text: We face a number of cybersecurity risks in connection with our business. From we have identified cybersecurity threats and cybersecurity incidents that require us to make changes to our processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, results of operations, and financial condition.


text: Our management team is responsible for the management of risks we face, including our CIO. Our CIO has been in the role since May 2021, and has 30 years of experience in technology risk management and cybersecurity, primarily within the financial services sector.

companyName: Princeton Bancorp, Inc.

ticker: BPRN

secItem: Item 1C

stage1Category: Management Role

stage1Method: majority


text: our board of directors is responsible for the oversight of risk management. In that role, our board of directors, with support from our cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, our board of directors receives quarterly reports from our management team regarding cybersecurity risks, and our efforts to prevent, detect, mitigate, and remediate any cybersecurity incidents.

stage1Category: Board Governance

stage1Method: unanimous


text: The Company's management, including the Company's Chief Compliance Officer and the investment manager's Global Chief Information Security Officer, are responsible for conducting a regulatory risk assessment which includes cybersecurity threats. Members of Company management possess relevant experience in various disciplines that are important to effectively managing cybersecurity related risks including Security Operations, Vulnerability Management, Network Security, Application and Cloud Security, and cybersecurity risk management. Management of the Company and the investment manager maintain compliance programs which include policies and procedures that are reasonably designed to address regulatory risks related to cybersecurity. The compliance programs include controls to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents impacting the Company; in addition to the compliance programs, a vendor oversight program is leveraged to monitor risks associated with relevant service providers including cybersecurity.

companyName: PIMCO Capital Solutions BDC Corp.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and internal auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Adviser's risk management program and processes, which include cyber risk assessments.


text: Board Oversight of Cybersecurity Risks The Board provides oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Global Chief Information Security officer or their designee regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's Chief Compliance Officer ("CCO"), is responsible for assessing and managing material risks from cybersecurity threats. Members of Company management possess relevant expertise in various disciplines that are key to effectively managing such risks. Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: We recognize the importance of assessing, identifying, and managing risk associated with cybersecurity threats. Our external advisor has implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such risks. Our advisor has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: LUB LIQUIDATING TRUST

stage1Category: Risk Management Process


text: This cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, and financial risk areas.


text: As we are fully externally managed, we are reliant on our external manager's network and risk management program. Our external advisor has elected to engage third-party managed service providers to maintain its network and to manage the monitoring, detection, mitigation, and prevention of cybersecurity threats. These service providers are responsible for managing our advisor's hosted services, all of the computer and computer-related hardware and software they use, and for managing the backup process. Our manager's primary managed service provider supplies management with monthly updates and activity reports related to network alerts, connectivity issues and help desk tickets.


text: We are subject to risks from cybersecurity threats and incidents. As of December 31, 2024, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition. However, there can be no assurance that the Company will not be materially affected in the future.

stage1Category: Strategy Integration


text: December 31, 2024 Our Trustees consider cybersecurity risk as part of its risk oversight function. Our Trustees oversee management's implementation of our cybersecurity risk management program. Our Trustees will receive periodic reports from management on our cybersecurity risks as well as updates, as necessary, regarding any significant cybersecurity incidents impacting our advisor's information systems.


text: Risk Management and Strategy We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats, which include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or patients, and violation of data privacy or security laws. We employ multiple levels of protection designed to minimize the risks associated with cybersecurity, ransomware and data breaches, including firewalls, data loss prevention, email filtering for ransomware, proactive threat-hunting, cloud-based backups, multifactor authentication, encryption software, intrusion testing and SIEM networking monitoring to ensure the integrity of our data and systems. In addition, we maintain recovery and other business continuity procedures.

companyName: Guardian Pharmacy Services, Inc.

ticker: GRDN


text: Our cybersecurity risk management program is informed by prevailing security standards and is designed to provide a framework for evaluating and responding to cybersecurity risks. This includes processes for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat, implementing cybersecurity countermeasures and mitigation strategies, and informing and updating management and, as needed, the audit committee and our board of directors of cybersecurity incidents that may pose a significant risk for the business. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality, as well as operational and business impact, and reviewed for privacy impact.


text: We deploy technical safeguards that are designed to protect our information systems, products, operations and sensitive information from cybersecurity threats. These include including firewalls, data loss prevention, email filtering for ransomware, proactive thread-hunting, cloud-based backups, multifactor authentication, encryption software, intrusion testing and SIEM networking monitoring to ensure the integrity of our data and systems. In addition, we maintain recovery and other business continuity procedures, including cloud-based backups, electrical generators, critical systems housed at hardened data centers and geographic redundancy, intended to minimize disruptions to our operations in the event of disaster or other interruptions to our information systems. Our security events are logged to a central source and monitored by a third party security operations management provider.


text: We provide periodic training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities and access of the relevant Company personnel.


text: Recognizing the complexity and evolving nature of cybersecurity threats, incidents and risks, we engage third-party experts, including cybersecurity consultants, to evaluate and support our risk management systems. We also rely on software support from third-party vendors to assist with evaluating, monitoring, and testing our information technology systems. These relationships enable us to leverage specialized knowledge and insights, to help ensure our cybersecurity strategies and processes remain effective. Our collaboration with these third parties includes regular audits, routine system monitoring, threat assessments, incident response, and consultation on potential security enhancements. We require third-party service providers with access to personal, confidential, or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

stage1Category: Third-Party Risk


text: we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For further discussion of the risks associated with cybersecurity incidents, see " Risk Factors—Risks Related to Our Business—Interruptions to our information systems may materially and adversely affect our operating results " as well as "— Cybersecurity attacks or other data security incidents could disrupt our operations and expose us to regulatory fines or penalties, liability or reputational harm.


text: Our board of directors has overall oversight responsibility for our risk management, and delegates data protection and cybersecurity risk oversight to the audit committee. The audit committee receives regular briefings on cybersecurity risks and risk management practices, including, for example, recent developments in the external cybersecurity threat landscape, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends, as well as how management is addressing or mitigating those risks. The audit committee may also promptly receive information regarding any material cybersecurity incident that may occur, including any ongoing updates regarding the same. The audit committee periodically discusses our approach to cybersecurity risk management with our VP of Technology & Senior Security Officer.


text: Our VP of Technology & Senior Security Officer is responsible for overseeing our cybersecurity risk management program. Our VP of Technology & Senior Security Officer has over 20 years of extensive experience in information technology and security, and works in coordination with other members of the management team.


text: Our VP of Technology & Senior Security Officer, along with leaders from our privacy and corporate compliance functions, collaborate to implement a program designed to manage our exposure to cybersecurity risks and to promptly respond to cybersecurity incidents. Response to incidents is delivered by multi-disciplinary teams in accordance with our incident response plan. Through ongoing communications with these teams during incidents, the VP of Technology & Senior Security Officer monitors the triage, mitigation and remediation of cybersecurity incidents, and reports such incidents to executive management, the audit committee and other colleagues in accordance with our cybersecurity policies and procedures, as appropriate.


text: We are a special purpose acquisition company with no business operations and therefore, prior to the completion of a business combination, do not have any operations of our own that face cybersecurity threats. Since our initial public offering, our sole business activity has been identifying and evaluation suitable targets for a business combination. Therefore, the Company does not consider that it faces significant cybersecurity risk and has not adopted any cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. Our board of directors is ultimately responsible for overseeing the Company's risk management activities in general and will be informed, promptly and as deemed necessary by our management team, of any cybersecurity threats or risks that may arise, cyber incidents and industry trends, including regarding the appropriate disclosure, mitigation, or other response or actions that our board deems appropriate to take. As of the date of this Report, the Company did not identify any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy and results of operations. However, any such attack could adversely affect our business. We depend on the digital technologies of third parties and any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. A penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. For more information about the cybersecurity risks we face, see the risk factor entitled " Cyber incidents or attacks directed at us could result in information theft, data corruption, operational disruption and/or financial loss. " in " Item 1A. Risk Factors—General Risk Factors. "

companyName: Oaktree Acquisition Corp. III Life Sciences

ticker: OACC

stage1Category: None/Other


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying, evaluating suitable acquisition transaction candidates and completing the merger with our target acquisition companies. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: AltEnergy Acquisition Corp

ticker: AEAE


text: information technology and data to operate our business effectively and recognize the importance of implementing and maintaining cybersecurity systems and processes that allow us to protect the confidentiality, integrity and availability of our information systems and the data residing within them.

companyName: INFINITY NATURAL RESOURCES, INC.

ticker: INR


text: We maintain a comprehensive cybersecurity risk program to effectively identify, assess, manage, and respond to cybersecurity risks and incidents. Our program is implemented by in-house personnel with experience in cybersecurity fields and is further enhanced by external partners that specialize in cybersecurity services. Our program is built on recognized industry standards and frameworks that are regularly evaluated and updated to address emerging threats.


text: Key elements of our cybersecurity risk management program include regular and thorough risk assessments to identify potential cybersecurity threats across our operations, the implementation of appropriate multi-layered security controls and advanced monitoring systems, comprehensive employee cybersecurity awareness training and education programs delivered throughout the year. A key element of our cybersecurity response program is the regular and redundant point-in-time backup of critical configurations and files. The backup information is stored both locally and at off-site locations for additional security.


text: Our board of directors oversees our cybersecurity risk management program through the Audit Committee. Our management team, including our Senior Vice President of Operations, provides periodic updates on cybersecurity matters to the Audit Committee, which relays them to the board of directors as needed. Our Senior Vice President of Operations has primary responsibility for assessing and managing cybersecurity risks and leading our overall cybersecurity posture, including the engagement of external third parties to assist us. Our Senior Vice President of Operations has 10 years of experience in the field of information systems and cybersecurity.


text: from Cybersecurity Threats As of the date of this Annual Report, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations and financial condition. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents, material or otherwise, remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity incident will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. For more information about the cybersecurity risks we face, refer to "Item 1A. Risk Factors" in this Annual Report.


text: The Company, the Advisor and StepStone Group are affiliates of StepStone Group Inc., a Delaware corporation listed on the Nasdaq Stock Market LLC and whose securities are registered with the SEC pursuant to Section 12(b) of the Exchange Act. In general, the Company relies upon the information systems and other enterprise services provided by StepStone Group Inc. and its subsidiaries, including StepStone Group and the Advisor (together, "STEP").

companyName: Stepstone Private Credit Fund LLC


text: STEP maintains a cybersecurity program that is reasonably designed to protect the Company's information, and that of the Company's portfolio companies and investors, against cybersecurity threats that may result in significant adverse effects on the confidentiality, integrity, and availability of the information systems of STEP and its affiliates. Governance.


text: Board of Directors The Board of Directors of StepStone Group Inc. ("STEP Board") oversees STEP's processes for assessing and managing risk. The STEP Board's Audit Committee is responsible for reviewing and discussing STEP's practices with respect to risk assessment and risk management, and risks related to matters, including information technology and cybersecurity.


text: The STEP Board and Audit Committee regularly review the measures implemented by STEP to identify and mitigate risks from cybersecurity threats. As part of such reviews, the STEP Board and Audit Committee receive reports and presentations from those responsible for overseeing STEP's cybersecurity risk management, including the Partner, Head of Information Technology & CISO ("Head of IT") and STEP's Legal team, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to STEP's peers, industry participants, service providers and other third parties. The Head of IT also periodically presents to the STEP Board and its Audit Committee, including to describe STEP's information security infrastructure and improvements made, and to report on any significant developments in respect to STEP. From time to time, external legal advisers provide education to the STEP Board and/or Audit Committee in respect of information security related developments and to provide training in respect of directors' responsibilities.


text: At the Company level, the Company's Board oversees and monitors enterprise risk management at the Company, including with respect to cybersecurity and information security risk. The Company's Board and disclosure review team are expected to receive periodic reports and updates from the Head of IT, as applicable in the context of risks from cybersecurity threats that may impact the Company. STEP has a framework under which certain cybersecurity incidents are escalated within the Company and STEP and, where appropriate, reported to the Company Board, STEP Board or Audit Committee in a timely manner.


text: STEP has a cybersecurity working group composed of members of the Information Technology (including Information Security), Legal and Compliance departments, including the Head of IT, the Chief Legal Officer of STEP, the Chief Compliance Officer of STEP, and a number of their respective team members. The working group meets regularly to identify and mitigate data protection and cybersecurity risks, implement information security governance mechanisms, discuss developments in information security, and discuss and action any significant cyber incidents relevant to STEP, and its affiliates, including the Company. The working group is expected to escalate matters of significance to STEP's Incident Response Team, ERMC (defined below) and/or the STEP Disclosure Committee, as well as to the Company's disclosure review team, as appropriate.


text: STEP has adopted an Incident Response Plan ("IRP") that applies in the event of a cybersecurity threat or incident, including those that impact the Company, to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate, including stakeholders at the Company, as relevant. In general, STEP's incident response process leverages the NIST framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all STEP personnel and STEP networks and systems, third-party systems and end-user devices, including those of the Advisor and those relied upon by the Company.


text: In addition, STEP has an Enterprise Risk Management Committee ("ERMC") composed of a number of members of senior management from operations across STEP's businesses, legal, compliance, information technology, finance, human resources and internal audit and risk. The ERMC was established to oversee and ensure the efficient and effective management of STEP's enterprise risks. Cybersecurity and significant information security matters are to be brought before the ERMC or certain of its members, and matters of primary significance are to be further escalated and reported to the StepStone Global Executive Committee and the Audit Committee of the STEP Board and the Company's Board, as appropriate.


text: At the management level, the STEP Head of IT, who has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at STEP and elsewhere, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices and reports directly to the President and Co-Chief Operating Officer of STEP. The Head of IT receives reports on cybersecurity threats from his team and external service providers on an ongoing basis and, in conjunction with management, reviews risk management measures implemented by STEP to identify and mitigate data protection and cybersecurity risks, including those applicable to the Company and the Advisor. The Head of IT works closely with the STEP Legal and Compliance departments to oversee compliance with legal, regulatory and contractual security requirements and in developing reports and presentations to the STEP Board and its Audit Committee, as well as to the Company's Board. The Head of IT is responsible for providing regular training to STEP employees, including employees of the Advisor, in respect of information security. Risk Management and Strategy.


text: STEP takes a multifaceted approach to managing risk from cybersecurity threats. STEP's cybersecurity program leverages people, processes, and technology to identify and respond to cybersecurity threats in a timely manner. STEP's information security program, and supporting policies apply to all employees, contractors and vendors servicing the firm, including employees of the Advisor. The program outlines the development, maintenance, and distribution of information security policies and procedures that detail the implementation and maintenance of the information security program and its safeguards, and cover various areas such as information handling, user access management, encryption, data retention and backups, computer and network security and monitoring, physical security, incident reporting and response, service provider oversight, and employee and contractor use of technology. STEP also undergoes annual SOC 1 Type 2 testing of its financial processes and supporting technical controls. In addition to the foregoing, STEP conducts regular employee trainings on cybersecurity, which trainings apply to the Company's officers and employees of the Advisor, and performs phishing exercises to test employees' understanding of how to identify social engineering attacks. STEP performs diligence, including in respect of information security, of vendors and third parties with significant access to confidential information and personal data, and periodically monitors such vendors, including such vendors relied upon by the Company and the Advisor. STEP also employs systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems STEP and its affiliates use. STEP conducts annual penetration testing performed by a rotating group of third-party security firms to test STEP's technical controls and security response. STEP's internal audit team has also conducted a cybersecurity assessment to evaluate STEP's preparedness against potential cyber risks and threats. In addition to its internal cybersecurity capabilities and third-party penetration testing, STEP also, at times, engages consultants or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: Material Cybersecurity Risks, Threats & Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. To date, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition, but the Company faces certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an effect. Additional information on cybersecurity risks the Company faces can be found in Part I, Item 1A "Risk Factors" of this Report under the heading "Cybersecurity risks and cyber incidents could adversely affect our business by causing a disruption to our operations, which could adversely affect our financial condition and results of operations.", which should be read in conjunction with the foregoing information.


text: Although, as a blank check company, we do not have any operations, we are nonetheless subject to the risk of cybersecurity incidents. Among other things, the investments in our Trust Account and bank deposits may be vulnerable to such incidents, and we may depend on the digital technologies of third parties. We and third parties may be subject to cybersecurity attacks or security breaches. To the extent that we rely on the technologies of third parties, we depend upon the personnel and the processes of such third parties to protect against cybersecurity incidents, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, our Management Team will report to the Board of Directors and provide updates on the Management Team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering. In addition to our own cybersecurity risks, any proposed Business Combination target may have been subject to, or may in the future be subject to, cybersecurity incidents.

companyName: Churchill Capital Corp IX/Cayman

ticker: CCIX


text: We are a special purpose acquisition company with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: Range Capital Acquisition Corp.

ticker: RANG


text: Cybersecurity Risk Management and Strategy As an externally managed company, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Operating Manager, an indirect subsidiary of Apollo. Apollo determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for us and other affiliated entities managed by Apollo, and we rely on Apollo for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Apollo Infrastructure Co LLC


text: The Apollo Global Management, Inc. ("AGM") Board of Directors is involved in overseeing Apollo's risk management program, including with respect to cybersecurity, which is a critical component of Apollo's overall approach to enterprise risk management (" ERM "). Apollo's cybersecurity policies and practices are ful into its ERM framework through its reporting, risk management and oversight channels and are based, in part, on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas: Governance.


text: As discussed further under the heading "Cybersecurity Governance," the AGM Board of Directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer (" CISO


text: ) and the CISO of Athene (" AHL's CISO "), a subsidiary of AGM, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, and also receive support, as appropriate, from our executive officers and other representatives of the Operating Manager and its affiliates. Collaborative Approach.


text: Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by Apollo management, in consultation with our management and our Board as applicable, in a timely manner. Technical Safeguards.


text: Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. Incident Response and Recovery Planning.


text: Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. Third-Party Risk Management.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: Kayne Anderson BDC, Inc.

ticker: KBDC


text: Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems. Education and Awareness.


text: Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.


text: Apollo engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. Apollo regularly third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to Apollo's risk management function, and Apollo adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors— Risks Related to our Company and an Investment in our Shares—We may face a breach of our cyber security, which could result in exposure of confidential information and adverse consequences to our operations."


text: To our knowledge, cybersecurity threat risks have not materially affected our company, including our business strategy, results of operations or financial condition.


text: Cybersecurity Governance The AGM Board of Directors' oversight of Apollo's cybersecurity risk management is supported by the audit committee of the AGM Board of Directors (the " AGM audit committee "), the AAM Global Risk Committee (" AGRC "), the Operational Risk Forum (the " ORF "), the Cybersecurity Working Group and management. The AGM Board of Directors, the AGM audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from Apollo's risk management professionals, AGM's Chief Security Officer (" CSO "), its CISO, and other members of Apollo's management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from Apollo's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM's board of directors and/or the AGM audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM Board of Directors or the AGM audit committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from Athene's CISO, at least annually.


text: The AGM CISO, in coordination with the Apollo Technology and ERM teams, works collaboratively across Apollo to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of Apollo's cybersecurity risk management program, multidisciplinary teams throughout Apollo are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the AGM audit committee or AGM Board of Directors, as appropriate.


text: AGM's CSO holds an undergraduate degree in Management Information Systems and Business Administration, which he received magna cum laude. He has over 25 years of cyber-related experience, having served in various roles in technology and cybersecurity, including as Head of IT Risk Management, Executive Director of IT & Risk Compliance, and Global IT Risk Evaluation Lead at large financial institutions and consulting firms. He was also previously AGM's CISO for nearly eight years. AGM's CISO holds a master's degree in Business Information Systems and has served in various roles in information technology and information security for over 25 years across a number of large financial institutions, including as Director, Cybersecurity and Risk.


text: As part of the risk management oversight (including oversight of cyber risks) of the Company's Board, the Board will regularly interact with, and receive reports from, management of the Company, the Operating Manager, Apollo, and other service providers. The Company's Board is expected to receive presentations and reports on cybersecurity risks from AGM's CSO or CISO, at least annually, addressing a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Apollo's peers and third parties. Additionally, Apollo and other service providers are expected to periodically report to management as it relates to the Company's cybersecurity practices.


text: Apollo's cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to the Company's management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to the Company, the Operating Manager, and evaluation of the adequacy of the Company's cybersecurity program (as coordinated through the Operating Manager and Apollo), including risk mitigation, compliance and controls.


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. However, because we have investments in our Trust Account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Investcorp AI Acquisition Corp.

ticker: IVCAF


text: Strategy and Oversight We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical studies and employees, or our information systems and the data contained therein.

companyName: Eledon Pharmaceuticals, Inc.

ticker: ELDN


text: We retain a Chief Information Consultant to collaborate with the company, including the Chief Financial Officer, and Executive Leadership Team, to help identify, assess and manage the company's cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, and evaluating threats reported to us. We also use a third-party security management vendor to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems, including, for example, incident detection and response policy, route risk assessments, data encryption, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, penetration testing, and cybersecurity insurance. As part of our information security program, we provide mandatory periodic training for all employees on how to identify potential cybersecurity risks and protect our resources and information. This training is supplemented by firmwide testing initiatives, including periodic phishing tests.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the Chief Information Consultant works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. In addition, our Chief Financial Officer evaluates material risks from cybersecurity threats and, as appropriate, reports to the Audit Committee of the Board of Directors, which evaluates our overall enterprise risk.


text: To date, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that we are aware of, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all such cybersecurity incidents or threats. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor titled " We depend on our information systems and those of our third-party collaborators, service providers, contractors or consultants, which may fail or suffer cybersecurity incidents that could result in a material disruption of our development programs or loss of data and have a material adverse effect on our reputation, business, financial condition or results of operations."


text: Our Board addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by our Chief Financial Officer who oversees the work performed by our Chief Information Consultant.


text: Our Chief Financial Officer is responsible for hiring appropriate consultants, helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our Chief Financial Officer, with support from our Chief Information Consultant, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: The Audit Committee receives periodic reports from our Chief Financial Officer concerning our significant cybersecurity threats and risks and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation. The Chief Financial Officer also promptly informs and updates the Board about any information security incidents that may pose significant risk to our Company.


text: The Chief Financial Officer has over 20 years of operations and leadership experience, including experience in information technology strategy and execution. The Chief Information Consultant has over 20 years of experience managing and securing technology infrastructure.


text: Cybersecurity Risk Management and Strategy The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and to protect the confidentiality, integrity, and availability of our and our client's data and information assets. As such, we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Intapp, Inc.

ticker: INTA


text: We design our program based on industry standard cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Also, our cloud services comply with numerous internationally recognized standards, such as ISO 27001, ISO 27017, ISO 27108, SOC 2 and CSA STAR.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity incident response plan is also designed to integrate with or complement other enterprise plans, such as our business continuity plan and crisis management plan.


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • A security team principally responsible for managing (1) our cybersecurity governance and risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response personnel, and senior management, including through the use of third-party providers for regular mandatory trainings; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A third-party risk management process for service providers, suppliers, and vendors.


text: When we experience cybersecurity incidents, we promptly activate incident response protocols and commence investigation of the incident. We may notify law enforcement and engage third-party professionals, as appropriate, as part of our incident response and/or investigation. Based on our assessments, during the last fiscal year, we have not identified any cybersecurity threat that has had a material impact on, or that we expect will have a material impact on our operations, business strategy, results of operations, or financial condition. However, we face ongoing cybersecurity risks, including threats that might become more sophisticated and effective over time. If realized, these risks are reasonably likely to materially affect us. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors."


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of our enterprise risks, including cybersecurity and other information security risks. The Committee oversees management's implementation of our cybersecurity risk management program. Also, we created a Risk Management Working Group which meets no less than quarterly and which receives updates on our cybersecurity risk management program and cybersecurity risks from the Chief Information Security Officer ("CISO"). The Risk Management Working Group includes two Audit Committee members, certain members of senior management and the CISO.


text: The Committee receives quarterly reports on our cybersecurity risks from the Risk Management Working Group. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports quarterly to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings on our cyber risk management program.


text: Our Cybersecurity Compliance and Disclosure Committee ("CCDC"), which is further described below, is chaired by our CIO and includes the General Counsel and the CPO of A-Mark and other representatives from the Company and our subsidiaries, including top-level management, to ensure enterprise-wide implementation and consistent application of the Company's data security, privacy, and artificial intelligence policies and procedures. The CCDC regularly enlists internal and external subject matter experts to assist where necessary.

companyName: Gold.com, Inc.

ticker: GOLD


text: Our team of experienced cybersecurity professionals has primary responsibility for our overall cybersecurity risk management program, including assessing and managing material risks from cybersecurity threats. Our CISO, Mark Schertler, supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Mr. Schertler has over 40 years of experience in the field of cybersecurity. Mr. Schertler leads a team of experienced cybersecurity professionals who have extensive experience in the field of cybersecurity, including experience in cybersecurity consulting, cloud security, security architecture, application security and serving as a chief technology officer.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy We recognize the importance of cybersecurity in safeguarding sensitive information, maintaining operational integrity, and working to ensure the safety and efficacy of our products. We evaluate and monitor cybersecurity risk as part of our overall enterprise risk management program, which considers cybersecurity risks alongside other company risks as part of our overall risk assessment process. In addition, the risk oversight responsibility of our Board of Directors and its committees is supported by our cybersecurity risk assessment program, which includes policies and processes that are designed to provide visibility and information about the identification, assessment, and management of critical risks and management's risk mitigation strategies to our Board of Directors and personnel that are responsible for risk assessment. These policies also govern the security of our products and the protection of customer and patient data and provide for vulnerability remediation, regular system updates and patches, employee training on cybersecurity and HIPAA best practices, incident reporting, and the use of encryption to secure sensitive information. To identify, assess, and manage material cybersecurity risks, our team uses a cybersecurity risk assessment process aligned with leading frameworks such as the National Institute of Standards and Technology's Cyber Security Framework and HIPAA. Our cybersecurity risk assessment program provides the underlying basis for the activities of our team to identify and mitigate risks from, as well as develop risk management and response strategies for, evolving and emerging cybersecurity threats.

companyName: ACCURAY INC

ticker: ARAY


text: Our cybersecurity program includes a variety of processes to assess, identify and manage risks from cybersecurity threats arising from our own and third-party provided systems, including annual training requirements, simulation exercises, threat monitoring and detection tools (including those using artificial intelligence and machine learning), threat containment methods, risk assessments, third-party penetration testing and security requirements for our suppliers and other third parties. We have established processes providing for review of identified cybersecurity incidents by a cross-functional cybersecurity incident response team who monitors and manages the detection, assessment, mitigation and remediation of cybersecurity incidents and escalates incidents to the Chief Information and Security Officer and to our disclosure review board, which evaluates such incidents for materiality and potential disclosure, and works to ensure that members of management responsible for overseeing the operation of our disclosure controls and procedures are informed of such cybersecurity risks and incidents. Our cybersecurity incident response team and disclosure review board are comprised of subject matter experts, including employees in cybersecurity, information technology and other areas, to evaluate potential security, financial, operational, reputational and other risks, and to address our process. We also engage third parties to enhance and strengthen our cybersecurity program, to provide additional capabilities and support and to provide periodic independent assessments and evaluations of our cybersecurity program. Third parties also provide managed services for security operations, incident response, and security remediation services.


text: We monitor and periodically enhance our cybersecurity program, processes, techniques and procedures to combat evolving and adaptive cybersecurity threats. To this end, we engage in the periodic assessment of our policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents, internally and through assessments by external providers. The results of such assessments, audits, and reviews are reported to the Audit Committee and the Board of Directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: We also monitor and test our safeguards and train all our employees on cybersecurity safeguards related to our information technology systems. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic cybersecurity trainings and tests. Further, we are focused on building and maintaining a positive cybersecurity culture through a combination of trainings, educational tools, videos, and other cybersecurity awareness initiatives. Our security training incorporates awareness of cyber threats (including malware, ransomware, and social engineering attacks), password hygiene, the importance of multifactor authentication and our incident reporting process. In addition to the assessment of internal cybersecurity risks, we have implemented processes to oversee, identify and monitor material risks from cybersecurity threats relating to potential compromises of sensitive information at our third-party business partners where relevant and we reevaluate these risks periodically. These processes include vetting of certain service providers for security, reliability, and availability; execution of a Business Associate Agreement with relevant providers for compliant management, storage, or processing of PHI if necessary; and confirmation by each service provider that its SOC-2 reports, or equivalent reports, are current and available, where applicable. In the event a service provider does not have a current and available SOC-2 or equivalent report, we review the service provider's cybersecurity risk management and advise relevant business stakeholders of any significant identified risks.


text: While we regularly experience cybersecurity incidents, and we expect to continue to be subject to such incidents, as of the date of this report, we are not aware of any cybersecurity incidents that have had or are reasonably likely to have a material impact on our business or operations. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations, or financial condition, as further described in Item 1A. Risk Factors in the risk factor entitled "Disruption of critical information technology systems, infrastructure and data or cyberattacks or other security breaches or incidents could harm our business and financial condition."


text: Our Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee, oversees the functioning of our cybersecurity risk management program and ensures strategic alignment and governance of our cybersecurity efforts at the highest level. Our Board of Directors receives periodic briefings on the outcome of our cybersecurity risk management program, including steps that we are taking to mitigate risks that the program identifies, and each quarter, the Audit Committee reviews cybersecurity incidents, metrics, and the state of the program.


text: Our cybersecurity risk management program is principally managed by our Global Information Systems team, which is led by our Chief Information and Security Officer, who reports directly to our Chief Executive Officer, as well as our Deputy Chief Information Security Officer (Deputy CISO). Our Chief Information and Security Officer and Deputy CISO combined have more than 40 years of experience in cybersecurity and/or information technology risk management, have relevant certification, and are active in a variety of cybersecurity related boards and organizations. Our Chief Information and Security Officer also serves as the officer who reports directly to senior management and makes regular reports to the Audit Committee and Board of Directors as described in this Item 1C. Under the direction of our Chief Information and Security Officer and Deputy CISO, we monitor developments that could affect our long-term organizational cybersecurity strategy based on threats globally and work to enhance our cybersecurity program as needed in response to such developments.


text: Cybersecurity Processes and Risk Assessment We rely on the cybersecurity program implemented by GECM. In order to assess, identify and manage material risks from cybersecurity threats, GECM has implemented a cybersecurity program for GEG and its subsidiaries, which is focused on (i) protecting the confidentiality of business, client, fund investor and employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: Great Elm Group, Inc.

ticker: GEG


text: GECM has implemented an information security policy governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and employee information that it stores or processes and the maintenance of critical services and systems. This program is based on recognized industry standards that we use to help us identify, assess and manage cybersecurity risks and is supported by both management and our Board. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks. GECM's policies and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, spam and phishing email filtering, and transmission of data over private networks. GECM's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: (1) cybersecurity risks associated with its physical and digital devices and infrastructure, and (2) cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information.


text: As a part of its cybersecurity program, GECM's cybersecurity processes and systems are reviewed and assessed by third parties. These third parties provide external expertise in all aspects of our cybersecurity program and assess and report on GECM's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks. These third parties also help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third-party consultants and vulnerabilities are reviewed by Great Elm's Information Technology & Security Committee (IT Committee), comprised of GECM's Chief Operating Officer and other members of Company management as well as its third-party IT consultant. In order to oversee and identify risks from cybersecurity threats associated with its use of large vendors and material third parties who will have access to sensitive data or client systems and facilities, GECM requires these parties to adhere to GECM's cybersecurity requirements prior to accessing such data. In addition, GECM performs periodic reviews of its critical vendors with the assistance of a third-party consultant to identify and assess the vendors' security posture to reduce risk to the Company.


text: In May 2024, the SEC adopted amendments to Regulation S-P, which, beginning in December 2025, requiring investment companies and SEC-registered investment advisers to adopt written policies and procedures for incident response programs to address unauthorized access to, or use of, customer information, including providing notice to certain individuals affected by any such incident. GECM will need to comply with this amended rule beginning December 2025. With the SEC particularly focused on cybersecurity, we expect increased scrutiny of our policies and systems designed to manage cybersecurity risks and related disclosures.


text: Governance and Oversight of Cybersecurity Risks GECM's cybersecurity program is managed by the IT Committee. The members of the IT Committee collectively have over fifty years of experience helping to oversee the information technology infrastructure and processes at GECM and other asset managers in both operations and IT infrastructure leadership roles. Third-party consultants with specific education and over 25 years' experience in IT Infrastructure and Cybersecurity are utilized to provide additional technical insight and recommendations. The IT Committee is responsible for supervising and interfacing with providers to implement GECM's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards.


text: GECM has also developed an incident response framework to monitor the prevention, detection, mitigation and remediation of cybersecurity events. This framework is managed and implemented by the IT Committee, with support from their third-party consultants. The IT Committee alongside the General Counsel and Chief Compliance Officer of GECM are responsible for gathering information with respect to cybersecurity incidents, assessing their severity and determining potential responses, as well as communicating with business leaders and senior management, and the Board of Directors, as appropriate.


text: Our Board monitors cybersecurity risk as part of Great Elm's overall risk management program. Our Board has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee, which includes oversight of risks related to cybersecurity threats. The Audit Committee and the Board, as appropriate, are informed about risks related to cybersecurity threats through periodic reports from GECM's Chief Operating Officer. Such reporting includes updates on GECM's cybersecurity program, the external threat environment, and GECM's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on GECM's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents, where applicable.


text: Impact of Cybersecurity Risks As of the filing of this Form 10-K, we are not aware of any cyber-attacks that have occurred that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We acknowledge that we cannot eliminate all security risks within our organization, and we cannot guarantee that any undetected cybersecurity incidents have occurred. For additional information about these risks, see "Item 1A. Risk Factors" in this Annual Report on Form 10-K.


text: Cybersecurity Risk Management and Strategy We recognize the importance of information security practices designed to protect the confidentiality, integrity, and availability of company information and the personal information that we process. Cybersecurity risk management is an integral part of our overall enterprise risk management efforts. We manage cybersecurity risks using a framework based on applicable regulations, industry standards, and recognized best practices. Through this framework, we devote significant resources to identifying, monitoring, assessing, and responding to cybersecurity threats and incidents, including those associated with our use of third-party software, applications, services, and cloud infrastructure.


text: Our Cybersecurity Program includes multiple policies, procedures, and other components designed to identify, analyze, and respond to cybersecurity risks, including reliance on a layered system of preventative and detective technologies and controls designed to detect, mitigate, and contain cybersecurity threats. As part of our Cybersecurity Program, we maintain a Written Information Security Plan that outlines internal controls and procedures designed to protect our information systems. Our Cybersecurity Program contains a comprehensive suite of cybersecurity policies that are commensurate with companies in our industry of similar size and sophistication, and these policies are also informed by the sensitivity of our data processing activities. Our Cybersecurity Program also includes policies and procedures designed to ensure adequate business continuity, disaster recovery, and incident response. We also have access through our insurer to computer forensics firms and specialized legal counsel in case of a cybersecurity incident. While we maintain cybersecurity insurance to assist in the cost of recovery from a cybersecurity incident, such coverage may not be sufficient to cover all costs resulting from such incidents.


text: We leverage qualified third-party consultants, advisors, counsel, and other experts to inform, audit, and update our Cybersecurity Program throughout each year. We engage security assessors to identify vulnerabilities through both internal and external penetration tests and to perform cybersecurity maturity assessments. We perform risk assessments annually, or more frequently if circumstances require, using both internal and external resources. We may also be subject to examinations or disclosures by applicable regulators. We conduct annual cybersecurity training for employees to enhance awareness of how to detect and respond to cybersecurity threats, as well as periodic phishing training and testing campaigns. We also conduct periodic table-top exercises to simulate a response to a cybersecurity incident.


text: Our designated IT team members monitor cybersecurity threats in real time for the Company at the enterprise level, with the assistance of third-party threat detection and monitoring software. Cybersecurity threats at the subsidiary level are also monitored in real time by experienced IT professionals at those subsidiaries, including our IT leadership at JM Bullion, AMS, Pinehurst, LPM, and SGI. These individuals report cybersecurity incidents immediately to our Chief Information Officer ("CIO") and Chief Privacy Officer ("CPO"), who in turn follow approved incident response and reporting protocols, as more fully described below.


text: We also maintain a formal Vendor Management Program that provides oversight of cybersecurity risks related to our vendor and supplier relationships. During vendor onboarding, we perform risk-based due diligence on these third-parties, with heightened requirements for vendors that have access to confidential enterprise information, personal data, or that require access to our information systems. This Vendor Management Program includes specific cybersecurity requirements for our vendors, as well as ongoing monitoring, assessment, and contract review. Members of the CCDC are involved in and review the Vendor Management Program annually.


text: We also maintain a formal Generative Artificial Intelligence ("GAI") Policy and Program that provides oversight of cybersecurity, privacy, and contractual risks related to enterprise use of GAI. All GAI tools and use cases must be submitted for review and approval by a subcommittee of CCDC members based on specific cybersecurity, privacy, and contractual requirements.


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against all cybersecurity threats and incidents. For more information on the risks that we face from cybersecurity threats, see "Risk Factors – Risk Factors of General Applicability—Legislatures and regulators continue to scrutinize cybersecurity management and incident reporting." in Part 1, Item 1A of this report.


text: Cybersecurity Governance The Board has overall responsibility for risk oversight and has delegated oversight of our Cybersecurity Program, including enterprise-wide risk assessment and management, to the CCDC. The CCDC's charter requires it to monitor Company efforts to prevent, detect, mitigate, and remediate cybersecurity incidents, and to comply with cybersecurity laws and regulations. The CCDC oversees and approves all Company policies and procedures related to cybersecurity. The CCDC also ensures that significant cybersecurity issues or concerns are reported to the Board and A-Mark's CEO, and disclosed to the public, individuals, or regulators where required by law.


text: The CCDC directly oversees information technology and information security risks through regular meetings, reports from management on information technology, cybersecurity, and related risk assessments, and incidents disclosed by third-party service providers as applicable. If a cybersecurity threat is identified, our Vice President of IT or other reporting individuals will immediately inform our IT service desk and notify our CIO and CPO. Once the threat has been analyzed, our CIO and CPO will inform our General Counsel of any security incidents. The General Counsel or her delegate will report on the incident, as appropriate, to the CCDC, our CEO, President, CFO, and to the Board, either at the next scheduled meeting or on a current basis, depending on the severity of the incident. Each quarter, the enterprise CPO presents legal and regulatory updates concerning cybersecurity, security incident response and notification, privacy, and artificial intelligence. A-Mark's CPO is certified by the International Association of Privacy Professionals as an EU, US, and management privacy professional, as well as an artificial intelligence governance professional. Our CPO has over a decade of privacy, data protection, and information management experience.


text: The CCDC reports at least quarterly to the Board and A-Mark's CEO on the following topics, among possible others: our current risk posture and threat landscape; new material cybersecurity threats and high-risk exposures; risk mitigations and controls; incident response readiness; and updates to cybersecurity policies and procedures. The CCDC is also authorized and directed to report to the Board and A-Mark's CEO promptly in the event of a significant cybersecurity incident, as appropriate.


text: A-Mark's CIO chairs the CCDC. Our CIO brings over 15 years of IT experience to A-Mark. Since joining A-Mark in 2019, he has been pivotal in enhancing our data privacy compliance program, significantly strengthening our data protection and privacy measures, particularly ensuring protection of sensitive data. The co-vice chairs of the CCDC are A-Mark's Vice President of IT and JM Bullion's Vice President of Digital and Technology. Our Vice President of IT has over 25 years of experience in IT working in various industries including ecommerce, health care, and financial industries focusing on IT operations, cybersecurity and compliance. Since joining the company in 2014, he has been instrumental in the creation and growth of our cybersecurity program. Our Vice President of Digital and Technology at JM Bullion has comprehensive experience in the cybersecurity field. He successfully established a 24/7 security operation center (SOC) to continuously detect and respond to security incidents, as well as implemented various advanced services to proactively detect vulnerabilities on potential attack surfaces with high accuracy spanning across assets, applications, data, endpoints and network. He also centralized the workforce identity and access management (IAM) of the various systems for improved administration and control at the subsidiary level. He joined JM Bullion in 2015 and has served in his current role as Vice President of Digital and Technology since 2021.


text: Other members of the CCDC include top executives and management from the Company and its subsidiaries, including A-Mark's General Counsel and Assistant General Counsel, CPO, President, Chief Financial Officer, Chief Operating Officer, Senior Director of Financial Reporting, Senior Director of Internal Audit, and Director of Enterprise Development and Administration, as well as JM Bullion's President and Chief Executive Officer and its Chief Financial Officer. Finally, the CCDC is assisted by an external compliance consultant with over twenty years of IT experience, and A-Mark's outside legal counsel for privacy and data security.


text: Cybersecurity Risk Management and Strategy Our enterprise risk management framework considers cybersecurity risk alongside other applicable risks as part of our overall risk assessment process. Within our comprehensive enterprise risk management framework, our cybersecurity risk management program is focused on assessing, identifying, and managing risks arising out of our use of information technology ("IT") including the risk of cybersecurity incidents and threats. The program is informed by recognized frameworks such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). Our cybersecurity team utilizes a variety of tools, processes and outside resources to continue to raise and maintain its maturity across the elements of NIST CSF.

companyName: HAIN CELESTIAL GROUP INC

ticker: HAIN


text: Our cybersecurity risk management program includes a Cyber Security Incident Response Plan ("CSIRP"). Our CSIRP supports the Company in identifying, containing, and tracking cybersecurity incidents experienced by us or our third-party service providers or suppliers. The CSIRP was established to minimize the impact of cybersecurity incidents on our networks, IT systems, users and business processes, and to ensure the timely and accurate reporting of material cybersecurity incidents, should they occur. The execution of our CSIRP is led by our Chief Information Officer and Head of Business Services ("CIO"), with support from a designated IT Incident Response Manager leading an Incident Response Team consisting of subject matter experts, as well as our Executive Response Team when appropriate. In the event of an incident, these individuals work together to assess its severity, notify and brief the appropriate team members, escalate to our Board of Directors as needed, and implement containment procedures. The Company also conducts tabletop exercises to enhance incident response preparedness and engage s third parties, including consultants and other professionals, on an as-needed basis to assess and support our cybersecurity practices and procedures.


text: Our cybersecurity risk management program is integrated into our operations and is widely communicated to employees through periodic (not less than annual) employee and contractor cybersecurity awareness training, which includes information about how to identify and report cybersecurity concerns and incidents. Our information technology organization also conducts phishing simulations and testing scenarios to help ensure compliance with our cybersecurity policies and procedures. These awareness measures are coupled with ongoing implementation of technology aimed to reduce vulnerabilities (including external testing and validation) and to monitor and assess threats. Our program includes monitoring on a continuous basis through automated tools and 24x7 managed services that detect threats and trigger alerts for assessment, investigation, and remediation by our information technology organization.


text: We maintain business continuity and disaster recovery plans to prepare for potential information technology disruptions. We also maintain insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cyber incidents and information systems failures. Based on the information we have as of the date of this Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See "Item 1A. Risk Factors – Risks Related to Cybersecurity and Technology" for further information about these risks.


text: Cybersecurity Governance Our Board of Directors has risk oversight responsibility for the Company, which it administers directly and with assistance from its committees. The Audit Committee assists the Board in its oversight of the cybersecurity risk management program. The Audit Committee is tasked with reviewing and receiving periodic reports from management regarding the Company's information technology system controls and security and, at least annually, evaluating the adequacy of the Company's information technology security program, compliance, governance processes, training and controls. The Audit Committee specifically oversees: • management's evaluation of the potential impact of cybersecurity risk exposures on the Company's business, financial results, operations and reputation, • the steps management has taken to monitor and mitigate such exposures, • major legislative and regulatory developments that could materially impact such exposure, and • the Company's incident response planning (including escalation protocols), including with respect to the prompt reporting of material cybersecurity threats or incidents to management, the Audit Committee and the Board of Directors.


text: Our CIO periodically provides the Executive Leadership Team, which consists of the Company's executive officers and other senior leaders, with cybersecurity briefings, information and trainings, and updates the Audit Committee on cybersecurity biannually or more frequently as appropriate. At any time, Board members may raise concerns regarding the Company's cybersecurity posture and recommend changes regarding controls or procedures to management. Our CSIRP includes a process for incidents to be evaluated for material impact, with an escalation protocol requiring reporting of material incidents to the Executive Response Team and to the Board of Directors.


text: The CIO is the management position with primary responsibility for the development, operation, and maintenance of our cybersecurity risk management program. The CIO has deep experience in information systems and technology, including developing information and cybersecurity programs, roll-outs of new technology, information security audit and assessments, and cybersecurity operations focused on identification, mitigation and response to cybersecurity threats. The CIO has experience overseeing and executing technology strategies in complex, global, and matrixed environments. The CIO joined the Company in 2020, bringing over 15 years of experience leading IT strategy and change initiatives in the consumer packaged goods industry, and reports directly to our interim CEO.


text: Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as information about our employees, contractors, vendors, suppliers, partners and customers. We understand the increasing reliance of our customers, suppliers, and partners on our digital platforms. Our goal is to strengthen our digital infrastructure, ensuring the highest levels of customer service while effectively managing risks and adhering to global compliance standards. We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats, and we continually monitor our overall security to assess performance and identify areas for improvement.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: Risk Management and Strategy Our processes for assessing, identifying, and managing cybersecurity threats have been integrated into our overall risk management processes. Our cybersecurity and risk management program is structured around strategy, execution, management, oversight, and user training, with ongoing evaluations to ensure its effectiveness.


text: Identifying and assessing cybersecurity risks and threats are integral components of our broader enterprise risk management strategy. Our information technology leadership, with input from senior management, is responsible for defining our cybersecurity strategy, setting priorities, and driving the execution of our cybersecurity initiatives. We maintain a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of our information systems, including the information residing on our systems. We utilize the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") to guide our efforts, aligning with industry standards.


text: We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers. Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk. Our cybersecurity and risk management program is developed based on: • Continuous Development: Ongoing refinement of our risk management processes. • Partners and Tools: Leveraging global access control and activity monitoring solutions. • Education and Training: Implementing company-wide policies and proactive user training. • Continuous Monitoring: Regular surveillance of our environment. • Access Management: Ensuring only authorized users have access to our Zero Trust approach network implementation.


text: 24x7 Endpoint Monitoring by NOSC As part of our commitment to safeguarding our network, we operate a Network Operations and Security Center ("NOSC") that provides 24x7 monitoring of all endpoints across our network. This continuous surveillance allows us to detect and respond to potential threats in real time, helping our systems remain secure and operational. The NOSC is a critical component of our cybersecurity infrastructure, enabling proactive risk management and the ongoing protection of our digital assets.


text: Use of Consultants and Advisors In addition to our in-house capabilities, we engage various third-party cybersecurity service providers to assess and enhance our cybersecurity practices and assist with protection and monitoring of our systems and information. We partner with a third-party provider specializing in endpoint security and monitoring. This partnership enhances our overall security posture by providing advanced incident response capabilities. This collaboration ensures that any potential threats are quickly identified and managed, adding an extra layer of security to our existing infrastructure.


text: The execution and measurement of our cybersecurity program are managed by our Information Technology department. This program is integrated into our broader governance and internal controls framework. We regularly engage with third-party consultants, auditors, and specialists to enhance our program, employing advanced cybersecurity technologies and services to prevent, detect, respond to, and recover from cyber threats and incidents. Additionally, our third-party security partner actively monitors and mitigates risks from external sources as part of our overall cybersecurity strategy.


text: We have processes to evaluate third-party service providers and vendors that have access to sensitive systems and customer data, which may include due diligence procedures such as assessments of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. Following an assessment, we determine and prioritize service provider risk based on potential threat impact and likelihood, and such risk determinations drive the level of due diligence and ongoing compliance monitoring required for each service provider.


text: Role of Management Management has implemented risk management structures, policies and procedures, and is responsible for day-to-day cybersecurity risk management. Our Information Technology department that is led by our Chief Technology Officer ("CTO") is responsible for the day-to-day assessment and management of cybersecurity risks. Our CTO has led IT departments, including cybersecurity teams, for the past 15 years in worldwide leading logistics companies. We have implemented several processes which allow the management team to be informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. These processes include, among other things, system alerts of potential malicious cyber activity, access to real-time dashboards that monitor and assess our systems, status reports provided on a daily, weekly and monthly basis, and regular ongoing communications with service providers regarding potential new attack vectors and vulnerabilities. Our CTO and his team share such information with our management team and reports information about such risks to our Audit and Executive Oversight Committee ("AEOC").


text: The Board of Directors, both directly and through the delegation of responsibilities to the AEOC, has risk management oversight, which includes the proper functioning of our cybersecurity risk management program. In particular, the AEOC assists the Board in its oversight of management's responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our information technology systems, processes and data.


text: The AEOC, which is comprised entirely of independent directors, is responsible for periodically reviewing and assessing with management (i) the adequacy of controls and security for our information technology systems, processes and data, and (ii) our contingency plans in the event of a breakdown or security breach affecting our information technology systems, it being understood that it is not possible to eliminate all such risks and that we will necessarily face a variety of risks with respect to information technology in the conduct of our business. The AEOC is additionally responsible for reviewing the cybersecurity disclosures required to be included in our filings with the SEC.


text: The AEOC regularly discusses with management, including our CTO, our enterprise risk management process, including our cybersecurity exposures, the steps management has taken to monitor and control such exposures and guidelines and policies to govern our risk assessment and risk management processes. The AEOC periodically reports to the Board regarding significant matters identified with respect to the foregoing, including, among others, our risk assessment and risk management approach to cybersecurity.


text: We believe each of the members of the AEOC has relevant work experience related to information security or cybersecurity to allow for the effective oversight of cybersecurity risks. In particular, Richard Palmieri has held numerous roles where he provided oversight of technology functions, Kristin Toth has significant experience managing e-commerce platforms and businesses, and Michael Gould has held senior roles in the technology consulting businesses at Oracle and Hewlett-Packard Company.


text: Risks from Material Cybersecurity Threats Although we have taken steps to prevent and mitigate data security threats, there can be no assurance that our protective measures and those of our third-party service providers will prevent or detect security breaches that could have a significant impact on our business, reputation, operating results and financial condition.


text: We have experienced two separate cyber events. First, in December 2021, we experienced a targeted cyber-attack, leading to a global shutdown of our connectivity, operational, and accounting systems to protect our infrastructure. Although our operations systems were eventually restored, this event caused significant disruption to our operations for approximately two weeks, temporarily impacting our ability to manage freight shipments, customs brokerage functions, and distribution activities. Next, in March 2024, our Canadian subsidiary experienced a targeted cybersecurity breach. This attack was identified by our end point protection software and our third-party monitoring partner. As per our response process, we initiated a shutdown of our Canadian infrastructure and engaged our incident response team. The operations systems were restored and approved to return to service within one week. While we continue to learn from these incidents, we do not anticipate further material adverse impacts from them on our business. Following the attacks, we enhanced our security program with additional tools and strengthened measures for improved system and network monitoring.


text: As of the date of this filing, we have not identified any cybersecurity threats that are reasonably anticipated to have a material effect on our business strategy, results of operations or financial condition. Maintaining a robust information security system is an ongoing priority for us and we plan to continue to identify and evaluate new, emerging risks to data protection and cybersecurity both internally and through our engagement of third-party service providers.


text: Cybersecurity is a significant and integrated component of Winchester Bancorp's risk management strategy, designed to protect the confidentiality, integrity and availability of sensitive information contained within the Company's information services. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to disrupt business operations, compromise sensitive data or both. As a proactive measure, the Company maintains insurance coverage for cybersecurity incidents experienced by the Company, however, such insurance coverage may not be sufficient to cover all losses incurred. During the year ended June 30, 2025, we did not, to our knowledge, experience a cybersecurity incident materially affecting or reasonably likely to materially affect the Company. Risk Management & Strategy (Scope)

companyName: Winchester Bancorp, Inc./MD/

ticker: WSBK