text: The audit committee is responsible for oversight of our cyber risk management program. The day-to-day management of the cyber program is directed by the Director of IT under the direction of the Chief Financial Officer. Currently, the Director of IT reports to the Chief Financial Officer and provides periodic updates to the Chief Financial Officer on cyber matters.


text: The Director of IT meets with the Chief Financial Officer periodically to discuss and review our cybersecurity risk management processes and to address matters related to potential cybersecurity and information technology risks, with input from the Company's third-party technology providers, as appropriate. The Chief Financial Officer provides periodic reports on cybersecurity and information technology matters to the audit committee, which is responsible for reviewing and overseeing the Company's risk management process, including risks from cybersecurity threats, as set forth in the audit committee charter. The audit committee periodically reports on cybersecurity risk management to the full board of directors.

companyName: Cabaletta Bio, Inc.

ticker: CABA

secItem: Item 1C

stage1Category: Board Governance

stage1Method: majority


text: Cyber Risk Management and Strategy Disc Medicine, under the oversight of the audit committee of the board of directors, has implemented and maintains processes to review and manage enterprise risks, including annual assessments of cybersecurity risks, across the Company.

companyName: Disc Medicine, Inc.

ticker: IRON

stage1Category: Risk Management Process

stage1Method: unanimous


text: Our cybersecurity risk management program, which is informed by and incorporates elements of recognized industry standards, is designed to identify, assess, and mitigate critical risks from cybersecurity threats. This program includes, but is not limited to, ongoing monitoring for potential critical risks from cybersecurity threats using automated tools. To support our cybersecurity risk management program, we leverage a managed service provider (MSP) that provides ongoing support for the protection of our information technology infrastructure as well as a virtual Chief Information Security Officer, or vCISO. Our cybersecurity risk management strategy is informed by periodic conversations with, and risk assessments conducted by, our vCISO.


text: We have an employee security awareness training program, offered upon employee onboarding and on an annual basis, that is designed to raise awareness of cybersecurity threats across functions as well as to encourage consideration of cybersecurity risks across our Company. As part of this employee training program, we periodically conduct phishing simulations designed to raise employee awareness of such risks.


text: We have also implemented a process to review contractual requirements related to information security obligations included in our agreements with certain third-party vendors and service providers, as appropriate.

stage1Category: Third-Party Risk


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems and infrastructure. For more information, please see Item 1A - Risk Factors.

stage1Category: Strategy Integration


text: Governance Related to Cybersecurity Risks Our Head of Information Technology (IT), under the oversight of our General Counsel, is responsible for the administration and maintenance of our cybersecurity risk management program, including the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who currently holds the title of Head of IT has more than 20 years of experience in information security and cybersecurity risk management.

stage1Category: Management Role


text: Our board of directors has delegated oversight of the Company's cybersecurity program to the audit committee of the board of directors. As provided in the audit committee charter, the audit committee is responsible for reviewing and discussing the Company's information security and risk management programs, controls, and procedures, including high-level review of the threat landscape facing the Company and the Company's strategy to mitigate cybersecurity risks and potential breaches. Under the audit committee charter, the audit committee is also responsible for reviewing the recovery and communication plans for any unplanned outage or security breach.


text: Our Head of IT, twice a year, provides reports to the audit committee on the status of our cybersecurity program, including measures implemented to monitor and address risks from cybersecurity threats, as appropriate. He also reports on a quarterly basis to the executive committee on cybersecurity and information technology matters. The chair of the audit committee provides periodic reports on cybersecurity risk management to the full board of directors. Our General Counsel, on an annual basis, discusses the results of our enterprise risk assessment processes, including risks related to cybersecurity, with the full board of directors.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, information related to our clinical trials, and information of our employees, or Information Systems and Data.

companyName: Landos Biopharma, Inc.


text: The Company's Director of Operations & Administration, with assistance from our third-party cybersecurity vendors, is responsible for identifying, assessing and managing the Company's cybersecurity threats and risks. Together, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, and evaluating threats reported to us.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response policy; incident detection and response tools; risk assessments; encryption of certain data; segregation of certain data; network security controls; access controls; asset management, tracking and disposal; employee training; and monitoring of certain systems. We also have cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise Risk Management Plan which is reviewed by management on a regular basis.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, including legal counsel and certain cybersecurity service providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations, contract manufacturing organizations, application providers, and information technology support. We prioritize the use of known vendors with experience specific to our industry needs and, depending on the nature of the services to be provided, our contracts with certain vendors include certain contractual provisions related to security.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences".

stage1Category: None/Other


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. Our audit committee of the board of directors is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of risks from cybersecurity threats, as outlined in its charter.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The Board also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: GTJ REIT, INC.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by the Director of Operations & Administration, who reports to the Chief Executive Officer, or CEO, and has experience in identity and access management, escalation and incident response, and risk management. The Director of Operations & Administration is responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Financial Officer, or CFO, and CEO. Management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from the CFO concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives regular reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We are committed to ensuring the confidentiality, availability and integrity of our data. Our cybersecurity strategy is informed, maintained and updated through various methodologies and external resources. As the concerns and issues evolve in cybersecurity, we remain focused on resiliency and continuous improvement to help enhance our cyber posture. We regularly reevaluate the threat landscape and evolve our controls to address new vulnerabilities and threats.


text: Risk Management and Strategy We regularly utilize information technology and data to operate our business. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, software, and hardware. Our critical data includes confidential, personal, and proprietary data (collectively "Information Assets"). The Company's risk management program is designed to manage identified material risks, which would include material cybersecurity risks. We rely on a team of internal and external resources, including external information technology and information security vendors to assess how identified cybersecurity threats could impact our business. These assessments may leverage, among other processes, industry tools and metrics designed to assist in the assessment of risks from such cybersecurity threats.


text: Accordingly, we work with third party providers to assess the environment to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on the risk assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business.


text: We implement and maintain various technical, physical and organizational controls designed to manage and mitigate material risks from cybersecurity threats to our Information Assets. The cybersecurity risk management and mitigation measures we implement for certain of our Information Assets include: policies and procedures designed to address information security, including external assessments to consider our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; encryption of data; network security controls; physical and electronic access controls; asset management, tracking and disposal; systems monitoring; and employee security training. We also have a cybersecurity training and compliance program in place for the Company whereby our connected employees are tested routinely through simulated phishing attempts.


text: We have not identified known risks, including as a result of prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, refer to Part I, Item 1A. Risk Factors for additional information about cybersecurity-related risks.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by Company management. The Chief Executive Officer, President and Chief Financial Officer discuss the cybersecurity programming. The Chief Financial Officer is responsible for the ongoing engagement of outside third parties to evaluate and update controls as recommended. Management is also responsible for working with appropriate third party vendors to evaluate the Company's risk profile and to update the controls for the Company's technology resources. Management is tasked with integrating cybersecurity considerations into the Company's overall risk management strategy, focus on appropriate priorities and approving related budgets, helping prepare for cybersecurity incidents, and soliciting and reviewing security assessments.


text: Management is involved with the Company's efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures. Management participates in cybersecurity incident response by anticipating and directing the Company's response to cybersecurity incidents. Our cybersecurity incident response processes are designed to identify and escalate certain cybersecurity incidents and vulnerabilities to members of management. Depending on the circumstances, management may work with third party experts and escalate to the Board as necessary.


text: Risk Management and Strategy As a company externally managed by the Advisor, we rely on Starwood Capital's information technology ("IT") systems, including data hosting facilities and other hardware and software platforms, some of which are hosted by third-party service providers, to assist in conducting our businesses. Starwood Capital's IT systems, like those of most companies, may be vulnerable to certain cybersecurity threats such as ransomware, interruption of services, data breaches, or any other cybersecurity incidents, or a series of related cybersecurity incidents, that could adversely impact our financial condition, results of operations, cash flows or business strategy, including our ability to operate core business functions. In the last fiscal year, Starwood Capital continually monitored the risk landscape and did not experience any cybersecurity breaches, including malware and computer virus attacks that have materially affected, or are reasonably likely to materially affect our financial condition, results of operations, cash flows, or business strategy. For more information on our cybersecurity-related risks, see Part I, "Item 1A. Risk Factors" included elsewhere in this Annual Report on Form 10-K.

companyName: Starwood Real Estate Income Trust, Inc.

ticker: SWDR


text: Starwood Capital considers cybersecurity risks, along with other top risks, within its Enterprise Risk Management ("ERM") framework. The ERM framework includes internal reporting at the business and enterprise levels, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. Starwood Capital has implemented a cybersecurity program that employs various controls and activities aimed at identifying, protecting against, detecting, and responding to cybersecurity threats. These controls and activities include hardware and software inventory tracking, endpoint protection, and network security measures to safeguard our assets from unauthorized access and attacks. Starwood Capital prioritizes data protection through access management designed to permit access only by authorized personnel. Starwood Capital's cybersecurity incident response plan, integrated into the ERM framework, outlines a structured process for handling information security incidents involving assets or data. It guides Starwood Capital's cybersecurity incident response team in containing, eradicating, and recovering from incidents while minimizing damage and disruption. The plan includes a clearly defined notification framework ensuring timely communication with business and management teams based on the incident's severity and potential impact. Additionally, Starwood Capital maintains a cybersecurity insurance policy to mitigate risks associated with cybersecurity incidents. The cybersecurity insurance policy covers both our company and other Starwood Capital affiliates.


text: Starwood Capital also periodically performs simulations and tabletop exercises at a management level and utilizes external resources and consultants, as needed. All employees of Starwood Capital are required to complete an annual computer-based Security Awareness Training Program that includes various topics on cybersecurity risk management best practices. This program educates users on how to identify information security threats and what actions should be taken in the event of a cybersecurity breach. Additionally, the employees of Starwood Capital are regularly tested with phishing campaigns reinforcing their awareness of email threats.


text: Annual risk assessments of Starwood Capital's Information Security Program are conducted to identify emerging information security and third-party risks. In addition, periodic vulnerability assessments and penetration tests are conducted throughout the year to support the identification of risks.


text: Further, Starwood Capital utilizes on-premises and cloud-based security solutions, with real-time monitoring provided by specialized managed third-party security service providers. These third parties collect events generated by critical systems in real-time, filter non-security events, and then correlate the information using security data analytical engines so that personnel of Starwood Capital can identify and analyze threats. With respect to the software platforms that are hosted by third parties, Starwood Capital utilizes an external vendor risk management platform to evaluate, rate, monitor and track vendor risk. The security practices and processes of our third-party service providers are monitored regularly. In addition, we have engaged a third-party to evaluate and review the remediation of cyber risks of our third party service providers, including financial service providers, property managers and professional service firms. For any hosted applications, Starwood Capital inquires if the vendor issues a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, Starwood Capital takes additional steps to assess its cybersecurity preparedness and assess the relationship on that basis. Starwood Capital's assessment of risks associated with the use of third party service providers is part of Starwood Capital's overall cybersecurity risk management framework.


text: Our board of directors is ultimately responsible for the oversight of risks from cybersecurity threats and has delegated responsibility for such oversight of cybersecurity matters to the audit committee. The audit committee receives at least quarterly, or more frequently as needed, updates from the Advisor on our cybersecurity program, including measures taken to address cybersecurity risks and significant cybersecurity incidents.


text: Starwood Capital's Chief Technology Officer, an industry veteran that has been focused on technology for over 40 years and in technology leadership roles at financial institutions for 20 years, leads the overall cybersecurity function and is responsible for developing and implementing Starwood Capital's Information Security Program and managing our response to threats. In addition to its in-house cybersecurity capabilities, at times Starwood Capital also engages third parties to assist with assessing, identifying, and managing cybersecurity risks. Members of Starwood Capital's IT security team, including the third-party security firms utilized as part, of its program, have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification.


text: Risks related to Cybersecurity Incidents We face significant risks related to cybersecurity threats, which could adversely affect our business, financial condition, and results of operations. Cybersecurity incidents, including but not limited to unauthorized access, data breaches, and other malicious activities, could result in the loss or theft of sensitive information, disruption of our operations, and damage to our reputation. While we have implemented measures to protect our information systems, there can be no assurance that these measures will effectively prevent all cybersecurity incidents.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: 1. Data Breaches: A breach of our information systems could lead to unauthorized access to customer or employee data, resulting in reputational harm and legal liabilities.


text: 2. Operational Disruption: Cybersecurity incidents could disrupt our operations, leading to delays in production, delivery, or fulfillment of customer orders.


text: 3. Intellectual Property Theft: Unauthorized access to our proprietary information could result in intellectual property theft, impacting our competitive position in the market.


text: 4. Regulatory and Legal Compliance: Cybersecurity incidents may subject us to regulatory investigations, legal claims, and penalties, affecting our compliance with applicable laws and regulations.


text: 5. Third-Party Relationships: Our reliance on third-party vendors and service providers exposes us to additional cybersecurity risks, and a security breach affecting these entities could impact our operations.


text: Although, to date, cybersecurity incidents have not materially impacted our business strategy, results of operations, or financial condition, there can be no assurances that they will not do so in the future. Refer to "Item 1A. Risk factors" in this Annual Report for additional information about cybersecurity-related risks.


text: Risk Management and Strategy Assessing, Identifying, and Managing Material Cyber Threats We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. We consult with external parties, such as cybersecurity firms and risk management and governance experts, on risk management and strategy. We use a team of outside vendors and government services specializing in IT and cybersecurity that provide expertise, tools, and methodologies to identify and assess vulnerabilities and potential threats. Automated tools and AI-based user behavior analytics also support identification and management of cyber threats. Response to a broad category of threats is immediate and automatic. Security personnel and members of our management are alerted when cyber threats or anomalies are detected. Persistent threats or issues that, in the opinion of management, are material are immediately brought to the attention of our board of directors.


text: In the event of a detected cyber incident by 24/7 monitoring software or employee notification, our IT and cybersecurity provider performs a detailed assessment of the incident, identifies the source of the problem, and resolves the issue as appropriate. If they are unable to resolve the issue, the problem is escalated to our cybersecurity monitoring and detection software provider for resolution. Events which are not routinely resolved by our IT and cybersecurity provider are brought to the attention of the board.


text: In order to mitigate risks of cybersecurity incidents, critical business and operational data are backed up at night and stored offsite for security purposes and to restore data in the event of a breach. Additionally, we provide cybersecurity awareness training of our employees, incident response personnel, and senior management.


text: Our management team, including our vice president of technology, is primarily responsible for assessing and managing our material risks from cybersecurity threats. Management supervises both our internal cybersecurity and IT personnel, as well as our retained external cybersecurity consultants and vendors. Additionally, they supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefing from internal or external security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants or vendors engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Our board of directors, through its Audit & Risk Committee, provides oversight and oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Management, including our vice president of technology, and our Audit & Risk Committee members, of which two members of our committee have received training and certifications on cyber risk governance for public companies, regularly brief our board of directors on our cybersecurity and information security posture as well as cybersecurity incidents deemed to have a moderate or higher business impact, even if viewed as immaterial to us. As cyber threats evolve and become more sophisticated, we believe that the board's involvement in cybersecurity governance ensures that we are adequately focused on resources and protecting the Company's assets and reputation.


text: Vital aspects of our cybersecurity governance that are currently in process or have been implemented include the following: • Governance and Strategy: Management, the Audit & Risk Committee and the board ensure that our cybersecurity strategy is aligned with our business strategy. • Risk Management and Oversight: Our Audit & Risk Committee and the board, as part of the board's enterprise risk management oversight, actively oversee our cybersecurity risk management framework, ensuring that material risks are identified, assessed, and mitigated. • Resource Allocation: o Budget Approval: The board reviews and approves cybersecurity budgets and resource allocations to ensure we have adequate resources to implement and maintain effective cybersecurity measures.


text: o Investment Decisions: The board, based upon recommendation of management or our external vendors and consultants, evaluates and approves significant investments in cybersecurity technologies, training, and talent.


text: o Regulatory Compliance: Management and the board both play a role in overseeing compliance with relevant cybersecurity regulations and legal requirements.


text: o Legal Oversight: Management and the board ensure we have appropriate legal counsel to address cybersecurity-related issues, including breach notification requirements.


text: o Training and Awareness: Members of management and members of our board take reasonable steps to stay informed about cybersecurity trends, threats, and best practices through ongoing education and training. Management reviews Company employee training programs to ensure employees are being trained appropriately and kept up to date on evolving cyber trends.


text: o Board Training: Certain of our board members have received training to understand cybersecurity risks and their role in overseeing cybersecurity.


text: o Periodic Updates: The board receives periodic updates from management, responsible staff and the Audit & Risk Committee regarding the Company's cybersecurity posture, incidents, and risk management efforts.


text: o Communication Strategy: Management, together with the board, are in the process of establishing a communication strategy for addressing cybersecurity disclosures with stakeholders, including customers, employees, and the public.


text: • Performance Evaluation: Included in the board's annual evaluation of the performance of the Company's chief executive officer is the effectiveness of implementing cybersecurity policy and measures, ensuring that cybersecurity policies and practices are effective and aligned with organizational goals. • Cybersecurity Culture: The board fosters a cybersecurity-aware culture throughout the organization, supporting management's efforts to build risk management including cyber into the fabric of the operating culture.


text: Despite these efforts, the rapidly evolving nature of cybersecurity threats requires ongoing vigilance, and there can be no assurance that our efforts will prevent all incidents. In addition to the foregoing, management and the board are evaluating, and intend to implement, further cybersecurity related measures, including without limitation developing a more robust internal policy framework, incident response plan, crisis management planning, and third-party vendor assessments and contractual obligations for third parties that the Company engages with. The Company intends to progress these efforts throughout 2024.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: MiNK Therapeutics, Inc.

ticker: INKT


text: We design and assess our program based on the Information Systems Audit and Control Association's Control Objectives for Information Technologies framework and National Institute of Standards and Technology cybersecurity framework, as well as threat trends identified by multiple external and internal cybersecurity intelligence reports.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight of risks from cybersecurity threats.

companyName: ARS Pharmaceuticals, Inc.

ticker: SPRY


text: We contract with external firms to assess our cybersecurity controls. We have processes in place to identify and evaluate risks associated with third party vendors and suppliers. In addition, we have systems in place to maintain business continuity and disaster recovery. Some or all of this work is done through our services agreement with Agenus. To date, we have not experienced any material cybersecurity incidents.


text: We describe whether and how risks from cybersecurity threats are reasonably likely to affect our business, results of operations and financial condition, under the heading "Our internal computer systems, or those of our third-party vendors, collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business" included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which is incorporated by reference into this Item 1C.


text: Cybersecurity Governance Our Audit Committee of the Board of Directors has oversight responsibility for risks and incidents related to cybersecurity threats. As part of our services agreement with Agenus, Agenus' Chief Information Officer provides the Audit Committee and the Board of Directors periodic reports on our cybersecurity risks and any material cybersecurity incidents.


text: Our team of cybersecurity professionals is led by Agenus' Chief Information Officer, who has over 20 years of experience in cybersecurity in regulated industries. Our cybersecurity team monitors the prevention and detection of cybersecurity events and is responsible for incident response and remediation.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: KINETA, INC./DE


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process, appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, among others: • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • undertake regular reviews of our consumer facing policies and statements related to cybersecurity; • proactively inform our customers of substantive changes related to customer data handling; • conduct annual customer data handling and use requirements training for all our employees; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; • conduct regular network monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K); • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and • conduct annual training with all employees on our security standards and requirements.


text: In the event of a cybersecurity incident, we will coordinate with our third-party cybersecurity advisor to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: As part of the above processes, we regularly engage with assessors, consultants, auditors, and other third parties, including by regularly having a third party review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.


text: Our internal processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. We determine an overall risk assessment of potential cybersecurity issues with our third-party suppliers. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. Additionally, if appropriate, we require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management.


text: Our audit committee is responsible for the oversight of risks from cybersecurity threats. At least annually, the audit committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the audit committee generally receives materials including a cybersecurity scorecard and other materials indicating current and emerging material cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and discusses such matters with certain members of management, which include our CFO and President. Members of the audit committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our President. Such individual completed a certificate program with Stanford University on Foundations of Information Security in the first quarter of 2024. In addition, he has over 20 years of executive responsibility for managing public company IT operations, including managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and deployment of internal training and company technology standards. This member of management is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: As discussed above, this member of management reports to the audit committee about cybersecurity threat risks, among other cybersecurity related matters.


text: We take cyber risk seriously as a part of modern enterprise risk management, protecting our stakeholders and assets, and building resilient processes. The modern threat landscape requires us to consider cyber risks, and make determinations regarding how to treat the risks. We evaluate cybersecurity risks alongside other business risks.

companyName: Dianthus Therapeutics, Inc. /DE/

ticker: DNTH


text: In the ordinary course of our business, we collect, use, store, and transmit digitally confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To that end, we rely on a multidisciplinary team (including from our IT function, senior management, and third-party service providers, as described further below) to assess how identified cybersecurity threats could impact our business. These assessments may leverage, among other processes, industry tools and metrics designed to assist in the assessment of risks from such cybersecurity threats.


text: Senior management is directly involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing incident response plans and engaging vendors to conduct penetration tests. Senior management participates in cybersecurity incident response efforts by being part of the incident response team and helping direct our response to cybersecurity incidents.


text: To augment internal knowledge, we have engaged a virtual Chief Information Security Officer ("vCISO") from a third-party firm that has provided IT and security services for over 17 years and utilizes industry expertise to recommend and implement best practice solutions for operational needs. The service provides a named vCISO as part of an advisory team to assess and help manage our cybersecurity program.


text: Cybersecurity risks are identified and processed in a Risk Register by an information security team that includes the vCISO and internal management. We conduct risk assessments, penetration testing, vulnerability scanning, receive alerts from security tools, and engage in an ongoing discussion of business processes and policy management. We use advanced tools to track governance, risk, and compliance tied to a security framework tailored from industry standards and best practices, and we test our tools and policies regularly.


text: Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. We have implemented and maintain information security processes designed to identify, assess, and manage material risks from cybersecurity threats to critical computer networks, third-party hosted services, communications systems, hardware, software, and our critical data including confidential, personal, proprietary, and sensitive data. Accordingly, we maintain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess any potential material impact to our business. Based on our assessment, we implement and maintain risk management processes to our information assets and mitigate harm to our business. In addition to internal systems and concerns, we manage risks from third parties that are a part of business operations. This includes assessing cybersecurity risks during the vetting process and recurring assessments during the life of the engagements. Relative levels of assessment are considered with regard to business criticality of the relevant third parties. We rely heavily on our third party CROs and CDMOs to manage our clinical trials and manufacture our investigational products, and a cybersecurity incident at a CRO, CMDO or other third party upon which we rely could materially adversely impact us. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. See "Risk Factors" in this Annual Report on Form 10-K for additional information on cybersecurity risks we face.


text: Information from the risk management process is managed by the Information Security Team and is reported to the Board of Directors on a regular basis. We provide cybersecurity updates to our Audit Committee on a quarterly basis. In the case of an incident, relevant members of the Information Security Team are involved to assess and oversee Incident Response operations as needed, including adequate reporting of material incidents if/when appropriate.


text: Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature, including clinical trial data ("Information Systems and Data").


text: Our Chief Executive Officer supervises our IT department (the "IT Department"), which coordinates with our cybersecurity incident management team, which consists of, among others, our Chief Financial Officer, Chief Legal Officer, Head of IT, and a third-party IT and cybersecurity consultant ("CSI Management Team") to identify, assess and manage our cybersecurity threats and risks. Members of our IT Department and CSI Management Team identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, internal and external audits, conducting threat assessments for internal and external threats, third-party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and evaluating threats reported to us.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a cybersecurity incident response policy; incident detection and response; vulnerability management processes; a disaster recovery and business continuity plan; risk assessments; encryption of certain of our data; network security controls; segregation of certain of our data; access controls; physical security; asset management, tracking and disposal; systems monitoring; vendor risk management processes; employee training; penetration testing; and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the IT Department works with the CSI Management Team to prioritize our risk management processes and mitigate cybersecurity threats that are expected to be more likely to lead to a material impact to our business. In addition, our management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which, together with the board of directors, evaluates our overall enterprise risk.


text: We use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including for example: a third-party IT and cybersecurity consultant; professional services firms, including legal counsel; threat intelligence service providers; cybersecurity software providers; managed cybersecurity service providers; penetration testing firms; and dark web monitoring services.


text: We use third-party service providers to perform a variety of functions throughout our business, such as conducting nonclinical and clinical trials; supply and quality testing; development and manufacturing; and professional services firms, including legal counsel. Additionally, we rely on third-party service providers and technologies to operate critical business systems to process sensitive data in a variety of contexts, including, without limitation, cloud-based infrastructure, encryption and authentication technology for certain environments and systems, employee email, and content delivery. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, which may include reputational due diligence and vendor risk evaluations.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Risk Factors—If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of IT Operations and Security, Senior Director of IT, and Chief Financial Officer.

companyName: Bolt Biotherapeutics, Inc.

ticker: BOLT


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including the CSI Management Team. Certain members of the CSI Management Team are information technology and security professionals, and we also rely on third-party security analysts who have certain certifications related to cybersecurity.


text: Our Chief Executive Officer, Chief Financial Officer and Chief Legal Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Additionally, they are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer. These members of management work with our CSI Management Team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our cybersecurity incident response policy includes reporting to the audit committee of our board of directors for certain cybersecurity incidents.


text: The audit committee periodically reviews and discusses with the appropriate members of our management material risks relating to data privacy, technology and information security, including cybersecurity, threats and back-up of information systems and our processes for assessing, identifying, and managing such risks, as well as our internal controls and disclosure controls and procedures relating to cybersecurity incidents. The board and audit committee are also provided with reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), International Organization for Standardization (ISO) 27001, and Payment Card Industry Data Security Standard (PCI DSS). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: KOHLS Corp

ticker: KSS


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, including our incident response personnel; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who access our critical systems and data.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors- Legal and Regulatory Risks".


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Our Audit Committee receives regular reports from management on our cybersecurity risks, and our full Board receives a periodic update. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as significant incidents.


text: Our Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. Board members receive presentations on cybersecurity topics from our Chief Technology Officer (CTO), Chief Risk and Compliance Officer (CRCO), and Chief Information Security Officer (CISO) or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: CARGO Therapeutics, Inc.


text: Our management team, including our CTO, CRCO, and CISO, has overall responsibility for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 25 years of technology and finance leadership experience across multiple industries for our CTO, over 30 years of experience in the Legal, Risk and Compliance disciplines for our CRCO, and over 20 years of cybersecurity leadership experience for our CISO.


text: Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of key cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data (such as information related to our product candidate development, collaboration activities and clinical trials), including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and sensitive personnel data and other personal data (collectively, "Information Systems and Data").


text: Our information technology department, supported by certain service providers, identifies, assesses and manages the Company's cybersecurity threats and risks. Our information technology department (led by our Director of IT Operations and Security), identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, real-time monitoring of network events, subscribing to reports and services that identify cybersecurity threats, evaluating threats and actors reported to us, conducting scans of the threat environment, evaluating our and our industry's risk profile, coordinating with law enforcement concerning threats when appropriate, conducting (and working with third parties, as appropriate) assessments and audits for internal and external threats and vulnerabilities, and using of external intelligence feeds.


text: We implement and maintain various technical, physical, and organizational measures, processes, and policies, designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, an incident detection and response plan; vulnerability management processes; risk assessments; implementation of security standards; encryption of certain data; network security controls; segregation of certain data; access controls including multi-factor authentication for certain Information Systems and Data; physical security; asset management, tracking and disposal; systems monitoring; vendor risk management program; employee training; penetration testing; and cybersecurity insurance. Our assessment and management of material risks from cybersecurity threats is integrated into the Company's overall risk management processes. For example, our information technology department presents updates on our IT environment and cybersecurity threats to the audit committee of the board of directors, which evaluates our overall enterprise risk and the effectiveness of our risk management approaches.


text: We use service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats. Such providers include but are not limited to legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed security service providers, and penetration testing firms.


text: We use service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. We have a vendor management program designed to manage cybersecurity risks associated with our use of certain of these providers. The program includes a risk assessment for certain vendors that host our Information Systems and Data. For vendors who host our critical data, we have processes designed to assess the vendor's ability to support business continuity and disaster recovery. Where appropriate, we conduct security questionnaires and a review of vendors' security. This review may include reviewing program documentation, security reports and audits, conducting security assessment calls with the vendor's security personnel, and imposing information security-related contractual obligations on the vendor. We also request data privacy assessments from certain vendors as appropriate. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see the risk factor in Part 1. Item 1A, including the risk factor entitled "Our internal computer systems, or those used by our CROs or other contractors or consultants, may fail or experience security breaches or other unauthorized or improper access."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our Director of IT Operations and Security and Senior Director of IT are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, reviewing security assessments and other security-related reports, and communicating key priorities to relevant personnel. For example, our Director of IT Operations and Security holds a Master of Science in information security and assurance, holds relevant certifications such as Certified Ethical Hacker, Computer Hacking Forensics Investigator, Security+ and Network+, and has worked for approximately nine years in the field of cybersecurity. Our Senior Director of IT has 25 years of IT management experience at various public biotechnology companies. Our Chief Financial Officer is responsible for helping prepare budgets, helping prepare for cybersecurity incidents, and approving certain cybersecurity processes.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Financial Officer. Our Chief Financial Officer receives regular reports on the status of our cybersecurity measures, and works with the Company's incident response team in an effort to help the Company mitigate and remediate cybersecurity incidents of which they are notified, and to assess and determine materiality for reporting purposes.


text: The audit committee receives periodic written and verbal reports from our Chief Financial Officer and directly from the information technology department concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented that are intended to address them. The audit committee also receives from the Director of IT Operations and Security or the Senior Director of IT, various written reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: The Sponsor, FMR LLC, and their respective affiliates operating as a business organization (collectively, "Fidelity") and its Enterprise Cybersecurity organization, on behalf of the Trust, have established a comprehensive risk management program, which includes processes to identify, assess, and manage cybersecurity risks, including material risks from cybersecurity threats, and to put in place appropriate controls to mitigate these risks and reduce the potential impact to the Trust and its Shareholders. The Trust does not have any employees and relies upon Fidelity and its Enterprise Cybersecurity organization for the Trust's day-to-day operations and to establish strategies, policies, and standards for the security of, and operations in, cyberspace.

companyName: Fidelity Wise Origin Bitcoin Fund

ticker: FBTC


text: The Trust depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. Through its vendor management program, and on behalf of the Trust, Fidelity oversees and identifies risks from cybersecurity threats associated with the use of third-party service providers. This vendor oversight program includes periodic reviews of the cybersecurity controls of third-party service providers. The frequency of such reviews is generally based on the nature of Trust's information processed by the vendor and the vendor's criticality to business operations.


text: On behalf of the Trust, Fidelity engages third-party consultants to assess, identify, and/or manage material risks from cybersecurity threats. For example, Fidelity engages third-party consultants to perform audits of its cybersecurity measures and risk management processes, including those applicable to Trust. Fidelity has also hired qualified independent assessors to review applicable security controls in accordance with the American Institute of Certified Public Accountant's System and Organization Controls assurance programs. Additionally, Fidelity utilizes third-party consultants with specific areas of cybersecurity expertise to review and report on various aspects of its cybersecurity program, including those applicable to the Trust. The results of these consulting engagements are shared with the Sponsor as part of periodic reports.


text: Fidelity's Enterprise Cybersecurity organization has a threat intelligence program which monitors for emerging cyber threats. Taking information gathered from public and private sources, including industry groups such as the U.S. Cybersecurity and Infrastructure Security Agency and the Financial Services Information Sharing and Analysis Center, the organization analyzes such information and incorporates tactics, techniques, and procedures into the program's security monitoring and detection tools and processes.


text: The potential impact of risks from cybersecurity threats on the Trust are assessed on an ongoing basis, and how such risks could materially affect the Trust's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Sponsor did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Trust, including its day-to-day operations, financial condition, and business strategies. In conjunction with Fidelity's Enterprise Cybersecurity, the Sponsor, on behalf of the Trust, participates in regular testing of applicable incident response processes to ensure appropriate escalation, mitigation, communication and reporting processes are in place.


text: Further, our cybersecurity team continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs. We use various security tools and processes to help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner, including, but not limited to, risk assessment network security controls, detection and response tools and a vulnerability management program.

companyName: DESTINATION XL GROUP, INC.

ticker: DXLG


text: The Sponsor provides strategic oversight regarding cybersecurity risks and threats. The Sponsor's Compliance and Risk Management Committee ("CRMC") comprised of various officers of the Sponsor and the broader Fidelity organization receives and reviews periodic reports from senior executives in Fidelity's enterprise cybersecurity organization, including Fidelity's Chief Information Security Officer ("CISO") and members of the CISO's staff. These reports contain information about risks from cybersecurity threats, including the results of recent independent reviews of the cybersecurity program, summaries of recent cybersecurity threat intelligence assessments, progress on key initiatives and strategies, and updates on recent regulatory activities, including new regulations and examinations.


text: The CRMC is responsible for assessing and managing material risks from cybersecurity threats. In connection with the Trust's reliance on Fidelity and its Enterprise Cybersecurity organization, the CRMC relies on the cybersecurity expertise of Fidelity's CISO and members of the CISO's staff to assist in assessing and managing the Trust's material risks from cybersecurity threats. The CISO has over twenty years of experience in technology and information security and has served as Fidelity's CISO since May 2021.


text: Management of the Sponsor is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Trust, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of Fidelity. The Sponsor is also made aware of material cybersecurity incidents which impact the Trust.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • overall risk assessment; • a technology team leveraging a third-party Security Operations Center (SOC) partner to monitor, manage and respond to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees and regular phishing campaigns; • a cybersecurity incident response policy that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors—Risks related to our business—Our information technology systems, or those used by our third-party contract research organizations or other contractors or consultants, may fail or suffer security breaches."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly updates from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.


text: Our management team, including the Vice President of IT and the Senior Vice President of Finance, General & Administrative, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 25 years of experience leading technology management functions within biotech companies as well as interacting with the Board.


text: Risk Management and Strategy We continuously monitor our information systems to assess, identify, and manage risks from vulnerabilities and assess cybersecurity threats. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process. We monitor risks through routine security assessments and implementation of enhancements to security measures used to protect our systems and data. We address system alerts on an ongoing basis. We maintain an Incident Response Plan Policy ("IRP"), which sets forth processes we will follow to address incidents as defined in the IRP, which include an actual or reasonably suspected cyber incident. Our information technology team promptly responds to system alerts and reported incidents that indicate the suspected presence of an incident and escalates in accordance with the IRP. The IRP, among other things, provides for a cross-functional team consisting of representatives from informational technology, risk management, legal, and communications, an Incident Response Team ("IRT"), that collaborates to quickly assess the impact, mitigate risks to information systems, and resolve incidents while improving information systems. Depending on the incident, we may utilize third-parties for assistance in investigating and addressing cybersecurity incidents.i We also utilize certain third-party service providers to perform a variety of critical business functions and recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. We have certain vendor management processes designed to help manage cybersecurity risks associated with our use of certain of these providers. Additionally, we strive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process.

companyName: Nkarta, Inc.

ticker: NKTX


text: We have not had cyber incidents that have materially affected our business or financial condition. For details about our risks associated with cybersecurity threats, see "— Computer system interruptions or security breaches of our information systems could significantly disrupt our product development programs and our ability to operate our business." in the section titled "Risk Factors" in Part I, Item 1A in this Annual Report on Form 10-K.


text: Management is responsible for identifying and assessing material risks for the business on an ongoing basis, including in relation to cybersecurity. As part of this process, our IRT is tasked with implementing and maintaining our cybersecurity programs, including establishing processes to ensure that potential cybersecurity risk exposures are monitored and putting in place appropriate mitigation measures. Our Chief Financial and Business Officer oversees our information technology department which monitors the prevention, detection, mitigation, and remediation of cyber incidents, if any, and reports all potential incidents and an initial assessment of such incident to the IRT. Our Chief Financial and Business Officer has over 6 years of experience with overseeing risk, compliance, and information technology functions.


text: Our Board of Directors (the "Board") oversees our risk management program as part of its general oversight function. The Board's Audit Committee is delegated the responsibility for reviewing and discussing with management our program to identify, assess, manage, and monitor significant business risks, including financial, operational, privacy, business continuity, legal and regulatory, reputation risks, and security, including cybersecurity. The Audit Committee receives quarterly updates from management regarding investigated incidents and periodic updates from management regarding cybersecurity matters (including the current threat landscape and cybersecurity risks). The Audit Committee may provide updates to the Board on the substance of these reports and any recommendations for improvements that the Audit Committee deems appropriate.


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. We use people, process, and technology controls to manage and mitigate cybersecurity risk. Our Chief Operations Officer is primarily responsible for this cybersecurity component and is a key member of the Information Technology ("IT") Committee, reporting directly to the Chief Executive Officer and, as discussed below, periodically to the board of directors. Our Chief Operations Officer has more than 15 years with the Company.

companyName: Affinity Bancshares, Inc.

ticker: AFBI


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Operations Officer along with members of the IT Committee, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: In many instances we rely on third-party providers to facilitate providing products and services to our customers. As a part of our overall cybersecurity risk management framework and, in addition to assessing our own cybersecurity preparedness, we also have a process in place to manage cybersecurity risks associated with third-party service providers. To help mitigate adverse impacts from a cybersecurity incident, we assess third-party vendors as a part of our vendor onboarding and continued due diligence which includes processes to assess information security posture. Depending upon the level of perceived security risk, we may impose security requirements upon a supplier, including: maintaining an effective security management program; abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident. We periodically conduct (or engage a third party to conduct) reviews of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of hosted applications, depending upon the level of risk, are required to provide a report as to their controls (e.g., a System and Organization Controls (SOC) 2 or ISO 27001 (Information and Security Certification) or similar report).


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the Board. The Incident Response Plan is coordinated through the Chief Operations Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated and tested at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company.


text: Our board of directors has established the IT Committee, which focuses on technology impact on all aspects of the bank. The IT Committee provides oversight and governance of the technology program including the information security program. The IT Committee includes the Chief Operations Officer and key departmental managers from throughout the entire company. The IT Committee generally meets monthly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Chief Operations Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the IT Committee on a monthly basis (or more frequently as may be required by the Incident Response Plan).


text: The board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Operations Officer provides monthly reports to our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The board of directors reviews and approves our information security and technology budgets and strategies annually.


text: Risk Management and Strategy We recognize the critical importance of maintaining the trust and confidence of our customers and employees. Consequently, we maintain a comprehensive security incident response plan ("SIRP") and we assess, identify, and manage material risks associated with cybersecurity threats. Our SIRP includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: We have integrated cybersecurity risk management into our broader risk management framework through various mechanisms, including (i) our updates to the Cybersecurity and Data Privacy Committee (the "Cyber Committee", created by our Board of Directors (the "Board") in 2016), which meets at least quarterly; (ii) our annual enterprise risk management update to the Board, and (iii) our information technology and security related internal controls, including vulnerability management programs.


text: The Company trains employees to understand their role in attempting to protect the Company from cybersecurity attacks. Our information security training program for employees includes acknowledgement of our information security policies, regular internal communications, and testing to measure the effectiveness of our information security program. For example, we conduct regular phishing awareness campaigns designed to emulate current threats and provide immediate feedback and, as necessary, additional training or remedial action.


text: In addition, the Company engages third parties to assist in assessing, identifying, and remediating material risks from cybersecurity threats. Our key cybersecurity controls are regularly tested by third-party service providers, which we retain to help identify vulnerabilities in our systems and to help maintain compliance to standards and regulatory requirements. Other third-party service providers are enlisted by the Company for security operations center services to augment our teams' monitoring capabilities and to assist with our investigation and response to alerts on emerging and ongoing threats.


text: The complexity and evolving nature of cybersecurity threats requires that we engage with a range of external experts, including cybersecurity assessors and consultants, in evaluating and testing our risk management systems. This enables us to leverage specialized knowledge and insights, to be confident that our cybersecurity strategies and processes are consistent with industry best practices. Our collaboration with these third-parties includes regular threat assessments and consultation on security enhancements.


text: In order to mitigate data or security incidents that may originate from third party vendors or suppliers, we conduct both privacy and security assessments to properly identify, prioritize, assess and remediate any third-party risks, and require security and privacy addenda to our contracts where applicable.


text: The nature of our business exposes us to cybersecurity threats and attacks that can lead to the unauthorized acquisition or access, compromise, loss, misuse or theft of our data, including personal information, confidential information or intellectual property. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition. Also see Part 1, Item 1A, Risk Factors, in this Annual Report on Form 10-K for a discussion of cybersecurity risks.


text: Our Board is ultimately responsible for the risk oversight of the Company, including cybersecurity and privacy risks. Our Board has delegated day-to-day responsibility for oversight of cybersecurity risks to the Cyber Committee. The Cyber Committee is composed of board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. Pursuant to its charter, our Cyber Committee: • assists our Board in fulfilling its risk oversight responsibilities with respect to the protection of the Company's assets, including confidential, proprietary and personal information, reputation and goodwill in all forms; • supervises and monitors the soundness of our cybersecurity and data protection strategies and practices; • oversees and monitors our material compliance with applicable information security, privacy and data protection laws, industry standards and contractual requirements; • promotes and furthers the integrity, adoption and coordination of our data security processes across the Company to help ensure that data and system security is a Company-wide business objective and priority; and • oversees our cybersecurity and data protection performance and the overall implementation of our cybersecurity and data protection strategy.


text: At the management level, our Chief Technology Officer ("CTO"), SVP, Technology and Information as well as our cybersecurity personnel are primarily responsible for identifying, assessing, monitoring and managing our cybersecurity. Our CTO reports directly to our President and Chief Executive Officer and at least quarterly meets with the Cyber Committee. Our current CTO has over 35 years of industry experience, including serving as CIO/CTO for over 6 years and having extensive experience in developing and leading technology risk management programs. Additionally, our technology staff holds multiple industry standard security certifications, including Cisco Certified Network Associate ("CCNA"), PCI Internal Security Assessor ("PCI ISA") and Certified Ethical Hacker ("CEH").


text: We believe cybersecurity is critical to advancing our technological advancements. As a biopharmaceutical company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: MAIA Biotechnology, Inc.

ticker: MAIA


text: Our Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our cybersecurity consultant, regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board retains oversight of cybersecurity because of its importance. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate. Our Cybersecurity consultant has extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks.


text: As a biopharmaceutical company, we must comply with extensive regulations, including requirements imposed by the Federal Drug Administration related to adequately safeguarding patient information and reporting cybersecurity incidents to the SEC. We work with our cybersecurity consultant on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. We believe we are positioned to meet the requirements of the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach.


text: We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a supplier, subcontractor or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on us. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See "Risk Factors" for a discussion of cybersecurity risks.


text: The Company prioritizes the security of its information systems and data integrity. We have developed a cybersecurity strategy, underpinned by our Cybersecurity Incident Response Plan, to manage and mitigate potential cybersecurity risks. Our strategy is designed to safeguard our systems and data.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity framework encompasses a proactive approach towards potential threats, focusing on prevention, detection, response, and recovery. Our cybersecurity risk management program is integrated into our overall risk management framework and shares common reporting channels and governance processes that apply across the risk management framework to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a cybersecurity team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers and software, where appropriate, to monitor, assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees; and • a global incident response plan that includes procedures for responding to cybersecurity incidents.


text: Our Incident Response Team ("IRT"), which includes members from various functional areas within the Company, including our data center operations, software, internal information systems, customer support, legal, and marketing departments, which are responsible for managing and mitigating any cybersecurity incidents at the Company. This team operates under the policy procedures that are outlined in our Cybersecurity Incident Response Plan.


text: Our experienced information technology management team has over 50 years of experience in the technology industry and play pivotal roles in incident identification, analysis, and response. This process includes notifying executive management when a cybersecurity breach or incident takes place, and taking necessary containment and mitigation steps to address the incident. Our comprehensive approach is designed to provide minimal impact on our operations and maintain the confidentiality and integrity of the personal information we handle.


text: Regular penetration testing, conducted by independent firms, forms a crucial part of our risk assessment process. These tests help us identify and mitigate potential vulnerabilities in our network security and data handling practices. Additionally, the Company monitors alerts and advisory statements from the Cybersecurity and Infrastructure Security Agency to keep abreast of relevant threats, vulnerabilities or alerts from actual incidents.