can compromise our intellectual property or other sensitive information and cause significant damage to our business, can limit our ability to operate our business, and adversely impact the success of our commercialization partners."


text: Risk management and Strategy We have implemented a set of comprehensive cybersecurity and data protection policies and procedures placing special interest in addressing cybersecurity threats and effectively managing associated risks. Our cybersecurity program is designed to identify, assess, and proactively manage material risk from cybersecurity threats, which are integrated into our overall risk management systems, as overseen by the Company's Board of Directors, primarily through its Audit Committee. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system. Our information technology, or IT, program is led by our Director of Information Technology, who strives to monitor and mitigate risks from cybersecurity threats and provides reporting to the Audit Committee.


text: Our approach to cybersecurity is not a one-time effort but an ongoing process. We engage in monitoring, risk assessments, and robust security measures designed to ensure the confidentiality, integrity, and availability of our information systems, including critical computer networks, hosted services, communication systems, hardware, and software and to protect critical data, including our employees' and customers' data, intellectual property, confidential and proprietary data, and strategic competitive information. We address cybersecurity challenges and enhance our overall risk management efforts by adopting and working to integrate recognized best practices, standards, and controls utilizing guidelines from the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) for our protection and prevention of cybersecurity, risk management, data backup, and disaster recovery.


text: Structured Framework: Our company-wide cybersecurity policy outlines our security posture and incident response protocol, ensuring clear escalation procedures to inform senior management, the Audit Committee, and the Board of Directors of cybersecurity events as needed.


text: We maintain a practical approach to cybersecurity. Our cybersecurity risk management program (an integral part of our overall Enterprise Risk Management Program) is designed to incorporate guidance from NIST CSF and other industry best practices. Within our program, we conduct internal and external security-based activities, including reviews and assessments of our third-party service providers and vendors. Our employees receive a formal cybersecurity awareness training on an annual basis, including specific topics related to social engineering and email frauds.


text: Detailed activities include: • Continuous Monitoring and Detection: Leveraging industry leading technologies to detect and alert on any suspicious activity across the enterprise to prevent and minimize cybersecurity attacks; • Information Security Assessments: Collaborating with internal and external partners to evaluate our data and network security; • Vulnerability Scanning and Penetration Testing: Engaging third-party service providers to assess internal and external vulnerabilities and potential threats; • Cyber Risk Register Reviews: Regularly reviewing our internal risk register to remain fully informed and prepared to address potential and identified risks; • Risk Prioritization: Prioritizing and addressing risks through our dedicated cybersecurity risk management program and cybersecurity council; • Annual Third-Party SOC Reviews: Ensuring that our financially critical service partners maintain effective internal controls, including access controls, change management, backup, and disaster recovery planning; and • Tabletop Exercises and Event Simulations: Engaging all employees across the company to build awareness, education, and enhance our cyber response posture and the collective team decision-making processes. For more information about these risks, see the risk factor titled "Our business is subject to the risk of terrorism, cyberattacks, or failure of key information technology systems," "Breaches of our information systems could adversely affect our reputation, disrupt our operations, and result in increased costs and loss of revenue," and "If our efforts to protect the security of personal information related to any of our customers, consumers, vendors, or employees are unsuccessful and unauthorized access to that personal information is obtained, or we experience a significant disruption in our computer systems or a cyber security breach, we could experience an adverse effect on our operations, we could be subject to costly government enforcement action and private litigation, and our reputation could suffer" under Item 1A.


text: Our Board of Directors has assigned oversight of cybersecurity risk management to the Audit Committee. The Audit Committee regularly receives reports from management, including IT leadership, and third parties on cybersecurity matters. In addition, our full Board of Directors receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates. We periodically engage third-party audit and legal firms with industry-recognized expertise on cybersecurity matters to review specific aspects of our cybersecurity enterprise risk management framework and controls.


text: IT leadership is responsible for developing appropriate cybersecurity programs, including as may be required by applicable law or regulation. This includes the coordination and creation of an Incident Response Policy, Incident Response Team, and Incident Response Plan in the event of a cybersecurity event. The AOB Incident Response policy covers our internal program and guidelines. The incident response team is composed of various stakeholders from all necessary aspects of the business, and the plan includes the steps to follow and communications necessary if/when a cybersecurity event occurs. The individual incident response team members represent expertise in IT, cybersecurity, finance, and operations that has been obtained generally from a combination of education and awareness, including relevant degrees and/or certifications, and work experience. The Director of IT has served in various roles in information technology and information security for 30 years, including serving in technical management and leadership positions in multiple verticals. The Director of IT holds undergraduate and graduate degrees in computer science and has attained several recognized network and security certifications throughout their career. The individual incident response team members are informed by their respective cybersecurity teams regarding the monitoring, prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.


text: Information regarding cybersecurity risks may be elevated by IT leadership through a variety of channels, including discussions between or among key leaders and our management and reports to the Company's Board of Directors and/or certain Board committees. When a cybersecurity incident is detected, we conduct an immediate assessment, determine materiality, and take appropriate actions as described above. This process is also followed when we are notified that a supplier has a cybersecurity incident. As noted above, the Audit Committee regularly receives reports on cybersecurity matters from senior IT leadership.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Alight recognizes the importance of developing, implementing and maintaining robust cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity and availability of the data in our care. The Company utilizes a cross-functional group of colleagues representing various stakeholders including technology, security, finance, internal audit, legal and others to identify and manage risks across the organization, including risks relating to cybersecurity.

companyName: Alight, Inc. / Delaware

ticker: ALIT


text: Cybersecurity Risk Management and Strategy We have established and implemented a cybersecurity risk management program and information privacy program (collectively, our "Cybersecurity and Privacy Programs") that are collectively intended to protect the confidentiality, integrity, and availability of our critical information systems and the information residing therein. These programs are integrated into, and form a part of, our overall risk management program, and share similar methodologies, reporting channels and governance processes to those that apply across the broader risk management framework.

companyName: GoodRx Holdings, Inc.

ticker: GDRX


text: The Company's cybersecurity program is focused on continuous improvement and takes a layered approach to cybersecurity to include prevention, detection, and response-based controls. Our preventative measures include network-based controls, malware defenses, email security, encryption for data in motion and at rest, continuous vulnerability testing and mitigation, and multi-factor authentication. Our detection and response measures include comprehensive logging and continuous monitoring utilizing both in-house and Managed Security Services, forensics capability, and an enterprise crisis management function. Alight employees are assigned data privacy and security training upon on-boarding and annually thereafter. The training is designed in collaboration with a third-party service provider and is designed to raise awareness of security practices and to educate employees on how to protect information and infrastructure.


text: To support the overall cybersecurity program, Alight maintains an incident management team that tracks and logs privacy and security incidents across Alight, our vendors, and partners to better manage remediation and resolution of any such incidents. Significant incidents are promptly reviewed by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is escalated for further review, and then reported to designated members of our executive leadership team where needed. We consult with outside counsel and forensics firms as appropriate, including on materiality analysis and disclosure matters, and members of our executive leadership team make the final materiality determinations and, if appropriate, disclosure to law enforcement, regulators or clients. Our executive leadership team apprises Alight's Board of Directors and our independent public accounting firm of significant matters and any relevant developments.


text: Our cybersecurity frameworks are informed by third-party standards relevant to our industry such as the National Institute of Standards and Technology, the Center for Internet Security and the International Standards Organization. We regularly test our cybersecurity defenses through both automated and manual testing to identify, prioritize and remediate risk. Alight also engages third parties to examine and report on the effectiveness of our controls relating to our systems, including those used in the cybersecurity frameworks.


text: Our Chief Technology Officer, Chief Information & Security Officer and Chief Legal Officer provide periodic reports on our cybersecurity and risk management efforts, including with respect to information security practices, to the Audit Committee of our Board of Directors (the "Audit Committee"), as well as to other members of our executive leadership team, as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Where appropriate, the Audit Committee then periodically reports to the full Board of Directors regarding the Company's assessment of potential risk exposures and the steps management has taken to monitor and control such risks, which includes the Company's cybersecurity program designed to prevent, detect, and rapidly respond to any potential incident. In addition to our scheduled meetings, the Audit Committee and executive leadership team maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on significant developments in cybersecurity to facilitate proactive and responsive oversight. The Audit Committee is apprised of strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement helps drive integration of cybersecurity considerations into our Company's broader strategic objectives.


text: Additionally, because Alight partners with a number of third parties in the ordinary course of business, our management team has developed and implemented processes to oversee and manage significant risks associated with use of third-party service providers. We conduct thorough security assessments of critical third-party providers before engagement and periodically monitor vendor compliance with our security standards. The monitoring includes periodic assessments by our vendor management team and use of an independent vendor risk rating service that alerts Alight when there is a change in a service providers security posture. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Our Chief Information & Security Officer has over 30 years of experience in the cybersecurity industry, including, prior to joining Alight in 2021, as the SVP, Chief Information Security Officer at a multinational health insurance and health services company in the Fortune 100, and as head of cybersecurity for a U.S.-based financial services company in the Fortune 500, as well as for a federal banking institution and for a professional services company in the Fortune 500 specializing in information technology services. Our Chief Information & Security Officer reports directly to the Chief Technology Officer and meets regularly with other members of senior management and the Audit Committee.


text: Key elements of our Cybersecurity and Privacy Programs include, bu t are not limited to the following: • Teams responsible for managing security and privacy controls, risk assessments, and responding to cybersecurity incidents; • Security and privacy awareness training of our employees; • Privacy and security risk assessments designed to identify material privacy and/or cybersecurity risks to our systems, processes, and assets; • The use of external service providers to assist with privacy and security controls, including vulnerability management; • An incident response plan with trained personnel and personnel that are trained to execute the plan; and, • A third-party risk management process for service providers and vendors.


text: To date, we have not experienced any cybersecurity incidents that have materially affected our business, operations, or financial condition. As our operations evolve, we may consider implementing additional cybersecurity measures as appropriate for the size and complexity of our business.

companyName: Bodhi Tree Biotechnology Inc

ticker: BDTB


text: Our program is regularly evaluated by internal stakeholders and external parties with the results of those reviews reported to the executive leadership team and the Audit Committee, as appropriate. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. Our results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future incidents. To further preemptively mitigate the potential financial impact of cybersecurity incidents, we maintain liability insurance that includes cyber coverage. However, our insurance may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our insurance may not cover any or all incidents that occur or claims made against us, and addressing an incident or defending a suit, regardless of its merit, could be costly and divert management's attention from our business and operations. For more information on our cybersecurity related risks, see the Risk Factors in Item 1A. of this Annual Report.


text: Cybersecurity Risk Management and Strategy We have established and implemented a cybersecurity risk management program and information privacy program (collectively, our "Cybersecurity and Privacy Programs") that are collectively intended to protect the confidentiality, integrity, and availability of our critical information systems and the information residing therein. These programs are integrated into, and form a part of, our overall enterprise risk management program, and share similar methodologies, reporting channels and governance processes to those that apply across the broader enterprise risk management framework.


text: Our Cybersecurity and Privacy Programs include: • Teams responsible for managing security and privacy controls, risk assessments, and responding to cybersecurity incidents; • Security and privacy awareness training of our employees; • Privacy and security risk assessments designed to identify material privacy and/or cybersecurity risks to our systems, processes, and assets; • The use of external service providers to assist with privacy and security controls, including vulnerability management; • An incident response plan with trained personnel and personnel that are trained to execute the plan; and, • A third-party risk management process for service providers and vendors.


text: We are subject to an evolving threat landscape that could pose various risks to our business, and such risks are regularly evaluated and managed via our Cybersecurity and Privacy Programs by internal and external experts. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information regarding risks related to cybersecurity matters, please see Part I, Item 1A, "Risk Factors—We depend on our information technology systems, and those of our third-party vendors, contractors and consultants, and any failure or significant disruptions of these systems, security breaches or loss of data could materially adversely affect our business, financial condition and results of operations."


text: Cybersecurity Governance Our Board and its committees have an active role in overseeing risk management and they have delegated to the Compliance Committee oversight over our cybersecurity and data privacy risks. The Compliance Committee oversees management's implementation of our Cybersecurity and Privacy Programs, except to the extent direct oversight by the Board is required by the FTC Order.


text: The Compliance Committee receives periodic reports from management regarding cybersecurity and privacy risks, any material updates thereto and a summary of any cybersecurity and/or privacy events or incidents that have occurred, in each case, since the most recent update provided to the Compliance Committee. The Compliance Committee reports to the full Board regarding its activities, including those related to cybersecurity and privacy. In addition, at least once every twelve months and promptly after the occurrence of certain specified cybersecurity/data privacy incidents, the Board and our Interim Chief Executive Officer receive the written Cybersecurity and Privacy Program materials, which include the results of the most recent cybersecurity and privacy risk assessment and any evaluations thereof or updates thereto (collectively, the "Reporting Materials"). On an annual basis, management also leads the Board through a comprehensive review of the Reporting Materials, including, among other things, a review of the identified material cybersecurity and privacy risk exposures and the safeguards implemented to control such risk exposures.


text: Our Security Team is responsible for assessing and managing our material risks from cybersecurity threats and is primarily responsible for our overall Cybersecurity and Privacy Programs and collaborates with other employees and third parties to identify and mitigate applicable risks. The Security Team's experience includes various industry certifications (e.g., CISSP, CISM, CCSP, CISA, etc.), and industry experience (e.g., healthcare, technology, critical infrastructure, etc.).


text: Under the Cybersecurity and Privacy Programs, our Security Team monitors, prevents, detects, mitigates, and remediates cybersecurity risks and incidents via various means, including monitoring threat intelligence from various sources, internal and external vulnerability management, and alerts and reports produced by security tools. Reporting of such risks is regularly provided to the Board and the Compliance Committee, as applicable.


text: We are subject to an evolving threat landscape that could pose various risks to our business, and such risks are regularly evaluated and managed via our Cybersecurity and Privacy Programs by internal and external experts. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. For more information regarding risks related to cybersecurity matters, please see Part I, Item 1A, "Risk Factors—We depend on our information technology systems, and those of our third-party vendors, contractors and consultants, and any failure or significant disruptions of these systems, security breaches or loss of data could materially adversely affect our business, financial condition and results of operations."


text: Cybersecurity Governance Our Board and its committees have an active role in overseeing risk management and they have delegated to the Audit and Risk Committee oversight over our cybersecurity and data privacy risks, including oversight of management's implementation of our Cybersecurity and Privacy Programs, except to the extent direct oversight by the Board is required by the FTC Order. The Audit and Risk Committee oversees management's implementation of our Cybersecurity and Privacy Programs, except to the extent direct oversight by the Board is required by the FTC Order.


text: The Audit and Risk Committee receives periodic reports from management regarding cybersecurity and privacy risks, any material updates thereto and a summary of any cybersecurity and/or privacy events or incidents that have occurred, in each case, since the most recent update provided to the Audit and Risk Committee. The Audit and Risk Committee reports to the full Board regarding its activities, including those related to cybersecurity and privacy. In addition, at least once every twelve months and promptly after the occurrence of certain specified cybersecurity/data privacy incidents, the Board and our Chief Executive Officer and President receive the written Cybersecurity and Privacy Program materials, which include the results of the most recent cybersecurity and privacy risk assessment and any evaluations thereof or updates thereto (collectively, the "Reporting Materials"). On an annual basis, management also leads the Board through a comprehensive review of the Reporting Materials, including, among other things, a review of the identified material cybersecurity and privacy risk exposures and the safeguards implemented to control such risk exposures.


text: Our Security Team is responsible for assessing and managing our material risks from cybersecurity threats and is primarily responsible for our overall Cybersecurity and Privacy Programs and collaborates with other employees and third parties to identify and mitigate applicable risks. Our Security Team is composed of certified cybersecurity professionals responsible for assessing and managing cybersecurity risks, led by the Senior Director of Information Security & Compliance. The qualifications of our Security Team include the following industry-recognized certifications: ISC2 Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (C|EH), Certified Incident Handler (GCIH), Certified Intrusion Analyst (GCIA), GSEC, CompTIA Security+, A+ Network+, CISM, CCSK, MCSA, MCSE, MCP, MCT, and Cisco Certified Network Associate (CCNA). The Senior Director of Information Security & Compliance reports to our Chief Technology Officer, who has over 19 years of experience in information technology. The Senior Director of Information Security & Compliance brings over 13 years of experience in risk management, cybersecurity and compliance. The Security Team's experience in information security and cybersecurity spans across various industries, including healthcare, technology, and critical infrastructure.


text: Under the Cybersecurity and Privacy Programs, our Security Team monitors, prevents, detects, mitigates, and remediates cybersecurity risks and incidents via various means, including monitoring threat intelligence from various sources, internal and external vulnerability management, and alerts and reports produced by security tools. Reporting of such risks is regularly provided to the Board and the Audit and Risk Committee, as applicable.


text: We are materially dependent upon our networks, information technology infrastructure and related technology systems to provide services to our customers, manage our internal operations and support our strategic objectives. Cyber-attacks have become prevalent in our industry, and the techniques used to sabotage or obtain unauthorized access to systems are constantly expanding and evolving. Malicious actors are increasingly sophisticated in their methods, tactics, techniques and procedures, seeking to steal money, gain unauthorized access to, destroy or manipulate data, and disrupt operations.

companyName: Rackspace Technology, Inc.

ticker: RXT


text: As of the date of this report, we have not identified any cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably anticipated to have a material adverse effect on our business. However, we have experienced and expect to continue to experience cybersecurity threats and cybersecurity incidents. As an example, in December 2022, we previously disclosed a ransomware incident that caused service disruptions for our Hosted Exchange customers. We are committed to maintaining robust governance and oversight of cybersecurity risks and implementing recognized industry best practices to help prevent, detect, mitigate and respond to these risks; however, we cannot provide assurance that cybersecurity risks will not materially affect our business in the future, including our business strategy, results of operations, or financial condition or that our controls, processes and procedures will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems.


text: Independent Oversight: The Audit Committee, composed entirely of independent directors under SEC and NYSE rules, oversees our cyber risk exposure and evaluates our risk mitigation strategies. The committee is regularly briefed by our VP, IT Services in depth, and in turn briefs the Board of Directors on any material cyber risks and events.


text: Cybersecurity threats, whether or not successful, could result in our incurring significant costs related to rebuilding our internal systems, writing down inventory value, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We have seen an increase in cyberattack volume, frequency and sophistication.


text: See "Risk Factors - Security breaches, cyber-attacks and other interruptions to our or our third-party service providers' infrastructure have disrupted and may continue to disrupt our internal operations and we may be exposed to claims and liability, lose customers, suffer harm to our reputation, lose business-critical compliance certifications and incur additional costs." for more information on our cybersecurity risks.


text: Risk Management and Strategy Cybersecurity risk management is a component of the company's broader enterprise risk management program and we have established cybersecurity policies and procedures to protect against and mitigate harm from cybersecurity incidents. We respond to cybersecurity incidents in accordance with our cybersecurity policies and procedures and applicable law. Rackspace maintains a cross-functional approach to cybersecurity risk, which is designed to help prevent, identify, assess, manage, mitigate, and respond to cybersecurity threats.


text: Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, manage and address material cybersecurity risks. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our operations, systems, network, data, products and/or services, and have processes to assess those issues for potential cybersecurity impact or risk.


text: We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. Our cybersecurity policies and procedures include incident response plans which guide our employees, senior management, the Audit Committee and the Board on our response to cybersecurity incidents, including escalation processes, as appropriate.


text: Our team engages with external cybersecurity advisors and experts, including outside counsel and outside cybersecurity firms, assessors, auditors and consultants as necessary or appropriate. We also maintain numerous industry-related compliance certifications for various aspects of our business, such as International Organization for Standardization ("ISO") 27001, Service Organization Controls ("SOC 1, 2, 3") and Payment Card Industry ("PCI"), Federal Information Security Management Act ("FISMA"), Federal Risk and Authorization Management Program ("FedRAMP") and Health Information Trust Alliance ("HITRUST") in the U.S., Information Security Registered Assessors Program ("IRAP") in Australia and Public Services Network ("PSN") in the U.K.


text: Our cybersecurity policies and procedures are designed to vet key third-party providers and provide for oversight and cooperation regarding cybersecurity incidents. In addition, our cybersecurity policies and procedures require our third-party providers to meet appropriate security requirements and we investigate security incidents that have impacted our third-party providers, as appropriate; however, our ability to monitor our third-party service providers' data security is limited.