text: Risk Management and Strategy We rely on information technology and data to operate our business and develop, market, and deliver our products and services to our customers. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, hardware, software, and our confidential, personal, proprietary, and sensitive data (collectively, "Information Assets"). Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats. We have implemented an information technology security policy, which includes cybersecurity vulnerability management designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business.


text: We engage in processes designed to identify such threats by, among other things, monitoring the threat environment using manual and automated tools. We subscribe to reports and services that identify cybersecurity threats, analyze reports of threats and conduct vulnerability assessments to identify vulnerabilities.

companyName: OPAL Fuels Inc.

ticker: OPAL

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Assets. We work with third parties, including cybersecurity software providers and managed cybersecurity service providers, to identify and assess cybersecurity risks and conduct penetration testing.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by a third-party service provider reporting to the Company's management. Management is also responsible for integrating cybersecurity considerations into our overall risk management strategy, communicating key priorities to employees, approving budgets, helping to prepare for cybersecurity incidents, approving cybersecurity processes, reviewing security assessments and making required disclosures. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct our response to cybersecurity incidents.

stage1Method: majority


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee of the board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a Security team responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes, and to provide support during incident response efforts; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors based on their criticality and risk profile. • There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Wag! Group Co.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information, see "Risk Factors — Risks Related to Privacy and Technology — Changes in laws, regulations, or industry standards relating to privacy, data protection, or the transfer or processing of data relating to individuals, or any actual or perceived failure by us to comply with such laws and regulations or any other obligations, including contractual obligations, relating to privacy, data protection, or the transfer or processing of data relating to individuals, could adversely affect our business, results of operations and financial condition."

stage1Category: Strategy Integration


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives reports regularly from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any cybersecurity incidents.

stage1Category: Board Governance


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Technology Officer ("CTO"), internal staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our CTO, is responsible for assessing and managing our material risks from cybersecurity threats. Our CTO leads a team that has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our CTO has more than 12 years of experience in cybersecurity, software, and IT in various technology-related businesses, including some oversight over security and integrity of systems and operations. In addition, our CTO leads our Security team, who have more than 16 years of experience in these fields.

stage1Category: Management Role


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources; any retained external cybersecurity consultants; and alerts and reports produced by security tools deployed in the IT environment. Our management team reports information about cybersecurity risks to the Committee.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Risk Management and Strategy We maintain a comprehensive technology and cybersecurity program designed to ensure our systems are effective and prepared for information security risks. This includes regular oversight of our programs for security monitoring for internal and external threats to maintain the confidentiality and integrity of our information assets. We have a formal, risk-based and enterprise-wide risk assessment program, which incorporates the assessment of security risk exposures, including cybersecurity risks.

companyName: INTEGRAL AD SCIENCE HOLDING CORP.


text: Security starts for our system at the edge of the network. We then build security deeper into the system resulting in interlocking layers designed to strengthen each other. Our information security management system is based upon industry leading frameworks, including ISO 27001. ISO 27001 specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a documented Information Security Management System within the context of the organization's overall business risks. It specifies the requirements for the implementation of security controls customized to the needs of individual organizations and addresses confidentiality, access control, vulnerability, business continuity, and risk assessment.


text: In addition, our cybersecurity program includes the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect these information assets. We have implemented security monitoring capabilities designed to alert us to suspicious activity and developed an incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a breach. Our information security team conducts annual information security awareness training for employees involved in our systems and processes that handle customer data and enhanced training for specialized personnel. Additionally, our information security team conducts internal annual audits of our systems.


text: Our program includes annual review and assessment by external, independent third-parties, who evaluate and report on our internal incident response preparedness, adherence to best practices and industry frameworks, compliance with applicable laws and regulations, and help with identifying areas for continued focus and improvement. We perform penetration tests and an independent audit every quarter to ensure our systems are secure. We also carry general liability insurance coverage and coverage for errors and omissions that is expected to provide protection against certain potential losses arising from a cybersecurity incident. However, such insurance may not be sufficient to cover all of our potential losses and may not continue to be available to us on acceptable terms, or at all.


text: Policies and processes are also in place to ensure review and identification of risks from cybersecurity threats associated with third-party service providers and vendors. Cybersecurity reviews are required prior to initiating any engagements with third-party service providers and vendors who receive access to IAS systems and infrastructure. Additionally, recurring annual audits of such critical third-party service providers and vendors are completed by our Information Security team.

stage1Category: Third-Party Risk


text: Certain of our data processing equipment is housed in third-party commercial data centers or on servers owned and operated by cloud-based service providers. We generally enter into service level agreements with these parties that include provisions for the implementation and operation of effective security controls at the third-party organizations. We have experienced, and may in the future experience, whether directly or through our third party providers, cybersecurity incidents. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business strategy, results of operations, and financial condition. For additional information about our cybersecurity risks, please refer to "Risks Related to Intellectual Property and Technology" in Item 1A, "Risk Factors."


text: The Board of Directors oversees the Company's information security program that institutes and maintains controls for the systems, applications, and databases of the Company and of its third-party providers and has delegated primary oversight of cybersecurity risks to the Audit Committee, which monitors the steps our management has taken to monitor and control exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken.


text: Our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) lead our cybersecurity program in collaboration with the Company's business functions. The CIO or CISO present updates to the Audit Committee quarterly and, as necessary, to the full Board. These regular reports include updates on the Company's performance preparing for, preventing, detecting, responding to and recovering from cyber incidents. The CIO also promptly informs and updates the Audit Committee and the Board about any information security incidents that may pose significant risk to the Company. The Company's program is periodically evaluated by external experts, and the results of those reviews are reported to the Audit Committee and the Board as necessary.


text: To more effectively prevent, detect and respond to information security threats, the Company maintains a cybersecurity program, which is supervised by the CIO whose team, including the CISO, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Additionally, the CIO chairs the Information Security Management Committee, which is made up of senior leaders from our Information Security, Compliance, Engineering, Technical Operations, Incident Management, Corporate IT, and Human Resources teams. This committee meets quarterly and drives awareness, ownership and alignment across broad governance and risk stakeholder groups for effective cybersecurity risk management and reporting.


text: Our CIO has over 30 years of experience in technology. He was appointed as our CIO in January 2022, after serving as SVP Enterprise Systems for approximately five years. Prior to that, he was Global Head of Business Systems & IT at LivePerson for approximately six years. Our CIO is certified by Oxford University for Cybersecurity for Business Leaders.


text: Our CISO has over 25 years of technology experience, with over 15 years of Information Security management experience. He was appointed as our CISO in March 2021, after serving as Director Security for approximately 2 years. Prior to that, he worked at GEP Worldwide as a Director of Security and Infrastructure Technology Management for approximately two years. Our CISO is certified for Certified Information Systems Security Professional (CISSP), and Certified Cloud Security Professional (CCSP).


text: Risk Management and Strategy We maintain a comprehensive technology and cybersecurity program designed to ensure our systems are effective and prepared for information security risks. Our program includes regular oversight of our systems for security monitoring for internal and external threats to maintain the confidentiality and integrity of our information assets. We have a formal, risk-based and enterprise-wide risk assessment program, which incorporates the assessment of security risk exposures, including cybersecurity risks.


text: Security starts for our system at the edge of the network. We then build security deeper into the system resulting in interlocking layers designed to strengthen each other. Our information security management system is based on industry-leading frameworks including International Organization Standardization (ISO) 27001, evidenced by our ISO 27001 certification and other audited activities. The ISO 27001 and additional frameworks specify the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a documented Information Security Management System within the context of the organization's overall business risks. It specifies the requirements for the implementation of security controls customized to the needs of individual organizations and addresses confidentiality, access control, vulnerability, business continuity, and risk assessment.


companyName: EverCommerce Inc.

ticker: EVCM


text: Policies and processes are also in place for the review and identification of risks from cybersecurity threats associated with third-party service providers and vendors. Cybersecurity reviews are required prior to initiating any engagements with third-party service providers and vendors who receive access to IAS systems and infrastructure. Additionally, recurring annual audits of such critical third-party service providers and vendors are completed by our Information Security team.


text: Certain of our data processing equipment is housed in third-party commercial data centers or on servers owned and operated by cloud-based service providers. We generally enter into service level agreements with these parties that include provisions for the implementation and operation of effective security controls at the third-party organizations. We have experienced, and may in the future experience, whether directly or through our third party providers, cybersecurity incidents. While risks from cybersecurity threats, including prior incidents, have not had a material impact on us, future incidents could have a material impact on our business strategy, results of operations, and financial condition. For additional information about our cybersecurity risks, please refer to "Risks Related to Intellectual Property and Technology" in Item 1A, "Risk Factors."


text: Board of Directors Oversight The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: Castellum, Inc.

ticker: CTM


text: We regularly assess cybersecurity risks to our systems, applications, and infrastructure; are in the process of building our capabilities to monitor our information systems for potential vulnerabilities; and implement controls pursuant to our cybersecurity policies, processes, and practices. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services.

companyName: NET Power Inc.

ticker: NPWR


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, may be reasonably likely to materially affect our operations and, therefore, our results of operations and/or financial condition.


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, may be reasonably likely to materially affect our operations and, therefore, our results of operations and/or financial condition. For more information about these risks, refer to the risk factor captioned "Despite implementing and maintaining industry standard security measures and controls, the website, systems and data we maintain may be subject to intentional disruption, other security incidents or alleged violations of laws, regulations or other obligations relating to data handling that could result in liability and adversely impact our reputation and future sales." in Part I, Item 1A. "Risk Factors.".


text: Our Board oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The Audit Committee of the Board oversees our risk management program, which focuses on the most significant risks to our business. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity threats. The Audit Committee reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and risks incidents. The Company's Chief Information Officer is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. The current Chief Information Officer and his team have over 40 years of experience in information security and possess the requisite education, skills, experience, and industry certifications expected of individuals assigned to these duties. The Chief Information Officer provides regular updates on our cybersecurity risk profile to the Audit Committee of our Board.


text: We regularly assess cybersecurity risks to our systems, applications, and infrastructure; have established capabilities and corresponding processes to monitor our information systems for potential vulnerabilities and threats; and implement controls pursuant to our cybersecurity policies, processes, and practices. To protect our information systems from cybersecurity threats, we use various security tools and services that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. In addition, we have a dedicated security operations center that performs 24x7 threat monitoring of our systems and environment. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services.


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, have the potential to materially affect our operations and, therefore, our results of operations and/or financial condition. For more information about these risks, refer to the risk factor captioned "Despite implementing and maintaining industry standard security measures and controls, the website, systems, and data we maintain may be subject to intentional disruption, other security incidents or alleged violations of laws, regulations or other obligations relating to data handling that could result in liability and adversely impact our reputation and future sales." in Part I, Item 1A. "Risk Factors.".


text: bMembers of the Cybersecurity team possess a diverse range of expertise, including prior work experience in cybersecurity, and specialized knowledge and skills in cybersecurity.

companyName: IREN Ltd

ticker: IREN


text: Prior to the Business Combination, we were a blank check company with no operations and therefore did not have any operations of our own that faced material cybersecurity threats. We plan to develop processes, including those intended to follow an internal Information Technology ("IT") Security Policy, which seek to assess, identify, and manage material risks from cybersecurity threats to the IT systems and information that we create, use, transmit, receive, and maintain. We also seek to integrate these processes and policies into our overall enterprise risk management system and processes. The processes for assessing, identifying, and managing material risks from cybersecurity threats, including threats associated with our use of third-party service providers, will include our efforts to identify the relevant assets that could be affected, determine possible threat sources and threat events, assess threats based on their potential likelihood and impact, and identify controls that are in place or necessary to manage and/or mitigate such risks. We plan to implement and conduct security assessments of all third-party service providers before engagement and maintain ongoing monitoring to ensure compliance with relevant cybersecurity standards.

companyName: NKGen Biotech, Inc.


text: In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.


text: Cybersecurity Risk Management and Strategy We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats. During the reporting period, we have not experience any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.


text: We will implement a cybersecurity program in the future. The program will be aimed at safeguarding the confidentiality, integrity, and availability of our essential systems and information, and will be designed to detect and mitigate risks from cybersecurity threats to our data and our systems. Central to our future cybersecurity efforts will be a robust incident response plan designed to address potential cyber incidents swiftly and effectively.


text: In designing and evaluating our cybersecurity program, we will adopt the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF 2.0") as a guiding principle. It is important to clarify that our use of the NIST CSF 2.0 is for guidance purposes to frame our risk identification, assessment and management processes and does not equate to compliance with any specific technical standards or requirements.


text: The key components of our future cybersecurity program will include: • conducting risk assessments to pinpoint material cybersecurity threats to our critical systems, data, products, services, and overall IT infrastructure; • a third-party security expert consultant overseeing the risk assessment process, maintenance of security controls, and coordination of responses to cybersecurity incidents; • engagement with external service providers to evaluate, enhance, or support our security measures; and • an incident response plan outlining specific procedures for managing cybersecurity incidents;


text: Cybersecurity Governance The governance of cybersecurity risks is a critical function of our Board of Directors which has a key role in the oversight of cybersecurity and related technology risks. The Board of Directors is tasked with monitoring the effectiveness of our cybersecurity risk management program as implemented by management.


text: The Board of Directors will receive regular updates from management on the state of cybersecurity risks facing the Company. This includes briefings on any significant cyber incidents and ongoing risk management efforts.


text: The responsibility for day-to-day management of cybersecurity risks lies with our management team, including the Interim Chief Financial Officer and Chief Executive Officer. This team will be at the forefront of our cybersecurity initiatives, coordinating both internal and external resources to anticipate, identify, and mitigate cyber threats. Our approach will include regular updates from our third-party security expert consultant, leveraging intelligence from various sources, and utilizing advanced security tools to protect our digital environment.


text: Risk Management and Strategy Our cybersecurity policies, standards, processes and practices are based on applicable laws and regulations and informed by industry standards and industry-recognized practices. Our strategy to assess, identify, and manage material cybersecurity risks is through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of our information systems and data. We implement security measures and processes to identify, prevent, and mitigate cybersecurity threats and to effectively respond to cybersecurity incidents when they occur. Our cyber risk management includes: (1) enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and risks related to compute infrastructure; (3) vendor risk management to identify risks related to third parties and business partners, which includes pre-engagement review, use of contractual security provisions, and continued monitoring, as applicable; (4) privacy risk management to identify privacy risks in our product and platforms and ensure regulatory compliance; (5) security monitoring to analyze and assess threat activity in real time; and (6) security incident response to investigate, respond to, and mitigate cyber threats. We regularly engage third parties to identify risks in our underlying software and infrastructure, to provide threat intelligence, and to assist in triaging, identifying, and responding to cyber threats.

companyName: Nextdoor Holdings, Inc.

ticker: NXDR


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section entitled "Risk Factors — Security breaches, including improper access to or disclosure of our data or our neighbors' data, or other hacking and phishing attacks on our or third-party systems, could harm our reputation and adversely affect our business."


text: Our Board of Directors maintains oversight of risks from cybersecurity threats by meeting with and receiving periodic updates from our Chief Information Security Officer ("CISO"), via our Audit & Risk Committee, which is assigned oversight of cybersecurity risks. Our Audit & Risk Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.


text: Our CISO, has over 20 years of experience in the technology and cybersecurity, including senior leadership roles in software security, penetration testing, and incident response. Our CISO attained and maintains multiple security certifications including CISSP (Certified Information Security Professional). Prior to Nextdoor, our CISO led Software Security at the Federal Reserve's National Incident Response Team.


text: Risk Management and Strategy We employ a comprehensive, cross-functional approach to assess, identify, and manage material cybersecurity risks, ensuring the confidentiality, security, and availability of our information systems and data. Our cybersecurity strategy is guided by applicable laws and regulations, industry standards, and best practices. We have established robust policies, standards, and processes to proactively safeguard our digital assets, mitigate risks, and respond effectively to cybersecurity incidents.


text: Our cyber risk management framework includes: (1) enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and infrastructure risks; (3) vendor risk management to identify risks related to third parties and business partners, which includes pre-engagement due diligence, use of contractual security provisions, and continued monitoring through risk-based periodic audits, as applicable; (4) privacy risk management to ensure regulatory compliance and proactively manage privacy risks across our products and platforms; (5) security monitoring to analyze and assess threat activity in real time; and (6) security incident response protocols to investigate, contain, and mitigate cybersecurity threats. To strengthen our defenses, we regularly engage third party experts to assess vulnerabilities, provide threat intelligence, and assist in triaging and responding to cyber incidents. We also conduct employee training on cybersecurity awareness, data protection, and threat response to reinforce our security culture.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section entitled "Risk Factors — Security breaches, including improper access to or disclosure of our data or our neighbors' data, or other hacking and phishing attacks on our or third-party systems, could harm our reputation and adversely affect our business."


text: Our Board of Directors, as a whole and at a committee level, maintains oversight of cybersecurity risk management, with primary responsibility assigned to our Audit & Risk Committee. Comprising solely independent directors, our Audit & Risk Committee receives regular updates from our Chief Information Security Officer ("CISO") and is responsible for ensuring that management has processes in place to identify, assess, and mitigate cybersecurity risks. The Audit & Risk Committee collaborates with management to oversee the implementation of security measures, incident response plans, and ongoing risk management strategies.


text: Our CISO, who reports directly to the Chief Technology Officer, has over 15 years of experience in technology and cybersecurity matters, with expertise spanning IT leadership, incident response, enterprise security, and business technology. Our CISO holds multiple cloud and IT certifications and is an active thought leader in the cybersecurity space. Prior to joining Nextdoor, our CISO led Business Technology, IT and Cybersecurity at Workato, Inc. and held key roles at Peloton Interactive, Inc. and KPMG LLP, where they built and implemented business continuity and cyber resilience programs.


text: Cybersecurity Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal information of employees and others ("Information Systems and Data"). We design and assess our program based on the International Standards Organization's (ISO) International standard "ISO 27001: Information security management systems", and "ISO 27002: Code of practice for information security controls". This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the ISO standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business."

companyName: OmniAb, Inc.

ticker: OABIW


text: Our information technology department with the assistance of third-party service providers help identify, assess and manage the Company's cybersecurity threats and risks. Our information technology department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: manual and automated cybersecurity tools such as malware scans, penetration testing, vulnerability testing such as phishing simulations and analysis of reported threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: employee training, access controls, data encryption, systems monitoring, regular patching of operating systems and software, a password policy, a written IT security incident response plan, and cybersecurity insurance coverage.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the information technology department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and reports to the Audit Committee of the Board of Directors, which evaluates cybersecurity and information technology risk as well as other aspects of our overall enterprise risk.


text: We have not identified cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."


text: Cybersecurity Governance Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board of Directors' Audit Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of Data Sciences and IT, who has prior work experience in information technology, and our Director of IT, who has experience in network security and systems administration. The Vice President of Data Sciences and IT and Director of IT have a combined 25 years of risk management experience. Our Vice President of Data Sciences and IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.


text: Our IT security incident response plan is designed to escalate certain cybersecurity incidents to our IT Security Council depending on the circumstances. Our IT Security Council is made up of our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer and Secretary, Vice President of Data Sciences and IT, and Director of IT. Based on the severity and materiality of the incident, the Company's IT security incident response plan also includes reporting to the Audit Committee of the Board of Directors for cybersecurity incidents. In addition, the Audit Committee receives regular reports from management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.


text: We rely on our vendor network to enable the performance of core research and development activities, including clinical trials. As part of our cybersecurity risk management program, we therefore maintain processes to, prior to onboarding and periodically thereafter, assess and review vendor standards around cybersecurity, incident management, and personal data processing, as applicable. Additionally, as appropriate, we include security requirements in vendor contracts.

companyName: Centessa Pharmaceuticals plc

ticker: CNTA


text: We have not identified cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of Data Sciences and IT, who has prior work experience in information technology, and our Director of IT, who has experience in network security and systems administration, who are primarily responsible for assessing and managing our material risks from cybersecurity threats. The Vice President of Data Sciences and IT and Director of IT, who report to our Chief Financial Officer, have a combined 25 years of risk management experience. Our Vice President of Data Sciences and IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, we have, from time to time, experienced threats to and security incidents related to our data and systems, including phishing attacks. For more information on our cybersecurity-related risks, see "Our internal computer systems have suffered, and our collaborators or other contractors or consultants may suffer from security breaches, which could result in a material disruption of our product development programs," in Item 1A "Risk Factors."


text: a Management regularly informs and updates the Board and the Audit and Risk Committee on cybersecurity risks, incidents, and the effectiveness of risk management strategies.


text: Cybersecurity Risk Management We recognize the importance of developing, implementing, and maintaining cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity, privacy, and availability of our data. We have implemented and integrated into our broader risk management framework a cybersecurity risk management program designed to promote a company-wide culture of cybersecurity risk awareness and management. Our cybersecurity risk management program includes a number of components, including periodic system audits and ongoing monitoring of critical risks from cybersecurity threats supported by third-party providers and technologies as well as automated tools. This process is designed to evaluate, assess, identify, and manage cyber risks in alignment with our business objectives and operational needs. In support of those efforts, we leverage a managed service provider ("MSP") and also engage with other third-party providers, consultants, and auditors to support our cyber risk management program, including periodic engagement of third parties to conduct security assessments and testing related to our computer systems. We have a process to implement mitigation plans to monitor and address identified cyber risks. Additionally, we have implemented an employee education program that is designed to raise awareness of cybersecurity threats, including risks posed by phishing attempts. We have implemented a process for this training to be included during the employee onboarding process and periodically thereafter.


text: The Board of Directors has responsibility for oversight of cybersecurity risk management. As part of our enterprise risk management program, the Board has established oversight mechanisms that seek to implement effective governance in managing risks associated with cybersecurity threats.


text: Day-to-day responsibility for assessing, monitoring, and managing our cybersecurity risk management program rests with our IT Department, who consults with our MSP as well as members of our finance and legal teams as appropriate, and our Head of Compliance on cyber matters. Our Head of Compliance oversees our risk management governance and periodic compliance testing and works with our IT Department and other functions, as appropriate, on the mitigation and management of identified cyber risks. The IT Department, together with our MSP executes the cybersecurity strategy. The IT Department and Head of Compliance report periodically to the General Counsel as well as to our Governance, Risk Management, and Compliance Committee ("GRC Committee") on cyber matters. Our GRC Committee is responsible for monitoring and overseeing our overall enterprise risk management process, including assessing, identifying, and managing cybersecurity related risks as part of its annual assessment of critical risks facing the Company.


text: On at least an annual basis, the Head of Compliance, the General Counsel, the GRC Committee, and the IT Department, in consultation with our MSP, provide an update to the Board regarding critical cybersecurity risks and ongoing cybersecurity initiatives and strategies. We have implemented a process for significant cybersecurity matters and strategic risk management decisions related to cyber risks to be escalated to the GRC Committee and/or the Board, as appropriate.


text: b Management provides frequent informal communications to the Board between regularly scheduled meetings to keep the Board apprised of any emerging risks or incidents.


text: The Board of Directors has responsibility for oversight of cybersecurity risk management. As part of our enterprise risk management program, the Board has established oversight mechanisms that seek to implement effective governance in managing risks associated with cybersecurity threats. In particular, the Audit Committee has been vested with cybersecurity governance mandate that includes defining the Company's cybersecurity strategy and implementation plan, performing regular oversight over Company's cybersecurity landscape, and assessing the impact of material cyber incidents, should they happen.


text: Day-to-day responsibility for assessing, monitoring, and managing our cybersecurity risk management program rests with our IT Department, supported by broader MSP's service team, and members of our finance and legal teams as appropriate, and our Head of Compliance on cyber matters. Our Head of Compliance oversees our risk management governance and periodic compliance testing and works with our IT Department and other functions, as appropriate, on the mitigation and management of identified cyber risks. The IT Department, supported by broader MSP's service team executes the cybersecurity strategy. The IT Department and Head of Compliance report periodically to the General Counsel as well as to our Governance, Risk Management, and Compliance Committee ("GRC Committee") on cyber matters. Our GRC Committee is responsible for monitoring and overseeing our overall enterprise risk management process, including assessing, identifying, and managing cybersecurity related risks as part of its annual assessment of critical risks facing the Company.


text: On at least an annual basis, the Head of Compliance, the General Counsel, the GRC Committee, and the IT Department, in consultation with our MSP, provide an update to the Audit Committee regarding critical cybersecurity risks and ongoing cybersecurity initiatives and strategies. We have implemented a process for significant cybersecurity matters and strategic risk management decisions related to cyber risks to be escalated to the GRC Committee and/or the Audit Committee, as appropriate.


text: Lafayette Square maintains a cybersecurity program which includes processes for assessing, identifying, and managing material risks from cybersecurity threats in the form of unauthorized occurrences that could result in adverse effects on the confidentiality, integrity, or availability of the Company's information systems (any such occurrence, a "Cybersecurity Incident"). The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Lafayette Square USA, Inc.


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company. The Adviser maintains a comprehensive information security policy to manage risk which details procedures such as incident response, business continuity and disaster recovery management plans, penetration testing and quarterly cybersecurity training for all employees. The Adviser (through the Staffing Agreement with the Administrator) employs a Chief Technology Officer ("CTO"), Bobby Patnaik. Mr. Patnaik has more than twenty years of experience, including fourteen years in financial services. Prior to joining Lafayette, Mr. Patnaik worked at Goldman Sachs Asset Management rising to the Global Head of Institutional/Fund Reporting and Reference Data Technology after spending several years developing and leading middle and back-office technologies. Mr. Patnaik began his career working for several technology and telecommunication companies, including AT&T and Verizon.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Adviser has contracted with Salt Cybersecurity, LLC to serve as a virtual Chief Information Security Officer ("vCISO") and perform an annual information security program risk assessment and gap analysis based on the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) standard (ISO/IEC 27001:2013). In addition, our vCISO conducts due diligence on each vendor we utilize to assess their levels of security when working with Lafayette Square data. The Adviser has also engaged a third-party cybersecurity firm, AG1, Inc. (dba AgileBlue), to act as Lafayette Square's outsourced security operation center ("SOC") and provide continuous monitoring of Lafayette Square issued devices for potential vulnerabilities with any threats escalated to the CTO.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. Lafayette Square's information security policy includes an incident response plan which specifies procedures for elevating, remediating, monitoring and communicating about Cybersecurity Incidents. A dedicated team of executive level leaders at the Adviser (the "Incident Response Team") including the Chief Risk Officer, Chief People Officer, Chief Compliance Officer and led by the Chief Technology Officer ensure Cybersecurity Incident containment, eradication, recovery and notification that is integrated in Lafayette Square's overall risk management. If a Cybersecurity Incident is detected, whether by way of penetration testing, a vulnerability scan conducted by the SOC, or otherwise, it will be reported to the Chief Technology Officer and Chief Compliance Officer who mobilize the Incident Response Team. The Incident Response Team will prepare the communications including alerting the Board of any material risks and any additional required reporting. The Chief Technology Officer is designated as the leader of the Incident Response Team and is designated to interface with key stakeholders including the Board.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. See "Item 1.A Risk Factors – We depend on information systems, and systems failures could significantly disrupt our business, which may, in turn, negatively affect the value of our Common Stock and our ability to pay distributions." for more details on how cybersecurity threats are reasonably likely to materially affect the Company including its business strategy, results of operations, or financial condition. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company. The Adviser maintains a comprehensive information security policy to manage risk which details procedures such as incident response, business continuity and disaster recovery management plans, penetration testing and quarterly cybersecurity training for all employees. The Adviser (through the Staffing Agreement with the Administrator) employs a Chief Technology Officer ("CTO"), Bobby Patnaik. Mr. Patnaik has more than twenty years of experience, including fourteen years in financial services. Prior to joining Lafayette, Mr.


text: Patnaik worked at Goldman Sachs Asset Management rising to the Global Head of Institutional/Fund Reporting and Reference Data Technology after spending several years developing and leading middle and back-office technologies. Mr. Verizon.

stage1Category: None/Other


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. See " Item 1.A Risk Factors – We depend on information systems, and systems failures could significantly disrupt our business, which may, in turn, negatively affect the value of our Common Stock and our ability to pay distributions. " for more details on how cybersecurity threats are reasonably likely to materially affect the Company including its business strategy, results of operations, or financial condition. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Cybersecurity Program We have implemented a cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of safeguards, such as: password protection; multi-factor authentication; monitoring and alerting systems for internal and external threats; and regular evaluations of our cybersecurity program.

companyName: Nauticus Robotics, Inc.

ticker: KITT


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider. We use a number of means to assess cyber risks related to our third-party service providers, including conducting due diligence in connection with onboarding new vendors. We also seek to include appropriate security terms in our contracts, where applicable as part of our oversight of third-party providers.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats We maintain an incident response program. In the event of a cybersecurity incident, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain a Cybersecurity Policy, which includes an Incident Response Plan in the event of a significant cybersecurity incident. In the event of a significant cybersecurity incident, our IT Director will chair an incident response team to handle the incident. Such incident response team will include members of IT, finance (if applicable), legal, communications, human resources and any affected unit or department. IT, along with a designated forensic team, will use the Incident Response Plan to guide the response.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our IT Director. Our IT Director has over 10 years of experience addressing cybersecurity risks. Our IT Director is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. Our Chief Technology Officer oversees the IT Director and briefs our board of directors on cybersecurity matters, including the nature and design of our cybersecurity program, and threats, events, and program enhancements.


text: In its oversight role, our board of directors is expected to specifically consider risks, including with respect to privacy, information technology and cybersecurity and threats to technology infrastructure.


text: On a regular basis, our IT Director will report to our board of directors on cybersecurity matters, including key risks, the potential impact of those exposures on our business, financial condition, results of operations, cash flows, reputation and prospects, and the programs and steps implemented by our management team to monitor and mitigate risks.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall approach to risk management. Given our nature and size, we do not have a dedicated enterprise risk function, but our management team regularly considers and evaluates risks. As part of that risk management process, our management team identifies, assesses and evaluates risks impacting our operations, including those risks related to cybersecurity, and raise them for internal discussion, and where it is determined to be appropriate, issues are also raised to our board of directors for consideration.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any previous cybersecurity incidents that have materially affected our business, financial condition, results of operations, cash flows, reputation and prospects or that are reasonably likely to have such a material effect. While we have implemented a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information regarding risks relating to privacy and cybersecurity, see "Item 1A—Risk Factors—Risks Related to Our Business."


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats We maintain an incident response program. In the event of a cybersecurity incident, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain a Cybersecurity Policy, which includes an Incident Response Plan in the event of a significant cybersecurity incident. In the event of a significant cybersecurity incident, our IT Systems Administrator will chair an incident response team to handle the incident. Such incident response team will include members of IT, finance (if applicable), legal, communications, human resources and any affected unit or department. IT, along with a designated forensic team, will use the Incident Response Plan to guide the response.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our IT Systems Administrator. Our IT Systems Administrator has 15 years in total network and system administration experiences, 8 of which are experience addressing cybersecurity risks. Our IT Systems Administrator is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. Our Vice President of Corporate Development & Administration oversees the IT Systems Administrator and briefs our board of directors on cybersecurity matters, including the nature and design of our cybersecurity program, and threats, events, and program enhancements.


text: In its oversight role, our board of directors considers risks, including with respect to privacy, information technology and cybersecurity and threats to technology infrastructure.


text: On a regular basis, our Vice President of Corporate Development & Administration will report to our board of directors on cybersecurity matters, including key risks, the potential impact of those exposures on our business, financial condition, results of operations, cash flows, reputation and prospects, and the programs and steps implemented by our management team to monitor and mitigate risks.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall approach to risk management. Given our nature and size, we do not have a dedicated enterprise risk function, but our management team regularly considers and evaluates the cybersecurity risks. As part of that risk management process, our management team identifies, assesses and evaluates risks impacting our operations, including those risks related to cybersecurity, and raise them for internal discussion, and where it is determined to be appropriate, issues are also raised to our board of directors for consideration.


text: Through its Manager, the Fund maintains a cybersecurity risk management program designed to identify, assess, manage, and mitigate threats, as well as respond to and recover from cybersecurity incidents. This program is coupled with an enterprise risk management program and covers the Fund's key information systems.

companyName: WTI Fund X, Inc.


text: The cybersecurity risk management program includes a comprehensive risk assessment that is applicable to the Fund's operations. This assessment is based on recognized standards for cybersecurity and information technology as set forth in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). It is reviewed and updated at least annually. Internal controls designed to mitigate risks presented in the assessment are tested annually by an independent third party. Additionally, the Manager, on behalf of the Fund, contracts with a qualified third party to perform annual assessments of the Company's cybersecurity risk management program and to perform cybersecurity risk evaluations of selected key vendors. Another third party is engaged to provide day to day IT services which include implementing, monitoring, and maintaining the preventative and detective measures specified as part of the Fund's cybersecurity risk management program.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and any particular incidents through briefings from internal security personnel to Mr. Wan or our management team; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in our IT environment.

companyName: GigaCloud Technology Inc

ticker: GCT


text: The Manager's Chief Compliance Officer led the development and oversees the implementation of the cybersecurity program, and is the head of the Manager's cybersecurity team, supported by the Director of Compliance. The Chief Compliance Officer is responsible for assessing and managing the Manager's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team, inclusive of all third parties engaged to provide operations, monitoring, detection, and remediation, has extensive experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes.


text: The Audit Committee of the Board of Directors oversees the Fund's cybersecurity risk exposures and the steps taken by management to monitor and mitigate identified risks. The Chief Compliance Officer briefs the Audit Committee on the effectiveness of the cyber risk management program at least on a quarterly basis. In addition, cybersecurity risks and cyber incidents, if any, are reviewed by the Fund's Board of Directors at least annually as part of the risk mapping exercise, or as warranted in the event of material incidents.


text: The Fund faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. See "Risk Factors – Risks Related to Cybersecurity" for further information on how our operations are subject to cyber incidents that could have a material adverse effect on our business, financial condition, results of operations, and cash flows.


text: Risk Management, Strategy and Procedures We, our Investment Adviser and its affiliates regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, standards, processes, and practices, which are integrated into our overall risk management system. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, protect against, detect, respond to, and recover from security incidents. These efforts are implemented by Carlyle's Global Technology & Solutions ("GTS") team in partnership with our business, legal, and compliance teams, and are essential for us to conduct investment activities, manage internal administration activities, and connect our global enterprise. Our systems, data, network, and infrastructure are monitored and administered by formal controls and risk management processes that log events and help protect the our data. In addition, our business continuity plans are designed to allow critical business functions to continue in an orderly manner in the event of an emergency. The GTS team works closely with Carlyle's business segment teams, including our Investment Adviser, to maintain operational resilience through business continuity planning and annual information technology disaster recovery and incident response plan testing, which collectively support the goal of mitigating risk were an emergency to occur. The GTS team has procedures in place to report cybersecurity threats or incidents on a periodic basis. These efforts are underpinned by the implementation of security best practices, where possible, such as: • Multi-factor authentication for remote access, privileged access management for system administrators, application whitelisting, laptop encryption, and advanced malware defenses on endpoints; • Incident preparedness and response planning and risk mitigation; • Independent and continuous security testing, assessment and vulnerability management; • Regular security awareness training, including phishing simulations, for Carlyle authorized users; • Restrictions on access to personal email accounts, cloud storage, social media, risk-based categories of websites and USB storage devices; • Device and system access management policies and procedures that restrict access upon employee or contractor separation from the company; and • Compliance attestations by Carlyle personnel on firm policies, such as Carlyle's acceptable use policy, upon hire and annually.

companyName: Carlyle Secured Lending III


text: In addition, Carlyle partners with third parties to assess the effectiveness of its cybersecurity program, which includes the Company. Third party assessments will include audits and assessments performed under the direction of Carlyle's internal audit team, which co-sources with third-party cybersecurity experts in conducting its reviews. GTS also administers Carlyle's cyber third-party risk management program, which assesses external service providers before onboarding and provides ongoing monitoring in accordance with certain risk-based cybersecurity criteria.


text: To our knowledge cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. The sophistication of cyber threats continues to increase and there can be no assurance that the various procedures and controls we utilize to mitigate these threats will be sufficient to prevent disruptions to our systems. Consequently, given that the magnitude of cybersecurity incidents or threats are difficult to predict, we are unable to determine at this time whether risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For an additional description of cybersecurity risk and potential related impacts on us, see Part I, Item 1A of this Form 10-K "Risk Factors—Risks Related to Our Business and Structure—Cybersecurity risks and cyber incidents may adversely affect our business or those of our portfolio companies by causing a disruption to our operations, a compromise or corruption of confidential information and/or damage to business relationships, or those of our portfolio companies, all of which could negatively impact our business, results of operations or financial condition."


text: Risk Management Oversight and Governance Our Board of Trustees oversees our enterprise risk management strategy, including our strategy on cybersecurity risks, directly and through its committees. In this respect, the Audit Committee of the Board of Trustees (the "Audit Committee")


text: oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports from Carlyle on our enterprise risk profile on an annual basis. In addition, Carlyle's Chief Information Security Officer ("CISO") leads our cybersecurity program, chairs Carlyle's Information Security Steering Committee ("ISSC"), and provides cybersecurity status reporting to our Audit Committee at least annually. The ISSC meets quarterly and ensures that cybersecurity initiatives are in alignment with Carlyle's strategic priorities.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies, standards, processes, and practices throughout our operations that are designed to address cybersecurity threats, events, and incidents. In particular, our cybersecurity program supports security governance, security awareness and training, security engineering and architecture, security risk management, vulnerability management, security monitoring, and incident response capabilities. In addition, our incident response plan contains escalation and reporting protocols, including reporting to our disclosure committee to consider materiality of cybersecurity incidents. Policies and procedures are in place to assist the disclosure committee with these materiality assessments and any resulting reporting requirements.


text: Carlyle's CISO, in coordination with our Chief Financial Officer, Chief Compliance Officer, and Principal Accounting Officer, among certain other senior executives of our Investment Adviser, is responsible for leading the assessment and management of cybersecurity risks. The current Carlyle CISO has over 30 years of experience in information security and is a Certified Information Systems Security Professional. As described above, Carlyle's CISO leads our cybersecurity program, chairs Carlyle's ISSC that is comprised of senior management and other sector representatives, and provides cybersecurity status reporting to our Audit Committee as necessary and at least annually.


text: Risk management and strategy The Company and the broader financial services industry face an increasingly complex and evolving threat environment.

companyName: North Haven Private Income Fund LLC


text: Morgan Stanley has made and continues to make substantial investments in cybersecurity and fraud prevention technology, and employ experienced talent to lead its Cybersecurity and Information Security organizations and program under the oversight of Morgan Stanley's Board of Directors (the "MS Board") and the Operations and Technology Committee of the MS Board ("BOTC").


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify, and manage risks arising from the cybersecurity threats confronting the Firm ("Cybersecurity Program"). Morgan Stanley's Cybersecurity Program helps protect the Firm's clients, customers, employees, property, products, services, and reputation by seeking to preserve the confidentiality, integrity, and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems, including as applicable to the Company and its stockholders. Morgan Stanley continually adjusts its Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.


text: The Adviser and the Administrator manage the Company's day-to-day operations, and the Company uses the Cybersecurity Program to assess, identify and manage material cybersecurity risks affecting the Company and its operations. The Company's business is dependent on the communications and information systems of Morgan Stanley, including but not limited to the Cybersecurity Program, and other third-party service providers.


text: Processes for assessing, identifying, and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and stockholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley forensics team, which develops and implements technologies designed to help detect these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Where a potential threat is identified in Morgan Stanley's environment or which impacts the Company, Morgan Stanley's incident response team evaluates the potential impact to the Firm and, as relevant, the Company, and coordinates remediation where required. These groups, as well as Morgan Stanley's Operational Risk Department, review external cybersecurity incidents that may be relevant to the Firm and the Company, and the outcomes of these incidents further inform the design of the Cybersecurity Program. In addition, Morgan Stanley maintains a robust global training program on cybersecurity risks and requirements and conducts regular training exercises for its employees and consultants, including those personnel relied upon by the Company.


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to the Firm or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity program to identify the impact of their services on the cybersecurity risks to the Firm or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or a Firm audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, certain elements of the Cybersecurity Program are subject to an audit by an independent consultant, as well as an assessment by a separate, independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley and Company Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Risk, is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company. Those processes are periodically tested through tabletop exercises.


text: Despite the continuous risk faced by the Company, we have suffered no incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, nor have we had any widespread intrusion or incident. Notwithstanding the exhaustive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations and financial condition. While GXO maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: GXO Logistics, Inc.

ticker: GXO


text: The Chief Compliance Officer ("CCO") of the Company is responsible for overseeing the Company's risk management function and generally and relies on the CIO, CISO, and Head of Operational Risk to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of Operational Risk has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies. The Company's CCO has worked in the financial services industry for 19 years and has covered business developments from a compliance perspective for over 10 years, during which time the Company's CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of Operational Risk report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our Board.


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO, the CISO, and the Head of Operational Risk, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2023, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify, and manage risks arising from the cybersecurity threats confronting the Firm ("Cybersecurity Program"). Morgan Stanley's Cybersecurity Program helps protect the Firm's clients, customers, employees, property, products, services, and reputation by seeking to preserve the confidentiality, integrity, and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems, including as applicable to the Company and its unitholders. Morgan Stanley continually adjusts its Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.


text: The Chief Compliance Officer ("CCO") of the Company is responsible for overseeing the Company's risk management function and generally relies on the CIO, CISO, and Head of NFR CTIS to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of NFR CTIS has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies. The Company's CCO has worked in the financial services industry for 19 years and has covered business developments from a compliance perspective for over 10 years, during which time the Company's CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: Processes for assessing, identifying, and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and unitholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley cyber threat detection team, which develops and implements strategies designed to defend against these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Morgan Stanley's vulnerability management team, as well as Morgan Stanley's Non-Financial Risk function ("NFR") review external cybersecurity incidents that may be relevant to the Firm and the Company, to further inform the design of the Cybersecurity Program. To assess the efficacy of Morgan Stanley's controls and defenses designed to mitigate cybersecurity risk, it utilizes internal and external testing, including penetration testing and red team engagements. The results of these assessments are used to strengthen the Cybersecurity Program. Additionally, Morgan Stanley maintains a global training program covering cybersecurity risks and requirements, including heightened security training to specialized employees, and conducts regular phishing email simulations for its employees and consultants as preventative measures.


text: When a threat is identified in Morgan Stanley's environment, its incident response team follows an incident response plan to evaluate the impact to the Firm and coordinate appropriate remediation. If warranted, the cybersecurity incident will be reported to applicable regulators, authorities, impacted clients or counterparties, as appropriate. The Firm's cybersecurity incident response and remediation processes, including assessing materiality and reporting requirements, are reviewed through tabletop exercises.


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to the Firm or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity program to identify the impact of their services on the cybersecurity risks to the Firm or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or a Firm audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's minimum cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, key elements of the Cybersecurity Program are subject to review by an independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley and Company Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Cyber, Technology, and Information Security Non-Financial Risk ("Head of NFR CTIS"), is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company.


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of NFR CTIS report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our Board.


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO, CISO, and Operational Risk functions, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Material cybersecurity risks are addressed by Morgan Stanley management-level ERM committees with escalation to the BOTC and Board, as appropriate. The BOTC has primary responsibility for assisting the Morgan Stanley board in its oversight of significant operational risk exposures of the Firm and its business units, including IT, information security, fraud, third-party oversight, business disruption and resilience, and cybersecurity risks (including review of cybersecurity risks against established risk management methodologies) and the steps management has taken to monitor and control such exposures.