text: We have implemented an Enterprise Risk Management ("ERM") program, managed by members of senior management, to identify, assess, and monitor key risks that are aligned with our strategic and business objectives. Our policies and processes are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards. We apply NIST best practices in how we implement security and privacy controls. We use NIST to define our practice in conducting risk assessments as well as to define our approach in managing internet of things ("IOT") device security. We have identified various cybersecurity risks that could adversely affect our business, results of operations, and financial condition, including violation of privacy laws; intellectual property theft; fraud; business interruption or ransomware; harm to customers or employees; and other legal and reputational risks. Resideo Technologies, Inc.


text: Our Chief Information Security Officer ("CISO") oversees our information security program, leading a team responsible for enterprise-wide cybersecurity strategy, policy, process, standards, and architecture. Our CISO holds an MBA in technology management and has over twenty-five years of technology leadership experience, along with other certifications in efficiency and project management. Beyond the CISO, the security team in charge of incident management has a strong bench of experienced information security practitioners holding diverse degrees in science, technology, computer science, and mathematics. Members of the operations team have certifications such as the Certified Information Systems Security Professional ("CISSP"), Certified Information Security Manager ("CISM"), Offensive Security Certified Professional ("OSCP"), Certified Ethical Hacker, and many more. They all come from backgrounds that complement professions in security and all of them have at least several years of industry experience.

companyName: RESIDEO TECHNOLOGIES, INC.

ticker: REZI

secItem: Item 1C

stage1Category: Management Role

stage1Method: majority


text: Internal and external experts regularly evaluate our information security program, with results reported to senior management and our Board of Directors. We actively collaborate with vendors, industry experts, and intelligence and law enforcement communities to continually assess and enhance the effectiveness of our information security policies and procedures.


text: We follow a structured framework linked to specific security standards and the procedural practices that the security team employs in supporting associated activities. Our information security team works closely with our managed security service provider to triage identified anomalies and alerts that are raised as risks and work across the company to validate the risk and act as deemed appropriate. The global security operations center ("SOC") within the CISO's organization is responsible for incident management including identification, assessment of initial threat, notification of key stakeholders, containment, remediation, and recovery. We have a cross-functional team prepared to respond in a timely manner to the incident and assess our obligations when incidents occur.


text: We use technical safeguards to protect our systems from cybersecurity threats, including firewalls and access controls. As part of our risk management practice, and given the rapidly changing regulatory landscape, we focus on making relevant privacy and cybersecurity training available to all employees, this includes mandatory training for all users on privacy and security best practices, as well as awareness training tied to our phishing campaigns. Topics included in our yearly training include best practices in password hygiene, phishing awareness, data privacy, and other focus areas. We periodically test our policies and practices to guard against cybersecurity threats and engage in audits, threat modeling, vulnerability testing, and table top exercises.

stage1Category: Risk Management Process

stage1Method: unanimous


text: We have an established practice to oversee and manage third-party service providers in order to protect our interests related to cybersecurity threats. The Contract and Procurement Security Services ("CPSS") process has several key requirements of third-party vendors who manage or control our electronic information resources to ensure they protect our interests in cybersecurity, including: adherence to cybersecurity best practices, such as the NIST Cybersecurity Framework; completion of a security assessment questionnaire prior to any contract execution; and through application of our GRC (Governance, Risk, and Compliance) Tool, which triggers automatic annual security reviews of vendors. The security compliance team within the CISO's organization actively reviews and assesses the third party's responses and takes appropriate actions based on the responses.


text: The Board and the committees of the Board oversee our risk profile and exposures relating to matters within the scope of their authority. Among other matters, the Audit Committee is charged with oversight of Resideo's risks relating to enterprise-wide cybersecurity, including review of the state of the Company's cybersecurity policies and programs and steps management has taken to monitor and control such exposures. Cybersecurity review with the CISO is a regular standing calendar item of the Audit Committee in connection with its overall ERM program oversight. In addition, our Audit Committee provides oversight of our product technology and software cybersecurity program. The Audit Committee, together with the CISO, provide the full Board with visibility into the risks that impact us and the plans to mitigate them. The CISO's reports to the committees and the Board include insights on operations, business cyber risks, emerging threats and key strategic initiatives driving improved security capabilities, and special topics around what the Company is doing to strengthen Resideo's security posture. Resideo Technologies, Inc.

stage1Category: Board Governance


text: Cybersecurity and Data Privacy Risks We are subject to cybersecurity and data privacy risks. Cyberattacks and security vulnerabilities could lead to increased costs, liability claims, or harm to our competitive position.

companyName: AVAI BIO, INC.

ticker: AVAI


text: Cybersecurity Risks Our operations and the operations of our and partners involve the storage, transmission, and processing of third parties' and our data, including personal, confidential, or proprietary information. This data is subject to privacy and security laws, regulations, and customer-imposed controls. Cybercriminals use a variety of methods to exploit potential vulnerabilities in our systems, products, and services. Sophisticated attacks could result in unauthorized access, loss, misuse, disclosure, modification, or destruction of this data.


text: We are committed to protecting our third parties' and our data. Despite efforts, our systems, products, and services remain vulnerable to attacks.


text: Data privacy issues are becoming increasingly significant due to the rapidly changing legal and regulatory landscape. Compliance with global and local data privacy laws requires ongoing investment in our information technology and employee training, and will continue to impact our business.


text: Governance and Oversight We should have a formal risk management program that addresses cybersecurity and data privacy risks. This program should include regular reporting to our senior management and Board of Directors, who provide oversight and direction. We have not established an enterprise risk management framework to assess and prioritize these risks.


text: Incident Response We maintain an incident response plan that includes policies and procedures for notifying affected third parties and complying with applicable laws.


text: Investments in Cybersecurity We will continually invest in our cybersecurity capabilities to protect our assets and those of our third parties. This potentially will include investment in advanced threat detection, encryption, and other security measures. Recent Cybersecurity Incidents During the last fiscal year, we did not experienced cybersecurity incidents.


text: Cybersecurity Risks Our operations and the operations of our and partners involve the storage, transmission, and processing of third parties' and our data, including personal, confidential, or proprietary information. This data is subject to privacy and security laws, regulations, and customer-imposed controls. Cybercriminals use a variety of methods to exploit potential vulnerabilities in our systems, products, and services. Sophisticated attacks could result in unauthorized access, loss, misuse, disclosure, modification, or destruction of this data. We are committed to protecting our third parties' and our data. Despite efforts, our systems, products, and services remain vulnerable to attacks.

stage1Category: None/Other


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, clinical trial data, and other confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Kronos Bio, Inc.


text: Our Director of Information Technology and Associate Director, Infrastructure Operations, help identify, assess and manage the Company's cybersecurity threats and risks. Along with our Director of Information Technology and Associate Director, Infrastructure Operations, our Senior Vice President, Corporate Operations and Legal and third-party service providers help identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting vulnerability assessments to identify vulnerabilities and third-party-conducted red/blue team testing and tabletop incident response exercises.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining an incident response plan, engaging in incident detection and response, encrypting certain of our data, maintaining network security and access controls, maintaining physical security, utilizing asset management, tracking and disposal, engaging in systems monitoring, training employees, engaging in penetration testing and maintaining cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program; the Director of Information Technology and Associate Director, Infrastructure Operations work with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; our senior management, with input from an external strategic advisor, evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which together with our board of directors evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms, including outside legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, and in the case of a realized threat, forensic investigators.


text: We use third-party service providers to perform a variety of functions throughout our business, such as providing applications and hosting.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of the third parties upon which we rely, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, interruptions to our operations such as our clinical trials, claims that we breached our data protection obligations, harm to our reputation, and a loss of future customers or sales and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Vice President, Corporate Operations and Legal and our Director of Information Technology. Our Senior Vice President, Corporate Operations and Legal has oversight of cybersecurity and risk management, has management and oversight experience, and reports to the Chief Executive Officer. Our Director of Information Technology has high-level knowledge of cybersecurity tools and provides oversight of cybersecurity strategy and cybersecurity vendor management, and reports to our Senior Vice President, Corporate Operations and Legal.


text: prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Part I, Item 1A, Risk Factors, Risks Related to an Investment in Our Company" for more information regarding cybersecurity risks.

companyName: OceanTech Acquisitions I Corp.

stage1Category: Strategy Integration


text: Our Senior Vice President, Corporate Operations and Legal is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Senior Vice President, Corporate Operations and Legal is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Senior Vice President, Corporate Operations and Legal. The Senior Vice President, Corporate Operations and Legal works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from the Director of Information Technology and Senior Vice President, Corporate Operations and Legal, concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives and has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our Associate Director, Infrastructure Operations, helps identify, assess and manage the Company's cybersecurity threats and risks. Along with our Associate Director, Infrastructure Operations, third-party service providers help identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting vulnerability assessments to identify vulnerabilities and third-party-conducted red/blue team testing and tabletop incident response exercises.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program; the Associate Director, Infrastructure Operations works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; our management, with input from an external strategic advisor, evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which together with our board of directors evaluates our overall enterprise risk.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of the third parties with whom we work, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, interruptions to our operations such as any future clinical trials, claims that we breached our data protection obligations, harm to our reputation, and a loss of future customers or sales and other adverse consequences."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Associate Director, Infrastructure Operations. Our President, Interim Chief Executive Officer, Chief Financial Officer and Chief Operating Officer has oversight of cybersecurity and risk management. Our Associate Director, Infrastructure Operations has high-level knowledge of cybersecurity tools and provides oversight of cybersecurity strategy and cybersecurity vendor management, and reports to our President, Interim Chief Executive Officer, Chief Financial Officer and Chief Operating Officer.


text: Our President, Interim Chief Executive Officer, Chief Financial Officer and Chief Operating Officer is responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel, for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our President, Interim Chief Executive Officer, Chief Financial Officer and Chief Operating Officer works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from our President, Interim Chief Executive Officer, Chief Financial Officer, and Chief Operating Officer, concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives and has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We rely on the cybersecurity strategy and policies implemented by Monroe Capital, the parent of both MC Advisors and MC Management that also apply to the Company. Monroe Capital's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Monroe Capital's enterprise-wide cybersecurity program is aligned to the National Institute of Standards and Technology Cybersecurity Framework. Monroe Capital's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Monroe Capital has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors and other third parties who entrust us with their sensitive information.

companyName: Monroe Capital Income Plus Corp


text: Monroe Capital's cybersecurity program includes physical, administrative, and technical safeguards, as well as plans and procedures designed to help Monroe Capital prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us, MC Advisors or MC Management. Monroe Capital's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us, our investment adviser, or our administrator, is disclosed into Monroe Capital's enterprise risk management program, which is overseen by the Monroe Capital Operations and Risk Committee ("ORC"), as discussed below. In addition, Monroe Capital periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing and monitoring its cybersecurity risk management programs and responding to incidents.


text: The Monroe Capital cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness and data protection training including for employees of MC Advisors and MC Management. Monroe Capital also has annual certification requirements for employees, including employees who provide services to us pursuant to our Investment Advisory Agreement and our Administration Agreement with respect to certain policies supporting the cybersecurity program. Monroe Capital undertakes periodic internal security reviews of our information systems and related controls, including systems affecting personal data and the cybersecurity risks of Monroe Capital's and our critical third-party vendors and other partners. Monroe Capital also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.


text: In the event of a cybersecurity incident impacting us, MC Advisors or MC Management, Monroe Capital has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational functions of Monroe Capital, including coordinating with the relevant employees of MC Advisors and MC Management. The incident response plan includes notification to the applicable members of cybersecurity leadership, including Monroe Capital's Head of Information Technology, and the Computer Security Incident Response Team ("CSIRT"), as appropriate, escalation to the full ORC and/or an internal ad hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on their nature, incidents may also be reported to the audit committee or full board of directors of Monroe Capital, as well as to the Audit Committee (the "Audit Committee") of our Board and to our full Board, if appropriate.


text: Risk Management and Strategy In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and store sensitive data. "Information systems" means electronic information resources that we own or use, including physical or virtual infrastructure controlled by these information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the information necessary to maintain or support our operations. Because cybersecurity threats continue to evolve, we have been required and may continue to be required to expend significant resources to continue to implement, modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. Financial expenditures may also be required to meet regulatory changes in the information security and cybersecurity domains. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors—General Risk Factors—The failure in cybersecurity systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively."


text: To address cybersecurity threats (defined as potential unauthorized occurrences on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems or any information residing in those systems therein), we have a implemented an incident and event response program. That program is a component of our overall enterprise risk management and business continuity frameworks. We employ an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity relative to our information systems, as well as to report on any suspected advanced persistent threats. The program is designed to allow for the detection and timely and efficient recovery from cybersecurity incidents (defined as a violation or imminent threat of violation of information security policies, acceptable use policies, or standard computer security practices) and events by providing a well-defined, organized approach for handling any potential threats to the confidentiality, integrity, and/or availability of our information systems.


text: The CSIRT maintains overall responsibility for addressing and resolving incidents that occur at Monroe Capital. The CSIRT: (i) coordinates efforts in response to incidents; (ii) manages the assessment, recovery, and remediation efforts related to incidents; (iii) manages communication, both internal and external, regarding incidents; and (iv) manages notification of regulatory bodies as required by law in response to incidents.


text: We contract with a third-party vendor (oversight for which is outlined in our Vendor Risk Management Policy) who monitors our information systems for suspicious activity, such as unauthorized intrusions. Suspected or confirmed threats, incidents, or events, however, also may be reported by employees, intrusion detection systems, third-party servicers or government entities. Once reported, cybersecurity incidents are to be brought to the attention of the Head of Information Technology, the ORC and the CSIRT, which provides status updates to the Information Security Committee ("ISC"), with the frequency of such updates depending upon the perceived threat level of the reported incident.


text: After receiving notice of a cybersecurity threat, such threats are investigated to determine whether an actual incident has occurred and, if so, whether a more thorough assessment by the entire ISC is appropriate. During these assessments, steps may be taken to isolate affected systems. Outside advisors may be employed regarding the cybersecurity threat, including to conduct legal and forensic investigations and work with other third parties who might be engaged to assist in any response and associated publicity.


text: During or at the conclusion of an assessment of a cybersecurity incident, we will respond to the incident. The response will vary based upon the severity of the incident or event. The Head of Information Technology will note the classification of the information potentially impacted, paying close attention to information classified as personally identifiable information and sensitive. The Head of Information Technology and appropriate personnel will determine whether the incident is likely to affect ongoing business operations. If such is the case (e.g., contamination is widespread across production systems), the Monroe Capital's Incident Response Plan and Business Continuity Plan shall be invoked as necessary. In determining the level of response, we have identified three criticality levels of incidents and events based upon the following criteria: • Risk to confidential data • Risk to business continuity • Risk to critical systems • Revenue impact • Client impact


text: Incident and risk event levels each vary from level 3 (or low) risk to level 1 (high) risk. The determination of the incident and risk level will dictate the level of personnel that will be responsible for addressing the incident, controlling the effects of the incident and formulating the response to the incident. Responses may include, when appropriate and/or required, notification to regulatory agencies (e.g., SEC), authorities (e.g., F.B.I., Department of Justice), clients, third parties or internal personnel.


text: The CSIRT is responsible for incident reporting and response. The action steps taken, beyond notification, are typically accomplished with the assistance of the IT department. The Head of Information Technology or CSIRT team member will work with the appropriate personnel to respond to the incident (following written guidelines) and to ensure concurrent documentation of the same. Should a breach occur at a third party that has a material impact on Monroe Capital, the CSIRT must be notified.


text: Following a cybersecurity incident, and during its investigation and the formulation of a response, our processes also envision measures designed to contain and/or eradicate the incident and prevent further effects. Once it is determined that the incident has been resolved, we then work to establish appropriate controls (if applicable) to address similar future events and/or prevent another similar event from occurring in the future. To date, we have not experienced any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Our cybersecurity program is managed by Monroe Capital's dedicated internal cybersecurity team, which is responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by Monroe Capital's Head of Information Technology, who has a bachelor's degree in systems engineering and over 12 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The CSIRT includes members of Monroe Capital's senior executive management, including its Chief Operating Officer, Chief Compliance Officer and the Head of Information Technology, who acts as chairperson of the ISC. The ISC is comprised of Monroe Capital's Head of Information Technology, Chief Operating Officer and Chief Compliance Officer. The purpose of the ISC is to protect Monroe Capital's technology, data and information, and the ISC is tasked with responding to technology and data security incidents. The ORC is a cross-functional committee that governs and oversees the Monroe Capital enterprise risk management program, including cybersecurity. The ORC includes members of Monroe Capital's senior executive management, including its President, Chief Compliance Officer, Chief Operating Officer, who acts as chairperson of the ORC, Chief Credit Officer, Chief Financial Officer - Investment Funds and Chief Financial Officer - Management Company. The ORC, through regular consultation with the Monroe Capital internal cybersecurity team and employees of MC Advisors and MC Management, assesses, discusses and prioritizes Monroe Capital's approach to high-level risks, mitigative controls and ongoing cybersecurity efforts.


text: As part of its oversight responsibilities over risks and controls, the Board is ultimately responsible for overseeing our cyber and information security risks. The Audit Committee has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Members of the ORC and other Monroe Capital personnel periodically report to our Audit Committee as well as our full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Monroe Capital's cybersecurity program as it impacts us, the external threat environment, and Monroe Capital's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Monroe Capital's preparedness, prevention, detection, responsiveness and recovery with respect to cybersecurity incidents.


text: Material Impact of Cybersecurity Risks As of the date of this annual report on Form 10-K, we are not aware of any material risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about the cybersecurity risks that we face is discussed in Item 1A of Part I, "Risk Factors" in this annual report on Form 10-K under the heading "The failure in cybersecurity systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively."


text: Our Senior Director of Technology boasts over ten years of experience spearheading technology operations for organizations with a keen emphasis on cybersecurity. His extensive background has been pivotal in shaping our cybersecurity policies, implementing our cybersecurity program, and supervising information governance and compliance measures.

companyName: Acreage Holdings, Inc.


text: Our cybersecurity program is managed by Monroe Capital's dedicated internal cybersecurity team, which is responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by Monroe Capital's Head of Information Technology, who has a bachelor's degree in systems engineering and over 13 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The CSIRT includes members of Monroe Capital's senior executive management, including its Chief Operating Officer, Chief Compliance Officer and the Head of Information Technology, who acts as chairperson of the ISC. The ISC is comprised of Monroe Capital's Head of Information Technology, Chief Operating Officer and Chief Compliance Officer. The purpose of the ISC is to protect Monroe Capital's technology, data and information, and the ISC is tasked with responding to technology and data security incidents. The ORC is a cross-functional committee that governs and oversees the Monroe Capital enterprise risk management program, including cybersecurity. The ORC includes members of Monroe Capital's senior executive management, including its President, Chief Compliance Officer, Chief Operating Officer, who acts as chairperson of the ORC, Chief Credit Officer, Chief Financial Officer - Investment Funds and Chief Financial Officer - Management Company. The ORC, through regular consultation with the Monroe Capital internal cybersecurity team and employees of MC Advisors and MC Management, assesses, discusses and prioritizes Monroe Capital's approach to high-level risks, mitigative controls and ongoing cybersecurity efforts.


text: management and strategy are an R&D stage pharmaceutical company, with no commercial operations or revenue streams. Since our IPO, our sole business activity has been ongoing research into our drug therapies]. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted a formal cybersecurity risk management program or process for assessing cybersecurity risk currently.

companyName: Pelthos Therapeutics Inc.

ticker: PTHS


text: Risk Management and Strategy We have implemented processes for assessing, identifying and managing material risks from cybersecurity threats as part of our overall risk management program. Our cybersecurity program is informed by the National Institute of Standards and Technology Cybersecurity Framework as well as other globally recognized standards. We use a layered defense model, incorporating a wide range of technologies and practices in an effort to prevent, detect and mitigate threats. These measures include intrusion detection and prevention systems, multi-factor authentication, encryption and endpoint protection tools. We also implement threat detection and response solutions. To address emerging threats, we employ automated monitoring, vulnerability scans and patch management processes. Regular assessments, such as penetration tests, security audits and table-top exercises, are conducted to identify vulnerabilities and promote incident response and risk mitigation. We also provide privacy and information security trainings for our employees on a recurring basis. From time to time, we engage assessors, consultants and other third parties to assist with assessing, identifying and managing cybersecurity risks, including assisting us to conduct some of the foregoing assessments. Our cybersecurity risk management processes also are informed by intelligence received from recognized cybersecurity industry experts and other third-party sources, and as appropriate we engage outside counsel to advise on regulatory compliance and other cybersecurity risk management efforts.

companyName: Walt Disney Co

ticker: DIS


text: In addition, we have processes designed to oversee and identify cybersecurity risks associated with our use of third-party service providers. Where appropriate based on the data and intellectual property to which these providers are reasonably expected to have access, we conduct security assessments and due diligence reviews of third-party systems for compliance with our security standards, and we include data protection language in our agreements with these third parties.

stage1Category: Third-Party Risk


text: Further, as part of our cybersecurity risk management processes, we maintain an incident response plan (IRP) that establishes a set of procedures for reporting and handling cybersecurity events. The IRP delegates to an internal incident response team the initial assessment, investigation and remediation of the event and includes, among other procedures, guidelines for escalation to senior management and engagement with law enforcement. In certain instances, events are escalated to the Cybersecurity Incident Disclosure Subcommittee, which is a subcommittee of the Company's Risk Management Committee (RMC) (discussed further below) and is responsible for, among other things, the accurate and timely disclosure of material cybersecurity incidents under the federal securities laws, including making the materiality determination and approving related securities disclosures.


text: As discussed in further detail in Item 1A – Risk Factors, the Company faces an increasingly challenging cybersecurity environment, and from time to time the persistent efforts of bad actors to gain unauthorized access to our and our service providers' information systems and our confidential and proprietary information are successful. In fiscal 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents or will not discover additional information about previously detected events.


text: The Company's Board of Directors has delegated to the Audit Committee oversight responsibility for information technology risks, including cybersecurity and data security risks and mitigation strategies. The Audit Committee at least annually receives reports from the Senior Vice President, Chief Information Security Officer (CISO) concerning the Company's cybersecurity and data security risks, including ongoing efforts to prevent, detect, monitor, remediate and manage such cybersecurity threats, the threat environment, incident updates and emerging cybersecurity practices and technologies. The Chair of the Audit Committee reports on its discussion, including concerning cybersecurity matters, to the full Board. In addition, from time to time, senior management briefs the Audit Committee, the Audit Committee Chair and the Board on cybersecurity matters potentially of interest, including cybersecurity events, regulatory disclosures and regulatory trends.


text: Day-to-day management of our information security strategy and operations is currently the responsibility of our CISO, who reports into our Chief Financial Officer. Prior to joining the Company, our CISO held senior leadership roles in various other organizations, including as CISO for a publicly traded, global retailer and as a consultant advising organizations on information security strategy, and as a Special Agent with the U.S. Secret Service focusing on electronic crimes. That experience is supplemented by the collective experience and expertise of our dedicated internal teams of cybersecurity personnel.


text: In addition, the Company's RMC, a management level committee that includes, among others, the Chief Financial Officer and Chief Legal and Compliance Officer, oversees and supports the Company's ongoing efforts to identify, assess and prioritize, manage and monitor the Company's enterprise risks, including risks related to privacy and cybersecurity, and periodically reports certain discussions to the Company's Chief Executive Officer and Audit Committee. The RMC's Cybersecurity Incident Disclosure Subcommittee, whose members include the members of the RMC, the CISO and lead securities counsel, is tasked with assessing significant events for materiality, related timely and accurate disclosure under the securities laws and, as appropriate, escalating such events to the Audit Committee and the Board of Directors.


text: Risk Management and Processes is actively working towards the integration of a cybersecurity risk management program into its comprehensive risk management framework to protect the confidentiality, integrity, and availability of its critical systems and information.

companyName: Sensus Healthcare, Inc.

ticker: SRTS


text: Risk Management and Strategy We have implemented processes for assessing, identifying and managing material risks from cybersecurity threats as part of our overall risk management program. Our cybersecurity program is informed by the National Institute of Standards and Technology Cybersecurity Framework and other applicable globally recognized standards. We use a layered defense model, incorporating a wide range of technologies and practices in an effort to prevent, detect and mitigate threats. These measures include intrusion detection and prevention systems, multi-factor authentication, account management and access controls, encryption and endpoint protection tools. We also implement threat detection and response solutions. To address emerging threats, we employ automated monitoring, vulnerability scans and patch management processes, network monitoring and defenses, antivirus/antimalware protections and network segmentations. Regular assessments, such as penetration tests, security audits and table-top exercises, are conducted to identify vulnerabilities and promote incident response and risk mitigation. We also provide privacy and information security trainings for our employees on a recurring basis. From time to time, we engage auditors, assessors, consultants and other third parties to assist with assessing, identifying and managing cybersecurity risks, including assisting us to conduct some of the foregoing assessments. Our cybersecurity risk management processes also are informed by intelligence received from law enforcement and other governmental agencies, private sector intelligence networks, recognized cybersecurity and intelligence firms and other third-party sources, and as appropriate we engage outside counsel to advise on regulatory compliance and other cybersecurity risk management efforts.


text: Further, as part of our cybersecurity risk management processes, we maintain a cybersecurity incident response plan (CIRP) that establishes a set of procedures for reporting and handling cybersecurity events. The CIRP delegates to an internal incident response team the initial assessment, investigation and remediation of the event and includes, among other procedures, guidelines for escalation to senior management and engagement with law enforcement. In certain instances, events are escalated to the Cybersecurity Incident Disclosure Subcommittee, which is a subcommittee of the Company's Risk Management Committee (RMC) (discussed further below) and is responsible for, among other things, the accurate and timely disclosure of material cybersecurity incidents under the federal securities laws, including making the materiality determination and approving related securities disclosures.


text: As discussed in further detail in Item 1A – Risk Factors, the Company faces an increasingly challenging cybersecurity environment, and from time to time the persistent efforts of bad actors to gain unauthorized access to our and our service providers' information systems and our confidential and proprietary information are successful. In fiscal 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents or will not discover additional information about previously detected events.


text: Day-to-day management of our information security strategy and operations is currently the responsibility of our CISO, who reports to our Chief Information and Data Officer and our Chief Security Officer, both of whom report to our Chief Financial Officer. Our CISO has approximately 15 years of experience working in information security positions, including having served as CISO for publicly traded companies. That experience is supplemented by the collective experience and expertise of our dedicated internal teams of cybersecurity personnel.


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. For more information about the risks we face from cybersecurity incidents, please refer those discussed risk factors starting with "We may incur substantial costs in our efforts to comply with evolving global data protection " and "Our internal computer systems, or those of our collaborators " in the section entitled "Risk Factors" included under Part I, Item 1A of this Report.

companyName: PLIANT THERAPEUTICS, INC.

ticker: PLRX


text: Pliant's Cybersecurity Program is integral to safeguarding our assets, maintaining stakeholder trust, and ensuring the continuity of our operations. The management of our Cybersecurity Program is entrusted to the Cybersecurity Governance Committee ("CSGC"), which includes our Chief Financial Officer, General Counsel, Head of Information Technology and Corporate Controller. The CSGC draws on more than twenty years of experience focused in the areas of corporate governance and implementation and oversight of information technology systems and processes. The Board of Directors has delegated oversight of the Company's Cybersecurity Program to the Audit Committee, who receives regular reports from the Chief Financial Officer regarding cyber risks and threats, progress of the Company's projects aimed at strengthening information security systems, assessments of the Cybersecurity Program, and insights into the evolving threat landscape. The Audit Committee provides updates about the Company's Cybersecurity Program to the Board of Directors at least annually.


text: The CSGC leads the enterprise-wide cybersecurity strategy and policy development to ensure alignment and best practices informed by industry established frameworks. The Cybersecurity Program emphasizes continuous improvement by actively engaging with internal and external stakeholders, striving to stay ahead of emerging threats, adapting to the evolving cybersecurity landscape, and fortifying our defenses against potential risks. The Cybersecurity Program undergoes regular evaluations conducted by both internal and external experts to assess the strength of our Cybersecurity Program. Regular penetration tests are performed as well as simulated cybersecurity events to test our defenses and responses to unmitigated penetrations. The results of these evaluations are reported to the CSGC and Audit Committee of the Board of Directors. We have also deployed an information security training program for our employees that includes training on matters such as phishing and email security best practices as well as required training on data privacy.


text: We have implemented processes designed to minimize the chance of a successful cyberattack and we have also established incident response procedures to address a cyber threat that may occur despite these safeguards. Pliant's Cybersecurity Incident Response Plan includes engagement with key vendors, industry participants, and intelligence and law enforcement communities which are a fundamental aspect of our strategy. The Response Plan addresses (1) detection, (2) analysis, (3) communication, (4) containment, (5) eradication, (6) recovery and (7) post-incident review.


text: Cybersecurity and data protection falls under our overall risk management and oversight. Our Board of Directors periodically receives reports from our operations committee, cybersecurity management, external professional advisors, and other relevant Company personnel regarding various types of risks faced by the Company and the Company's risk mitigation efforts related thereto, including cybersecurity risks and related mitigation efforts.

companyName: Bally's Corp

ticker: BALY


text: Due to the critical nature of our business to the U.S. economy and national energy security and the continuous threat of cyberattacks, we regard cybersecurity as a top tier enterprise risk. Cybersecurity is integrated into our enterprise risk management program, which includes quarterly technology and cybersecurity risk assessments. We use the results of the technology and cybersecurity risk assessments for risk-based decision making to determine actions and priorities for our cybersecurity program. The technology and cybersecurity risk assessment process includes an objective, risk-ranking process; documented mitigation activities; and action plans for those risks requiring additional mitigation. These activities consider safety implications, operational disruptions, and business and financial impacts. As part of the cybersecurity program, we regularly obtain threat intelligence from various sources, which sources originate from private, commercial, and independent entities. In addition, our IT leadership routinely conducts risk quantification, simulations, and assessment exercises. We regularly engage with relevant government agencies to report and share certain security information enabling us to benchmark our capabilities, establish appropriate program targets, and adapt to emerging cybersecurity issues.

companyName: Midstream Co LLC


text: To manage our cybersecurity risk, we practice cyber hygiene through, among other measures, identity and access management, vulnerability and patch management, and asset management programs. We also segment our informational and operational technologies, and leverage network micro-segmentation and combine this practice with zero-trust security concepts. Operationally, we continuously monitor for cyber intrusions and augment our internal resources and capabilities with third-party service providers. Multiple security technologies are employed to protect our systems, applications, and data, including next generation firewalls, multi-factor authentication and access controls, and endpoint detection and response solutions. We have integrated our cloud-hosted services with our security operations center and have implemented measures aimed at securing our remote workforce. We measure our cybersecurity practices against the National Institute of Standards and Technology Cybersecurity Framework, relevant industry standards, and government regulations. We routinely engage independent third-party security firms to exercise and assess our cybersecurity capabilities.


text: Our information technology governance, including cybersecurity, is documented through written policies, procedures, guidelines, and standard operating procedures. All of our employees are required to undergo quarterly cybersecurity training. This training includes cybersecurity policies, cyber threats, and incorporating best practices into daily routines. Contractors and vendors that have access to our data, devices, or services are required to complete cybersecurity training prior to receiving access. Employees, vendors, and contractors with access to our operational technology network are required to undergo additional training specific to operational technology interactions. We maintain a Supplier Code of Conduct that is provided to our providers of materials and services during the onboarding process and that conveys our expectations regarding use and access requirements when using our technology resources.


text: We also manage cybersecurity risk through incident response strategies. We employ a fault-tolerant, highly available architecture and network segmentation as part of our containment strategy. We do not solely rely on architecture to ensure continuity and containment, and we employ additional technologies including, but not limited to, automated account disabling, automated device quarantining, network segment-isolation scripts, and cyber kill chain runbooks. We have implemented an Enterprise Data Backup Policy, which includes, among other activities, offsite backups, intra-day recovery points, and routine restoration of critical data. We use infrastructure-as-code to enable recovery of virtualized environments and employ data replication across multiple operating regions. We routinely exercise our recovery capabilities. Our Cybersecurity Incident Response Plan establishes a framework to manage the life cycle of a cyber event. Additionally, our Enterprise Crisis Management Plan provides a structure to assemble an enterprise crisis team in the event of a potential cyber related crisis. The crisis response team, including our Chief Information Officer (CIO), is responsible for managing the channels of communication pursuant to our Crisis Management Plan. This notification includes the notification or reporting of any significant cyber incidents to executive management. We periodically conduct cyber incident drills that include, as applicable, members of our Board of Directors, executives, certain business stakeholders, and legal and security partners, as necessary.


text: While we and third parties that provide services to us commit resources to the design, implementation and monitoring of our digital systems, there is no guarantee that our or our third parties' cybersecurity measures will provide absolute security. Like other companies in the natural gas industry, we have identified and expect to continue to identify cyberattacks and incidents on our systems. Additionally, we have received notification from third-party service providers of certain such matters on their systems. None of the cyberattacks and incidents we have identified, or been notified of, to the filing of this Annual Report on Form 10-K has had a material impact on our business strategy, results of operations or financial condition. For more information regarding the risks associated with cybersecurity that may impact our business strategy, results of operations, or financial condition, see "Cyberattacks aimed at us or those third parties on which we rely, as well as any noncompliance by us or such third parties with applicable laws and regulations governing cybersecurity and/or data privacy, could materially adversely affect us." included in Part I, "Item 1A. Risk Factors" of this Annual Report on Form 10-K.


text: The Board also receives presentations from management regarding trends in cybersecurity risks and risk mitigation initiatives and plans, including briefings on recent breaches at other companies and key takeaways and lessons learned that are applicable to our business. The Board will also periodically review key cybersecurity-related benchmarks for the Company.


text: Given the importance to us of our cybersecurity program, in April 2022, our Board elected to exercise direct oversight of cybersecurity matters, rather than acting through its committees. The Board, as well as separately our executive management, receives, and has the opportunity to ask questions and raise discussion points regarding, management reports from the CIO and Senior Director of Cybersecurity and Network Operations on cybersecurity matters, as needed and no less than quarterly throughout the year, which reports include items such as cybersecurity updates, cybersecurity operational results, and audit findings. In addition, the Board and executive management receives and reviews the results of our cybersecurity risk and capabilities assessment on an annual basis.


text: The cybersecurity program is managed by our CIO and our Senior Director of Cybersecurity and Network Operations and reviewed and monitored by executive management, with oversight from the Board. Our CIO has significant expertise and more than 30 years of experience in information technology and cybersecurity including cloud technologies and reports to our Executive Vice President & Chief Legal Officer. Our Senior Director of Cybersecurity and Network Operations has more than two decades of experience in the fields of information technology and cybersecurity and holds cybersecurity certifications, including the Certified Information Systems Security Professional, Certified Cloud Security Professional, and GIAC Information Security Professional certifications. The CIO and Senior Director of Cybersecurity and Network Operations meet regularly with each other and members of their team to discuss cybersecurity threats, capabilities and program strategy. We have built in incident workflows that automatically provide notifications and escalate cybersecurity incidents. During an incident, the CIO acts as the incident commander and the Senior Director of Cybersecurity and Network Operations acts as operations section chief, working together to provider supervision over incident response.


text: Cybersecurity Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer is primarily responsible for the cybersecurity component of our risk management program and is a key member of the risk management organization, reporting directly to the Chief Executive Officer and, as discussed below, periodically to the Technology Committee of our board of directors.

companyName: MetroCity Bankshares, Inc.

ticker: MCBS


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer, who reports directly to our Chief Executive Officer, along with key members of their team, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We have established processes and systems designed to assess, identify, manage, and mitigate cybersecurity risk and threats, including regular and on-going education and training for employees, including information security awareness training, preparedness simulations and tabletop exercises, and recovery and resilience tests. We employ a variety of preventative and detective tools designed to monitor and block suspicious activity and to identify cybersecurity threats. We continue to strengthen the management and oversight of cybersecurity risks through new security system enhancements, policies, testing, identification and reporting. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity professionals and third-party specialists. We also engage a third-party to perform penetration testing and ongoing analysis to identifty potential vulnerabilities and areas for additional enhancement. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with third-party service providers. We also monitor our email gateways for malicious phishing campaigns and monitor remote connections for cybersecurity threats. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to senior management and the Technology Committee of our board of directors, as well as the full board of directors. The Incident Response Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: The Company has a dedicated Security Forum and a Data Protection Committee comprising members from our senior leadership that convene on a regular basis to receive updates from our operations committee, cybersecurity management, external professional advisors, and other relevant Company personnel about the Cybersecurity & Privacy programs we have in place; discuss and assess material risks and planned risk mitigation, incidents and planned remediation efforts, trends observed, consider cybersecurity-related proposals, and review and adopt changes in cybersecurity policies.


text: We have not experienced a cybersecurity incident or identified risks from known cybersecurity threats or prior cybersecurity incidents that has materially impacted our business strategy, results of operations, or financial condition. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, results of operations or financial condition. For further discussion of risks from cybersecurity threats, see the section captioned "System failures or breaches of our network security could subject us to increased operating costs as well as litigation and other liabilities" in Item 1A. Risk Factors.


text: Cybersecurity Governance Our Information Security Officer directs our enterprise information security department and manages our information security program. The responsibilities of enterprise information security department include cybersecurity risk assessment and defense, vulnerability assessment, incidend prevention, mitigation, response, and remediation, data access governance, third-party risk management, and business resilience. Our Information Security Officer has over ten years of relevant expertise and formal training in the areas of information security and cybersecurity risk management in the financial institutions industry.


text: The Technology Committee of our board of directors has primary responsibility for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Security Officer provides quarterly reports to the Technology Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity risks and incidents. The Technology Committee also reviews our cyber security risk profile on a quarterly basis. The Technology Committee, as well as the full board of directors, reviews and approves our information security and technology budgets and strategies annually. The Technology Committee provides a report of their activities to the full board of directors on a quarterly basis.


text: Cybersecurity Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer is primarily responsible for the cybersecurity component of our risk management program and is a key member of the risk management organization, reporting directly to the Chief Executive Officer and, as discussed below, periodically to the Information Technology Committee of our board of directors.


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer, who reports directly to our Chief Executive Officer, along with key members of the Information Security Officer's team, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by the Informaiton Security Program, as well as the Information Technology Committee, with the goal of addressing changing threats and conditions.


text: We have established processes and systems designed to assess, identify, manage, and mitigate cybersecurity risk and threats, including regular and on-going education and training for employees, including information security awareness training, preparedness simulations and tabletop exercises, and recovery and resilience tests. We employ a variety of preventative and detective tools designed to monitor and block suspicious activity and to identify cybersecurity threats. We continue to strengthen the management and oversight of cybersecurity risks through new security system enhancements, policies, testing, identification and reporting. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity professionals and third-party specialists. We also engage a third-party to perform penetration testing and ongoing analysis to identify potential vulnerabilities and areas for additional enhancement. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with third-party service providers. We also monitor our email gateways for malicious phishing campaigns and monitor remote connections for cybersecurity threats. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to senior management and the Information Technology Committee of our board of directors, as well as the full board of directors. The Incident Response Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: Cybersecurity Governance Our Information Security Officer directs our enterprise information security department and manages our information security program. The responsibilities of enterprise information security department include cybersecurity risk assessment and defense, vulnerability assessment, incident prevention, mitigation, response, and remediation, data access governance, third-party risk management, and business resilience. Our Information Security Officer has over ten years of relevant expertise and formal training in the areas of information security and cybersecurity risk management in the financial institutions industry.


text: The Information Technology Committee of our board of directors has primary responsibility for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Security Officer provides quarterly reports to the Information Technology Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity risks and incidents. The Technology Committee also reviews our cyber security risk profile on a quarterly basis. The Information Technology Committee, as well as the full board of directors, reviews and approves our information security and technology budgets and strategies annually. The Information Technology Committee provides a report of their activities to the full board of directors on a quarterly basis.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and practices. We routinely assess material risks from cybersecurity threats, including any potential unauthorized attack on, or use of, our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information stored therein.


text: Our data breach management policy classifies potential threats by risk levels, and we typically prioritize our threat mitigation and impact evaluation efforts based on those risk classifications, while focusing on maintaining the resiliency of our systems. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks.


text: Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. Some of the other steps we have taken to detect, identify, assess, classify, and attempt to mitigate data security and privacy risks include: • Adopting and periodically reviewing and updating information security and privacy policies; • Conducting targeted audits and penetration tests throughout the year, using both internal and external resources; • Complying with the Payment Card Industry Data Security Standard (PCI-DSS); • Implementing an Information Security Management System (ISMS) and Privacy Information Management System (PIMS) which are certified as meeting the requirements of the ISO 27001 & ISO 27701 standards, respectively; • Engaging an industry-leading, suitably qualified and experienced third party to independently evaluate our information security systems on a regular basis; • Adopting a vendor risk management program, which includes receiving the results of cybersecurity and data privacy audits conducted on certain vendors engaged in high-risk data processing; • Providing security and data protection training and awareness to our employees, contractors and key partners with access to any sensitive information and systems; and • Maintaining cyber liability insurance.


text: We also understand the importance of collecting, storing, using, sharing, and disposing of personal information in a manner that complies with all applicable laws. To facilitate compliance with those laws, we have privacy policies in place regarding our treatment of customer data in both our offline and online environments, as well as policies relating to the protection of employee and vendor data. Our policies provide explanations of the types of information we collect, the rationale for such collection, how we use and share information, and generally describe the measures we take to protect the security of that information. Our policies also describe how customers may initiate inquiries and raise concerns regarding the collection, storage, sharing and use of their personal data.


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A "Risk Factors -Cybersecurity and Technology Risks.


text: Management's Responsibilities In the event we identify a potential cybersecurity or data privacy issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, our Board of Directors, other stakeholders, and law enforcement when responding to such issues. We have a dedicated management team overseeing our cybersecurity and data privacy initiatives, led by our Chief Information Officer, our Vice President and Global Data Privacy Officer, and our Vice President of Cybersecurity, each in consultation with professional advisors. Our Chief Information Officer has over 25 years' experience overseeing and managing information technology teams and complex IT systems, and our Vice President of Cybersecurity has over 15 years' experience developing and managing cybersecurity functions and strategies. Our Vice President of Global Data Privacy is a recognized leader in the industry with over ten years of experience in managing global data privacy programs. Our cybersecurity and data privacy management team regularly meets with senior executives and other team members to provide oversight with respect to our cybersecurity and data privacy risk detection, identification, assessment, classification, and mitigation efforts.


text: Our data breach management policy classifies potential incidents by risk levels, and we typically prioritize our incident mitigation and impact evaluation efforts based on those risk classifications, while focusing on maintaining the resiliency of our systems. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks.


text: Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. Some of the other steps we have taken to detect, identify, assess, classify, and attempt to mitigate cyber security and risks include: • Adopting and periodically reviewing and updating information security and privacy policies; • Conducting targeted audits and penetration tests throughout the year, using both internal and external resources; • Complying with the Payment Card Industry Data Security Standard (PCI-DSS); • Implementing an Information Security Management System (ISMS) that is certified as meeting the requirements of the ISO 27001 standard; • Implementing a Privacy Information Management System (PIMS) that complies with the requirements of the ISO 27701 standard; • Engaging an industry-leading, suitably qualified and experienced third party to independently evaluate our information security systems on a regular basis; • Adopting a vendor risk management program, which includes receiving the results of cybersecurity evaluations conducted on certain vendors engaged in high-risk data processing; • Providing security and data protection training and awareness to our employees, contractors and key partners with access to sensitive information and systems; and • Maintaining cyber liability insurance.


text: Cybersecurity and data protection falls under our overall risk management and oversight. Our Board of Directors periodically receives reports from our operations committee, cybersecurity management, external professional advisors, and other relevant Company personnel regarding various types of risks faced by the Company and the Company's risk mitigation efforts related thereto, including cybersecurity risks and related mitigation efforts.


text: The Board also receives presentations from management regarding trends in cybersecurity risks and risk mitigation initiatives and plans, including briefings on recent breaches at other companies and key takeaways and lessons learned that are applicable to our business. The Board will also periodically review key cybersecurity-related benchmarks for the Company.


text: The Company has a dedicated Security Forum and a Data Protection Committee comprising members from our senior leadership that convene on a regular basis to receive updates from our operations committee, cybersecurity management, external professional advisors, and other relevant Company personnel about the Cybersecurity & Privacy programs we have in place; discuss and assess material risks and planned risk mitigation, incidents and planned remediation efforts, trends observed, consider cybersecurity-related proposals, and review and adopt changes in cybersecurity policies.


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. The Company has designed and implemented a cybersecurity incident response plan and related processes, which are overseen by a team of internal cybersecurity professionals, including individuals with over ten (10) years' experience handling vulnerability and security management, system upgrades, mitigation initiatives, user education and system re/accreditation. The Company provides regular desk-top educational training and incident simulation exercises to better address potential cyber security incidences and response thereto.

companyName: Charlotte's Web Holdings, Inc.

ticker: CWBHF


text: Management's Responsibilities In the event we identify a potential cybersecurity issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, our Board of Directors, other stakeholders, and law enforcement when responding to such issues. We have a dedicated management team overseeing our cybersecurity initiatives, led by our Chief Information Officer, our Vice President and Global Data Privacy Officer, and our Vice President of Cybersecurity. Our Chief Information Officer has over 25 years' experience overseeing and managing information technology teams and complex IT systems, and our Vice President of Cybersecurity has over 15 years' experience developing and managing cybersecurity functions and strategies. Our Vice President of Global Data Privacy is a recognized leader in the industry with over 7 years of experience in managing global data privacy programs. Our cybersecurity management team regularly meets with senior executives and other team members to provide oversight with respect to our cybersecurity risk detection, identification, assessment, classification, and mitigation efforts.


text: Cybersecurity Processes and Risk Assessment We rely on the cybersecurity program implemented by Blue Owl, the indirect affiliate of our Adviser. Blue Owl has implemented a cybersecurity program, which i is focused on (i) protecting the confidentiality of business, client, investors in its funds and its employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: Blue Owl Technology Finance Corp.

ticker: OTF


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").


text: Blue Owl's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed by Blue Owl IT Management for remediation. When Blue Owl engages vendors and other third party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.


text: Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate.


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess and manage cybersecurity events. The framework is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by an internal team that is responsible for enterprise-wide cybersecurity strategy, policies, engineering and processes. The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.


text: Our Board of Directors has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: Impact of Cybersecurity Risks In 2023, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Internal and external cybersecurity threats and risks, as well as other disasters, may adversely affect our business or the business or our portfolio companies by impairing the ability to conduct business effectively." and "Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business."


text: Cybersecurity Processes and Risk Assessment We rely on the cybersecurity program implemented by Blue Owl, the indirect affiliate of our Adviser. Blue Owl has implemented a cybersecurity program, which is focused on (i) protecting confidentiality of business, client, investor and employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing proactive and reactive measures, including Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. Blue Owl's cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks and Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").


text: Blue Owl's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed and addressed by Blue Owl IT Management. When Blue Owl engages vendors and other third party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.


text: Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate. Blue Owl has a process designed to assess the cybersecurity risks associated with the engagement third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess, manage and report cybersecurity events, which is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The incident response framework determines when the C-ROC should provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including senior members of Blue Owl's management, Blue Owl's Audit Committee or Blue Owl's Board of Directors. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Following these risk assessments, we evaluate how to reasonably address identified gaps in existing safeguards to minimize identified risks and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high level personnel, including our Head of Information Security and Compliance, to manage the risk assessment and mitigation process.

companyName: AppLovin Corp

ticker: APP


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by IT Management as part of its responsibility for enterprise-wide cybersecurity strategy, policies, implementing Blue Owl's monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes and various other technological and administrative safeguards. The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.


text: The Audit Committee is primarily responsible for oversight and review of guidelines and policies with respect to risk assessment and risk management. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.