text: Sixth Street maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by us, from anticipated threats or hazards. Sixth Street utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software, among others.


text: Sixth Street tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Further, Sixth Street engages in cyber incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Tabletop exercises are conducted by Sixth Street's Technology Risk team in collaboration with outside service providers as appropriate and includes members of Sixth Street's senior management and Legal/ Compliance team. Learnings from these tabletop exercises and any events that Sixth Street experiences are reviewed, discussed, and incorporated into its cybersecurity framework as appropriate. In addition to Sixth Street's internal exercises to test aspects of its cybersecurity program, Sixth Street periodically engages independent third parties to assess the risks associated with its information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of Sixth Street's information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of the cybersecurity systems and processes.

companyName: Sixth Street Specialty Lending, Inc.

ticker: TSLX

secItem: Item 1C


text: Sixth Street has a comprehensive Security Incident Response Plan (the "IRP") designed to inform the proper escalation (including, as appropriate, to our executive officers and other representatives of the Adviser or its affiliates) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually.


text: Sixth Street maintains a cybersecurity risk management process to identify and mitigate risks that impact the firm. Sixth Street's Head of Technology Risk periodically discusses and reviews cybersecurity risks and related mitigants with Sixth Street's Cybersecurity Committee and incorporates relevant cybersecurity risk updates and metrics.


text: Sixth Street employs a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.


text: In the last three fiscal years, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats affect our business, and our reliance on the Sixth Street and its affiliates in managing these risks, see "Part 1. Item 1A. Risk Factors – Risk Related to our Business – Cybersecurity risks and cyber incidents may adversely affect our business or those of our portfolio companies by causing a disruption to our operations, a compromise or corruption of confidential information and/or damage to business relationships, or those of our portfolio companies, all of which could negatively impact our business, results of operations or financial condition" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Sixth Street has a dedicated cybersecurity team, led by its Head of Technology Risk, who works closely with Sixth Street's Cybersecurity Committee, to develop and advance the firm's cybersecurity strategy, which applies to us. Sixth Street's Cybersecurity Committee includes its Chief Operating Officer and Chief Information Officer, Chief Risk Officer, General Counsel, Chief Compliance Officer, as well as our Chief Financial Officer and Chief Compliance Officer.

stage1Category: Management Role

stage1Method: unanimous


text: The Head of Technology Risk has extensive experience in cybersecurity and technology and is responsible for all aspects of cybersecurity across Sixth Street. He has a B.S. in Computer Science from University of Washington and has over 18 years of experience contributing to cybersecurity related workflows, processes, policies, system designs, program management, and vulnerability discovery, exploitation, mitigation, and remediation.


text: Sixth Street conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The Head of Technology Risk reviews the cybersecurity framework annually as well as on an event-driven basis as necessary. The Head of Technology Risk also reviews the scope of the cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Sixth Street's information and systems.


text: Our Board of Directors is responsible for understanding the primary risks to our business, including any cybersecurity risks. The Board of Directors is responsible for reviewing periodically our and the Adviser's information technology security controls and related compliance matters, with management. Sixth Street's Head of Technology Risk reports to the Board of Directors at least annually on cybersecurity matters, including risks facing us and the Adviser and, as applicable, certain incidents. In addition to such periodic reports, the Board of Directors may receive updates from management as to our and the Adviser's cybersecurity risks and Sixth Street cybersecurity program developments.


text: Risk management and strategy We have an enterprise-wide information security program designed to protect our information systems from cybersecurity threats. We identify and assess risks from cybersecurity threats by monitoring and evaluating our digital assets and our risk profile using various methods. We monitor security events that are internally discovered or externally reported that may affect our systems and have processes and procedures to assess those events for potential cybersecurity impact or risk and consequently improve our security measures and planning. Additionally, we work with third parties from time to time that assist us in refining our cybersecurity risk strategy in order to identify, assess and manage cybersecurity risks, including professional services firms and consulting firms. We seek to detect and investigate unauthorized attempts and attacks against our network and services, and to minimize their occurrence and recurrence through changes or updates to our internal processes and tools and changes or updates to our services; however, we remain potentially vulnerable to known or unknown threats.

companyName: EQUITY RESIDENTIAL

ticker: EQR


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity events to members of management depending on the circumstances. Key members of management, including representatives from information technology ("IT"), operations, legal, finance, risk management and internal audit, serve on the Company's senior security incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified, and certain cybersecurity incidents are escalated to the Company's executives. In addition, the Company's incident response processes include potential reporting to the Audit Committee of our Board of Trustees for certain cybersecurity incidents.

stage1Category: Risk Management Process


text: We also have a third-party risk management program in place to manage cybersecurity risks associated with third-party service providers. While we do maintain processes and procedures to identify, prioritize and assess risks associated with third-party service providers, we must rely on third parties to augment our security program, and we cannot ensure in all circumstances that their efforts will be successful.


text: While to date we have not experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Any significant disruption to our systems could adversely affect our business and results of operations. Further, a cyber incident impacting our systems or a third-party's systems could subject us to business, regulatory, litigation and reputational risk, which could have a negative effect on our business, financial condition and results of operations.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A, Risk Factors, for a discussion of cybersecurity risks.


text: Our Information Technology Security Team, under the oversight of our Senior Vice President and Chief Technology Officer and the leadership of our VP of IT Infrastructure and Security, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The Information Technology Security Team manages and continually enhances a robust enterprise security structure with the ultimate goal of minimizing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Our Information Technology Security Team possesses decades of experience in navigating cybersecurity threats and mitigating associated risks as a result of holding similar positions at other large companies. Most members of the team hold degrees in cybersecurity and/or related disciplines, have cybersecurity certifications such as Certified Information Systems Security Professional (CISSP) and/or periodically attend various cyber-focused conferences and training programs. Specifically, our Senior Vice President and Chief Technology Officer and our VP of IT Infrastructure and Security combined have over 30 years of technology and cybersecurity experience. The team provides regular reports to senior management and affected departments on various cybersecurity threats, assessments and findings.


text: The Audit Committee of our Board of Trustees oversees our annual enterprise risk management assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats. The Audit Committee oversees our ongoing cybersecurity risk management efforts and regularly receives detailed reports from representatives of our Information Technology Security Team addressing a wide range of related topics. At least annually, our IT leadership (and external cybersecurity experts if applicable) reviews key cybersecurity strategies and policies with the full Board of Trustees, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends and other areas of importance.


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes the implementation of a cybersecurity incident response plan. This plan was developed with support from our Audit Committee and in consultation with key stakeholders across our organization to ensure it accurately reflects their respective roles and responsibilities. The plan has been selectively disseminated throughout our organization to ensure appropriate coverage and to foster a cohesive and informed response to cybersecurity incidents.

companyName: GETTY REALTY CORP /MD/

ticker: GTY


text: We design and assess our program based on industry standards to align closely with information security frameworks and guidelines. This does not imply that we meet or are in compliance with any particular technical standards, specifications, or requirements, only that we use the frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: We utilize a commercially available third-party hosted cloud network environment with commercially available systems, software, tools and monitoring to provide security to protect our information and data and alert us to potential information security breaches. The third party engaged by us to oversee and host our network was engaged, in part, because of its experience with information security and data protection and products designed to manage against information and data security breaches. We conduct mandatory annual cybersecurity training for employees and have information security and data privacy policies and procedures in place applicable to our directors, officers, and employees.


text: We previously engaged an outside consultant to conduct a comprehensive cybersecurity assessment, the methodology for which was based on information security frameworks and guidelines such as the National Institute of Standards and Technology (NIST), Center for Information Security (CIS), and ISO 27001. Management reviewed the results of the assessment with the Audit Committee and worked with consultants, auditors, and other third parties to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means.


text: While we have not experienced any cybersecurity incidents to date, the scope and impact of any future incidents cannot be predicted and there can be no assurance that our cybersecurity risk management program will be effective in preventing material cybersecurity incidents in the future. For additional information, see "Item 1A. Risk Factors—Risks Related to Our Business and Operations—We rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could harm our business. Additionally, our failure to comply with applicable privacy, data security or protection or cyber security laws could adversely affect our business" in this Annual Report on Form 10-K.

stage1Category: None/Other


text: Management and Board Oversight Our Board of Directors actively considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risk to the Audit Committee. The Audit Committee is instrumental in overseeing the implementation of our cybersecurity risk management program by management.


text: The Audit Committee receives detailed quarterly reports from management about our cybersecurity risks, and management provides timely updates to the Audit Committee about any significant cybersecurity incidents, as well as those with lesser impact potential if deemed appropriate to do so.


text: The Audit Committee informs the full Board of Directors about its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on our cybersecurity risk management program. Members of the Board of Directors are kept abreast of cybersecurity developments through presentations by our Chief Financial Officer or external experts as part of their ongoing education on issues impacting public companies.


text: Our management team, including our Chief Financial Officer, and members of the Audit Committee play a pivotal role in assessing and managing material risks stemming from cybersecurity threats. The management team is primarily responsible for the oversight of our overall cybersecurity risk management program, and coordinates with our external cybersecurity consultants.


text: Efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents are supervised by our management team. These efforts include briefings from internal security personnel, leveraging threat intelligence and information from governmental, public, and private sources, engagement with external consultants, and utilizing alerts and reports generated by our security tools within the IT environment.


text: Risk Management and Strategy AVITA Medical has implemented an Information Security Management System ("ISMS"). The Company's ISMS is a continuous process designed to analyze the potential risks, vulnerabilities, the likeliness of occurrence and the related consequences of cybersecurity threats. The process is based on establishing the context, assessing the risks, and treating the risks. The key concept of the ISMS is to consistently maintain and improve confidentiality, integrity, and availability of information assets that should be protected by the organization on behalf of itself and its clients, and third parties. Once a risk, threat or vulnerability is identified, the Company establishes a risk treatment plan to take corrective action to prevent risks that can be avoided and minimize the ones that cannot. We engage an independent third-party cybersecurity services and consulting firm to continuously review our information security and provide technical oversight. We also conduct internal phishing campaigns and perform an independent penetration test on an annual basis. In addition, we conduct regular security awareness training and testing of our employees. The Company has not had any material cybersecurity incidents.

companyName: AVITA Medical, Inc.

ticker: RCEL

stage1Method: majority


text: 1. Context establishment - Established in accordance with the requirements of International Organization for Standardization 27001 and 27002 ("ISO 27001" and "ISO 27002"). The ISO 27001, Information security management systems, provides a framework and guidelines for establishing, implementing and managing an ISMS and ISO 27002, Information security controls, provides a reference set of generic information security controls including implementation guidance.


text: 2. Risk Assessment - Relates to an evaluation and identification of risks, threats and vulnerabilities that exist or could exist, identifies the likelihood of occurrence and potential consequences. As part of the risk assessment management prioritizes the assessed risks from low to high based on likelihood and level of impact.


text: 3. Risk Treatment – will detail the remediation process for risks, vulnerabilities and threats identified to reduce the risk to an acceptable level.


text: 4. Risk Acceptance- The Company's risk assessment is evaluated from a Low (1) to a High (3) on the Impact the threat would have on the Company and its operations and the likelihood of occurrence. Threat ratings created from the Impact and probability calculations will result with a value from 1- 9.


text: a. Low (1 – 2.99) = Risk level acceptable and no further action deemed necessary b. Medium (2 – 5.99) and High (6 - 9) – implement risk management to reduce the risk to an acceptable level 5. Risk Communications- Results of the risk assessment are communicated to appropriate levels of management. Report includes the identified risk and vulnerability summaries. Updates will include treatment plans and status updates.


text: 6. Risk Monitoring and Review - Continuously performed to evaluate any changes or the need for changes. The Company uses the Ontrack software solution ("Ontrack") to monitor and track all aspects of risk assessment. Ontrack also serves as tool to track any cybersecurity incidents and remediation tasks.


text: Disclosure of Management's Responsibility The Company's Chief Financial Officer is responsible for overseeing the Cybersecurity Risk Management Program and leading the Company's efforts to mitigate technology risks in partnership with various business leaders in the organization. For qualifications of the CFO refer to Item 10 of the Form 10-K. We have protocols, policies and tools in place to mitigate cybersecurity risk. They also provide the administrative, technical, and physical safeguards to ensure the security, confidentiality, integrity and availability of confidential information and personal information from unauthorized access, use, disclosure, alteration, destruction or theft. In addition, we engage an independent third party annually to assess our IT general controls and IT security. Special focus is given to maintaining and improving our alignment with ISO 27001. Additionally, we have a cybersecurity incident response plan in place that provides a documented framework for handling high and low severity security incidents and facilitates coordination across multiple parts of the business. Finally, cybersecurity is integrated into the Company's training as all employees are required to take security awareness training.


text: Disclosure of the Board's Responsibility While management is primarily responsible for assessing and managing cybersecurity risks on a day-to-day basis, the Company's Board of Directors oversees management's efforts to assess and manage risk. The Board of Directors (through the Audit Committee) monitors the cybersecurity risk assessment and response process. The Audit Committee is briefed by our Chief Financial Officer on our cybersecurity ISMS program and the overall cybersecurity risk environment. The briefing may include discussions on topics such as: information security and technology risks, cybersecurity risk assessment process and updates, information risk management strategies, and progress on cybersecurity and data protection training initiatives for employees, among others.

stage1Category: Board Governance


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Four Corners Property Trust, Inc.

ticker: FCPT


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers and vendors based on their criticality and risk profile.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity risks that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - We may be vulnerable to security breaches or cyber-attacks which could disrupt our operations and have a material adverse effect on our financial performance and operating results."

stage1Category: Strategy Integration


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit and Risk Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any significant cybersecurity incidents.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Accounting Officer.


text: Our management team, including our Chief Accounting Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over ten years of overseeing IT risk management and compliance, day-to-day IT operations, and coordinating with external IT security experts. Our Chief Accounting Officer also works in tandem with an external cybersecurity consultant that has experience in cybersecurity assessment, response, and mitigation.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Management is responsible for the day-to-day handling of risks facing our Company, while the Board of Directors, as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated certain risk management responsibilities with respect to cybersecurity to our Audit and Compliance Committee.

companyName: HCA Healthcare, Inc.

ticker: HCA


text: The Audit and Compliance Committee periodically reviews our data security programs, including cybersecurity processes and procedures regarding cybersecurity threats, AI, disaster recovery and critical business continuity, and reviews our programs and plans that management has established to monitor compliance with data security compliance programs and test emergency operations preparedness. The Audit and Compliance Committee also receives reports regarding risks associated with our data security programs and management's plans for monitoring and testing compliance with data security regulations.


text: The Audit and Compliance Committee meetings take place on a quarterly basis and include a report from our Chief Security Officer ("CSO") regarding our security programs, including (i) the status on activities under way to support our security strategy, (ii) an overview of the current threat landscape, including emerging threats and trends that may affect us, (iii) key performance measures of security operations and (iv) general security program needs. The security program includes cybersecurity and information security risk management. Our senior security leadership team has an average of 20 years of data security experience, and each member has served in multiple roles within our security programs.


text: We seek to leverage a comprehensive risk management program aligned with the National Institute of Technology Cybersecurity Framework 2.0 that encompasses a structured approach to assess, identify, and manage cyber and information security risks. The internal processes for these activities are evaluated for alignment with our objectives and overall risk tolerance. This approach is consistent with our overall risk management efforts. The CSO participates with other senior officers, including the Chief Executive Officer, Chief Information Officer, Chief Financial Officer, Chief Legal and Administrative Officer, Chief Ethics and Compliance Officer and others on our risk management committee, which develops and coordinates enterprise cybersecurity and information security policy and strategy, and provides guidance to senior management.


text: We utilize cross-functional teams and risk assessment tools and technologies to identify potential cybersecurity and information security threats and risks. These teams include representatives from various departments within our Company to promote a holistic view of the organization's cybersecurity and information security risk landscape and to facilitate communication. We have implemented multiple layers of security measures designed to protect the confidentiality, integrity and availability of our data and the systems and devices that store and transmit such data. We also seek to embed security measures into software and system development processes and to use current security technologies. In addition, we engage third parties to actively monitor potential threats as well as our security defenses. The risk landscape is assessed to determine the likelihood and potential impact of identified risks. This assessment involves a combination of qualitative and quantitative analyses to help prioritize identified risks and determine the appropriate risk treatment. The effectiveness of the cybersecurity and information security program is tested through a combination of internal and external assessments. Updates are provided to senior management and the Audit and Compliance Committee for informed decision-making and are integrated into our broader enterprise risk management processes.


text: We also seek to oversee and identify potential cybersecurity and information security threats and risks relating to suppliers and third-party service providers. These efforts may include due diligence to assess the party's cybersecurity practices, controls, and compliance with relevant statutes and regulations; the use of contractual agreements that outline certain cybersecurity requirements; and using outside services to perform ongoing monitoring of select suppliers and third-party service providers. We also collaborate with select third-party suppliers to develop and align incident response plans.

stage1Category: Third-Party Risk


text: No risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cybersecurity threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cybersecurity risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.


text: The Company's Board of Directors (the Board) is responsible for overseeing the Company's risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology (NIST) and are included in the Company's overall risk management system and processes. In general, the Company seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company's information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: Aptevo Therapeutics Inc.

ticker: APVO


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Company has information security and risk management policies and procedures designed to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of incidents in a timely manner. • Technical Safeguards: The Company implements technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. Additionally, the Company leverages an industry standard Endpoint Detection and Response (EDR) tool to manage and monitor endpoint security for laptops and servers including scanning and monitoring of vulnerabilities. Further, the Company has mandated multi-factor authentication for all employees in addition to periodic security and phishing training and awareness.


text: In 2023, the Company engaged an independent assessor to assess the maturity of its cybersecurity program against the NIST Cybersecurity Framework (NIST CSF). The results of the NIST CSF maturity assessment laid the roadmap for the cyber initiatives conducted in 2023 and future. Further, a third-party conducted an external and internal penetration test, performed a dark web scan for any Aptevo private and confidential data and assessed Aptevo's cloud security configuration posture. All critical and high-risk findings from that assessment were addressed in 2023.


text: • Incident Response and Recovery Planning: The Company has established and maintains security incident response and disaster recovery plans designed to address the Company's response to a cybersecurity incident. • Third-Party Risk Management: The Company leverages third-party vendors to house critical clinical trial data. These vendors are required to be GxP compliant which entails strong cybersecurity controls that are validated by a third-party auditor. Furthermore, the Company has begun performing security risk assessments prior to on-boarding new significant vendors. • Education and Awareness: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: The Board has designated the Audit Committee as the governing committee for the oversight of the Company's material IT cybersecurity risks. The Audit Committee reviews cybersecurity risks through quarterly updates, and the committee monitors the status of ongoing projects to strengthen existing information security controls and practices and mitigate the potential risk of cybersecurity incidents. Quarterly, the Company's Chief Financial Officer (CFO), with support from the expert firm providing Chief Information Officer (CIO) services, presents on material cybersecurity risks and their accompanying mitigation and remediation strategies to the Audit Committee.


text: The CIO and CFO are key management roles responsible for assessing and managing material risks from cybersecurity threats. The CIO reports to the CFO and is responsible for implementing and maintaining the enterprise cybersecurity organization. The CIO has over 20 years of experience in Information Security and Cybersecurity for public and private institutions in the pharmaceutical, insurance, manufacturing, healthcare, and non-profit industries. The CFO also brings over 20 years of experience with a focus on small to mid-size public companies in the life science and technology fields.


text: The CIO, in coordination with senior management including the CFO, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. The CIO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Management is responsible for identifying, monitoring and mitigating the material risks facing the Company, including cybersecurity risks. The Board of Directors oversees management's processes related to those risks. The Audit Committee of the Board of Directors is responsible for overseeing the risks associated with information technology and cybersecurity threats, and reports on its activities to the full Board following each committee meeting.

companyName: GOODYEAR TIRE & RUBBER CO /OH/

ticker: GT


text: The Audit Committee exercises its risk oversight function by carefully evaluating information and cybersecurity reports they receive from management; assessing the priorities and roadmap of the cybersecurity program; and making inquiries of management with respect to areas of particular interest to the Board. Senior leadership, including our chief digital officer ("CDO") and our chief information security officer, periodically briefs the Audit Committee on our cybersecurity and information security programs and reviews relevant cybersecurity incidents.


text: Our global information technology organization, led by our CDO, is responsible for our overall information security strategy, policies, operations and threat detection and response. Our current CDO has more than two decades of experience in the automotive industry. The global information technology organization manages and maintains the cybersecurity program with the goal of preventing, detecting and remediating incidents, and works to increase our system resilience to minimize the business impact should an incident occur. Our cybersecurity program is informed by multiple, overlapping cybersecurity frameworks. These include the National Institute of Standards and Technology Cyber Security Framework (NIST-CSF); Cybersecurity Maturity Model Certification (CMMC); Control Objectives for Information and Related Technology (COBIT); International Organization for Standardization (ISO, specifically 27001); and Trusted Information Security Assessment Exchange (TISAX). Our cybersecurity program has achieved TISAX certification, or "labeling" for its demonstrated ability to identify, protect, detect, respond and recover from cyber risks. The "labeling" process requires independent, third-party auditors to test and confirm the controls we have implemented.


text: The program includes escalation and notification of potentially significant incidents to the Cybersecurity Disclosure Committee and the Audit Committee of the Board, as appropriate. Our Cybersecurity Disclosure Committee is comprised of senior leadership across multiple functional areas and is responsible for reviewing and evaluating potentially significant cybersecurity incidents and for determining whether any notification or disclosure is required under applicable laws, including the federal securities laws. In 2024, We have developed an AI Governance Council to address the cybersecurity, data privacy and data management of emerging technologies. The Council is a multidisciplinary group with representatives from the human resources, information technology, law, compliance and ethics, privacy, and research and development functions.


text: Third-party specialists are also incorporated into our approach to cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, cybersecurity maturity assessments or consulting on best practices to address current and new challenges. These evaluations include testing both the design and operational effectiveness of security controls.


text: We recognize a cybersecurity incident experienced by a supplier or joint venture partner could materially impact us. We assess third-party cybersecurity controls as part of our third-party IT risk due diligence and engage in cybersecurity consultant-led solution design reviews when integrating new tools or third parties. We contractually require third parties to report cybersecurity incidents to us so we can assess the impact of the incident and any necessary regulatory reporting obligations that may be required.


text: Notwithstanding our risk management efforts related to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material or other adverse effect on us. See Item 1A. "Risk Factors" for a discussion of our information technology and cybersecurity risks.


text: The Company's Board and management recognize the importance of maintaining the trust and confidence of our customers, clients, business partners and employees, and that effective risk oversight is critical in running a successful business and fulfilling its fiduciary responsibilities to the company and its shareholders. Our Board is responsible for assuring that an appropriate culture of risk management exists within the Company and for setting the right "tone at the top." The Board oversees an enterprise-wide approach to risk management, designed to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance and enhance shareholder value.

companyName: BADGER METER INC

ticker: BMI


text: A fundamental part of risk management is not only understanding the risks a company faces and what steps management is taking to manage those risks, but also understanding what level of risk is appropriate for the Company. The involvement of the full Board in setting the Company's business strategy is a key part of its assessment of management's tolerance for risk and also a determination of what constitutes an appropriate level of risk for the Company.


text: Refer to Part I, Item 1A. "Risk Factors" of this 2024 Annual Report on Form 10-K for further information about the Company's overall ERM process.


text: Risk Management and Strategy Cybersecurity is a critical component of the Company's ERM program. The Company has established an information security framework to help safeguard the confidentiality, integrity, and availability of information assets and ensure regulatory, operational, and contractual requirements are fulfilled. The Company's cybersecurity program is focused on the following key areas:


text: Governance: The Board provides oversight of the ERM process and reviews the significant identified risks. The Board's oversight of cybersecurity risk management is supported by the Audit and Compliance Committee, which regularly interacts with the Company's senior management, including the Director - Information Systems (i.e. the Company's chief information officer). The Company's various Board committees also play a role in risk management, as detailed in their respective charters.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the materiality, public disclosure and reporting of such incidents can be made by management in a timely manner. Senior leadership also briefs the Board on information security matters at least annually.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, such as machine learning intelligence platforms with an array of technologies, extensive encryption, firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. The frameworks used to guide the deployment of technical safeguards include: International Organization for Standardization (ISO) 27001, Service Organization Control 2 (SOC 2), Sarbanes Oxley (SOX), and National Institute of Standards and Technology (NIST). The Company has been ISO 27001 certified since 2015 and is externally audited and certified annually by a leading IT compliance attestation firm.


text: Incident Response Planning: The Company has established, maintains and regularly tests incident response plans that address the Company's overall preparedness and response to a cybersecurity incident. The plans include, among other steps, assessment processes to determine the magnitude and materiality of an incident, an analysis of the need and method to communicate to various constituencies (customers, employees, authorities, etc.), and the requirements for public and regulatory disclosure. In addition to this response planning framework, among other mitigating actions the Company maintains an insurance policy for cybersecurity liability that provides not only coverage for breaches, but also loss prevention services and claims advisors.


text: The Company's Board of Directors provides oversight of the Company's cybersecurity program through periodic updates, typically on a quarterly basis. Additionally, on an annual basis, cybersecurity risks are discussed as part of enterprise risk management.

companyName: NOV Inc.

ticker: NOV


text: Third Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third party systems. Third parties are granted access to systems based on the principle of least privilege.


text: Education and Awareness: The Company provides mandatory annual training for personnel regarding cybersecurity threats to educate employees with effective tools and knowledge to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. Quarterly internal phishing tests are performed, and periodic and/or thematic email communications are provided throughout the year to raise awareness. Individual training is given to personnel as needed.


text: The Board oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board receives annual cybersecurity updates from senior management, and the Audit and Compliance Committee provides a deeper level of oversight through an annual review of management's approach to cybersecurity risk with the Director – Information Systems. The Board and the Audit and Compliance Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: The Director – Information Systems, as head of cybersecurity and in coordination with management, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response plans. Management is actively involved in the incident response and risk management process (mitigation, transference, and acceptance). Additionally, Company management meets monthly as part of the cybersecurity steering committee to direct proper activities to mitigate any risks identified.


text: The SVP-CFO, VP-Controller and VP-General Counsel are explicitly informed by the Director of Information Systems, internal security team and Managed Security Service Provider (MSSP) of incidents and periodically updated on the investigation progress and impact of the incident. Management also receives explicit monthly summaries on all incidents. Material incidents are summarized at an annual management review meeting.


text: Internal IS Management has the following certifications: Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), GIAC/SANS Certified Forensic Examiner, Cloud Forensics and Incident Responder (GCFR), Certified Advanced Smartphone Forensics (GASF), Certified Cloud Security Professional (CCSP), Magnet Certified Forensic Examiner, BBA Information Technology Emphasis Security, and CompTIA Security+.


text: While the Company has experienced, and expects to continue to experience, cyber threats, no material security breaches of third-party information have occurred. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A "Risk Factors" under the heading "General," which should be read in conjunction with the foregoing information.


text: As part of the Company's enterprise risk management, we maintain a cyber risk program with established policies and procedures to detect, prevent, mitigate, and remediate cybersecurity incidents and related risks. The program is led by our Chief Information Security Officer ("CISO"), who has 30 years of experience in information security and is a Certified Information Systems Security Professional. Our CISO reports directly to our Chief Information Officer of Corporate IT, who has over 25 years of experience in all areas of information technology. Our cybersecurity team is comprised of experienced, educated, and certified professionals with decades of experience in cybersecurity leadership roles.


text: Our cyber risk management program is based on recognized industry practices and standards in cybersecurity and information technology. These standards include the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization for Standardization ("ISO") 27001. Security controls are managed using an information security management system ("ISMS"), providing a systematic approach consisting of people, processes, and technology. NOV's ISMS aims to minimize risk and ensure business continuity by proactively limiting the impact of security incidents.


text: Our cybersecurity incident response plan includes an escalation process to senior management, who evaluates various factors related to the cybersecurity incident to assess the impact on the Company and any required disclosures. If a cybersecurity incident was determined to be material by senior management, our Board of Directors would be promptly notified and the incident reported based on applicable legal requirements. Our processes also address cybersecurity risks associated with third-party service providers, including those in our supply chain or who have access to our data or systems. We evaluate third-party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. We conduct continuous vulnerability assessments and continuous penetration testing. Additionally, we undergo internal and external assessments of our processes to identify opportunities for improvement and reduce exposure to cybersecurity incidents.


text: We have not experienced any cybersecurity incidents that have had a material adverse effect on our business, financial condition, results of operations, or cash flows. Although we have not experienced any cybersecurity incidents that are individually, or in aggregate, material, we have experienced cyberattacks in the past, which we believe have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. We recognize the potential impact of cybersecurity risks on our business strategy, results of operations, and financial condition and take proactive measures to mitigate these risks. See Item 1A. "Risk Factors."


text: Cybersecurity Risk Management and Strategy As an externally managed closed-end management investment company that has elected to be regulated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our officers under the oversight of our Board of Trustees. Our officers are senior professionals of the Adviser and Sixth Street and each of the Adviser and Administrator is a subsidiary of Sixth Street. As such, we are reliant on Sixth Street for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Sixth Street has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Sixth Street Lending Partners


text: Sixth Street maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by us, from anticipated threats or hazards. Sixth Street utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software, among others.


text: Sixth Street tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Further, Sixth Street engages in cyber incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Tabletop exercises are conducted by Sixth Street's Technology Risk team in collaboration with outside service providers as appropriate and includes members of Sixth Street's senior management and Legal/ Compliance team. Learnings from these tabletop exercises and any events that Sixth Street experiences are reviewed, discussed, and incorporated into its cybersecurity framework as appropriate. In addition to Sixth Street's internal exercises to test aspects of its cybersecurity program, Sixth Street periodically engages independent third parties to assess the risks associated with its information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of Sixth Street's information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of the cybersecurity systems and processes.


text: Sixth Street has a comprehensive Security Incident Response Plan (the "IRP") designed to inform the proper escalation (including, as appropriate, to our officers and other representatives of the Adviser or its affiliates) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually.


text: Sixth Street maintains a cybersecurity risk management process to identify and mitigate risks that impact the firm. Sixth Street's Head of Technology Risk periodically discusses and reviews cybersecurity risks and related mitigants with Sixth Street's Cybersecurity Committee and incorporates relevant cybersecurity risk updates and metrics.


text: Sixth Street employs a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.


text: In the last three fiscal years, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats affect our business, and our reliance on the Sixth Street and its affiliates in managing these risks, see "Part 1. Item 1A. Risk Factors – Risk Related to our Business – Cybersecurity risks and cyber incidents may adversely affect our business or those of our portfolio companies by causing a disruption to our operations, a compromise or corruption of confidential information and/or damage to business relationships, or those of our portfolio companies, all of which could negatively impact our business, results of operations or financial condition" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Sixth Street has a dedicated cybersecurity team, led by its Head of Technology Risk, who works closely with Sixth Street's Cybersecurity Committee, to develop and advance the firm's cybersecurity strategy, which applies to us. Sixth Street's Cybersecurity Committee includes its Chief Operating Officer and Chief Information Officer, Chief Risk Officer, General Counsel, Chief Compliance Officer, as well as our Chief Financial Officer and Chief Compliance Officer.


text: The Head of Technology Risk has extensive experience in cybersecurity and technology and is responsible for all aspects of cybersecurity across Sixth Street. He has a B.S in Computer Science from University of Washington and has over 18 years of experience contributing to cybersecurity related workflows, processes, policies, system designs, program management, and vulnerability discovery, exploitation, mitigation, and remediation.


text: Sixth Street conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The Head of Technology Risk reviews the cybersecurity framework annually as well as on an event-driven basis as necessary. The Head of Technology Risk also reviews the scope of the cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Sixth Street's information and systems.


text: Our Board of Trustees is responsible for understanding the primary risks to our business, including any cybersecurity risks. The Board of Trustees/ is responsible for reviewing periodically our and the Adviser's information technology security controls and related compliance matters, with management. Sixth Street's Head of Technology Risk reports to the Board of Trustees at least annually on cybersecurity matters, including risks facing us and the Adviser and, as applicable, certain incidents. In addition to such periodic reports, the Board of Trustees may receive updates from management as to our and the Adviser's cybersecurity risks and Sixth Street cybersecurity program developments.


text: Cybersecurity is an integral part of the Board's risk analysis and discussions with management. At least annually, the full Board is updated on the Company's cybersecurity risks and risk mitigation strategy by our Vice President of Information Technology, who is responsible for management of our IT program. The Board also receives ad hoc updates, as needed, about material changes to the Company's cybersecurity program and/or the cybersecurity landscape, including briefings on major legislative and regulatory developments, from our Vice President of Information Technology and representatives from Legal and/or Risk Management, as applicable.

companyName: ACADIA REALTY TRUST

ticker: AKR


text: Our Vice President of Information Technology regularly evaluate the Company's cybersecurity risk profile and leads the development of strategies to mitigate risks and address cybersecurity issues that may arise, in consultation with members of our senior management and Risk Management teams. Our Vice President of Information Technology and Director of Risk Management each have approximately 25 years of experience, and holds certifications in cybersecurity from accredited information technology certification providers.


text: We have formal policies and procedures that address cybersecurity incident response and disaster recovery from interference with our critical applications. Our Cybersecurity Incident Response Plan provides a documented framework for responding to cybersecurity incidents in coordination across multiple departments. In the event of such an incident, our Cybersecurity Incident Response Team ("CIRT"), which is comprised of our Vice President of Information Technology and representatives from Risk Management, Legal and Financial Reporting, would respond to such incident in accordance with our Cybersecurity Incident Response Plan. Any cybersecurity incident that meets certain criteria will be communicated by the CIRT to senior management and the Board in a timely manner, and will be evaluated by our Executive Management Team, comprised of certain executives, to assess the impact of the incident on the Company, considering qualitative and quantitative factors. In conducting this assessment and responding to an incident, the CIRT and Executive Management Team may utilize the services of third-party consultants.


text: Cybersecurity user awareness training is mandatory for all new hires and for existing employees on an annual basis to help protect our employees and the Company against cybersecurity threats. This annual training is customized to address specific cybersecurity challenges and scenarios that we may face within the real estate investment industry. Novel cybersecurity threats to the Company that are identified by our IT team are communicated to all employees by email, as needed, in an effort to promote awareness and protect the Company from cyber attacks.


text: Risk Management and Strategy We maintain an Enterprise Risk Management ("ERM") program to identify and respond to the most critical risks to our business, including cybersecurity risks. Risks and vulnerabilities from our increased reliance on information technology systems are assessed at least annually as part of our ERM program. In response to such assessments, controls are embedded into our processes and technology by our Vice President of Information Technology to seek to mitigate risks to our systems and processes from cybersecurity incidents. We continuously evaluate if we have adequate controls in place utilizing a risk-based approach that aligns with the National Institute of Standards and Technology Cybersecurity Framework.


text: Our daily operations are monitored by a dedicated IT team. We conduct monitoring of our computer networks, and have implemented systems and processes intended to secure our information technology systems and prevent unauthorized access to or loss of sensitive data, including through the use of encryption and authentication technologies. We assess the adequacy of our cybersecurity measures through annual penetration testing of our computer networks by external consultants, and we have performed tabletop simulations and drills at both a technical and management level around scenarios involving the loss of critical information and technology systems.


text: We maintain a risk-based approach to evaluating and overseeing cybersecurity risks presented by our third-party vendors. Third-party vendors that meet certain criteria, such as owning and operating any information technology networks and systems on which the Company relies, are evaluated to assess their performance across several domains, including data security and operations management. We seek to maintain effective communication with our third-party vendors to facilitate timely notification of cybersecurity incidents that might impact the Company.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from time to time, experience threats and security incidents related to our and our third-party vendors' information systems. For more information, please see Item 1A. Risk Factors - Increased IT security threats and more sophisticated computer crime could pose a risk to our systems, networks, and services.


text: Cybersecurity Governance and Risk Management Information security is a significant operational risk for financial institutions such as Radian and includes the risk of loss resulting from cyberattacks.

companyName: RADIAN GROUP INC

ticker: RDN


text: To help mitigate this risk, Radian has designed and maintains an Information Security Program that is intended to protect our corporate data as well as data entrusted to us by our customers and partners. The Information Security Program is built on a risk-based approach that identifies and prioritizes cyber threats based on their potential impact on our strategy, operations, and assets. This program is aligned with our enterprise risk management program, extends across business lines and encompasses written policies on cybersecurity.


text: The Company has assigned executive ownership of and accountability for the Information Security Program to the Chief Information Security Officer, who leads a dedicated team of trained staff to protect the confidentiality, integrity and availability of information assets. Our Chief Information Security Officer has over 20 years of diverse industry experience, including serving in similar roles overseeing cybersecurity programs, as well as serving in numerous board and advisory capacities. Several members of the Information Security team hold advanced degrees as well as industry-recognized certifications in cybersecurity and related disciplines. The Information Security Program also utilizes third-party managed security services where appropriate.


text: Our Information Security Program utilizes multiple layers of security controls that are intended to protect information assets and operations. As a guideline to manage our cybersecurity-related risk, we use the National Institute of Standards and Technology Cybersecurity Framework, which outlines information security measures and controls over five functions: Identify, Protect, Detect, Respond and Recover. This does not imply that we meet any particular technical standards, specifications, or requirements. Our risk management process is designed for the purpose of identifying, assessing and mitigating potential threats and uncertainties that may impact the achievement of our business objectives. This process involves engaging relevant stakeholders, conducting regular risk assessments, and staying informed about industry-specific risks and market trends. Identified risks are evaluated based on their potential impact and likelihood of occurrence.


text: As a Company, we have developed key security services, including data governance, encryption, vulnerability management, systems and network monitoring, access controls, application security, threat detection, incident response, employee awareness training and assessment of our third-party service providers. We regularly test our incident response readiness and reporting through tabletop exercises, external and internal penetration testing and internal security testing so that identified risks and incidents are escalated and communicated for appropriate remediation activities that are intended to reduce risks to an acceptable level.


text: Our board of directors has ultimate oversight of cybersecurity risk, which it manages in coordination with the Risk Committee of our board of directors as part of our enterprise risk management program. The Risk Committee regularly reviews the Company's enterprise risk management program and Information Security Program with management and reports to the board of directors. The Chief Information Security Officer reports directly to our Chief Digital Officer and presents at least annually to the Company's full board of directors about the overall effectiveness of the Information Security Program, as well as quarterly to the Risk Committee. Radian's board of directors approves the written Information Security Policy and Information Security Program documents annually. Collectively, these documents describe the structure, scope, organization and requirements of the Information Security Program, as well as the responsibility and authority of the Chief Information Security Officer.


text: To further maintain governance and oversight over the Information Security Program, we have established an Information Security Council and Executive Information Security Committee composed of our Chief Information Security Officer and colleagues with experience, education and ongoing training in information security, cybersecurity risk and information governance. In addition, our Chief Executive Officer receives regular updates from the Chief Information Security Officer, reviews reports of key developments involving our Information Security Program and meets with our Information Security team at least quarterly to review the readiness and effectiveness of our program. We also utilize both internal and external auditors to provide independent assessments of our Information Security Program. Cybersecurity incidents are reviewed at least quarterly by management, the appropriate executive committees and the board of directors or its committees.


text: While the Information Security Program is reasonably designed to mitigate the risk of cybersecurity events, we cannot provide assurance that we will not be subject to a cybersecurity event. In "Item 1A. Risk Factors," see "We could incur significant liability or reputational harm if the security of our information technology systems, or of our third-party vendors or service providers, is breached, including as result of a cyberattack, or we otherwise fail to protect confidential information, including personally identifiable information that we maintain."


text: Due to our reliance on digital technology and electronic communications to run our business, cybersecurity threats and incidents pose an ongoing and escalating risk to our internal and third-party provided information systems and data, reputation and shareholder value, results of operations and financial condition. Our Chief Technology Officer, who reports directly to our Chief Executive Officer, holds over 25 years of experience in information technology, specifically infrastructure, information security and fraud, and identity solutions at large global companies, and our Vice President of Information Technology ("IT") Governance, who reports to our Chief Technology Officer, holds over 20 years of experience in various information security roles. Together, our Chief Technology Officer and Vice President of IT Governance ("IT leadership") oversee and lead our information security program and our business strategy, financial planning and capital allocation around our cybersecurity risk management and governance practices. We also have an established Incident Response Team ("IRT") to respond to and manage cybersecurity events. This team includes our IT leadership as well as senior leadership from our accounting, legal, corporate communications and risk management departments with subject-matter expertise and established tenure at Prologis in their respective areas. The IRT is tasked with taking appropriate action to safeguard the integrity of our information systems, data and network resources, investigate whether a breach occurred, define disclosures, communicate effectively with key audiences, including the Board as necessary, mitigate cybersecurity incident risks and provide a resolution through our cybersecurity incident communication protocols. Additionally, on an annual basis the IRT is involved and engaged in security initiatives, including tabletop exercises facilitated both internally and externally, to stay relevant on current practices in the areas of cybersecurity.

companyName: Prologis, Inc.

ticker: PLD


text: The processes implemented by our IT leadership and IRT to oversee and identify cybersecurity risks are based on the Prologis Information Security Policy governed by the United States National Institute of Standards and Technology Cybersecurity Framework. The framework focuses on five key categories of cybersecurity risk management and governance: (i) identify: develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data and capabilities; (ii) protect: develop and implement appropriate safeguards to ensure delivery of critical services; (iii) detect: develop and implement appropriate activities to identify the occurrence of a cybersecurity event; (iv) respond: develop and implement appropriate activities to take actions regarding a detected cybersecurity incident; and (v) recover: develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or service that were impaired due to a cybersecurity incident. This framework is utilized within our organization as part of an integrated risk management program that involves participation from employees, to our Board and third-party service providers, with whom we have protocols in place to mitigate cybersecurity incident risks within our supply chain through the products and services we provide and use. Additionally, all employees and contractors are required to attend mandatory cybersecurity training on an annual basis.


text: Our IT leadership reports to the Board on an annual basis on cybersecurity matters and, as necessary, when incidents arise in accordance with our cybersecurity incident communication protocols. Our Board, specifically our Audit Committee, oversees cybersecurity risks and we believe contains the necessary expertise to perform those duties, including specific industry experience within information technology. Additionally, Prologis' cybersecurity risk management practices are reviewed and benchmarked against its peers through regular participation in a third-party security benchmarking survey. Our IT infrastructure is externally audited as part of our Sarbanes-Oxley audit process and our controls include information security standards. We also maintain standalone cybersecurity insurance and strive to adhere to local cybersecurity regulations in all the countries we do business. We believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and are not reasonably likely to materially affect Prologis, including its business strategy, results of operations or financial condition. Please refer to "Our business and operations could suffer in the event of system failures or cybersecurity attacks" under Item 1A. Risk Factors.


text: Risk Management and Strategy We have developed an information security program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our information security program is managed by our SVP, Chief Security Officer ("CSO"), whose team (the "CSO Office") is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, technologies, and processes. Our CSO's primary responsibility includes assessing, monitoring, and managing our cybersecurity risks. Her background includes extensive experience as an enterprise CSO, with over 24 years of experience in the field of cybersecurity. In partnership with our Chief Information Officer ("CIO") who leads our Governance Risk and Compliance ("GRC") function, the CSO Office oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee security training program.

companyName: JFrog Ltd

ticker: FROG


text: The CSO Office implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and advanced compliance systems to identify and mitigate potential vulnerabilities. The CSO Office collaborates closely with key departments within the Company, including the office of our Chief Technology Officer ("CTO"), Engineering, IT, DevOps, Support, and Production, to implement our Vulnerability Management Remediation Plan. This collaboration is aligned with industry standards of the Software Development Life Cycle, underscoring our commitment to maintaining robust security protocols across all phases of our operations.


text: Our cybersecurity program leverages people, processes, and technology to identify and respond to cybersecurity threats. We have a global incident response capability supported by our Security Operations Center (which we refer to as SOC) team, a managed security service provider (MSSP) and our global Cybersecurity Incident Response Team (which we refer to as CSIRT), which provides threat detection and incident response.

companyName: Arthur J. Gallagher & Co.

ticker: AJG


text: We have developed and maintain a robust cybersecurity incident response plan. JFrog's cybersecurity incident response team has a comprehensive strategy and policies in place for managing security incidents. Along with swift threat classification, containment, and eradication, the strategy includes notification procedures to promptly inform and support stakeholders in accordance with applicable data breach notification laws. Incident analysis is carried out to understand root causes and drive continuous improvement.


text: Our information security controls and practices are certified against globally recognized standards: ISO 27001, ISO 27701, ISO 27017, SOC 2 Type II, CSA start level 1, TISAX and KY3P by S&P Global. We are also aligned to cybersecurity practices and controls recommended by the National Institute of Standards and Technology ("NIST"), part of the U.S. Department of Commerce.


text: Our third-party vendor risk management program addresses third party vendors with access to our systems or data, or who process data on our behalf, and includes a risk-based approach and security assessments throughout the third-party life-cycle, from onboarding to termination, as well as through contractual controls and technological controls to monitor the vendors' posture. This program is designed to oversee and identify risks from cybersecurity threats associated with its use of third-party service providers.


text: Training and Awareness Our employees undertake cybersecurity and data privacy training during onboarding. The majority of our employees complete annual refresher modules. JFrog also maintains a secure-code training program for developers and quarterly phishing simulation to improve our employees' awareness. Any employee who does not meet our performance expectations in such simulations is required to undergo additional training.


text: Engagement with Third-Parties on Risk Management Given the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, helping our cybersecurity strategies and processes remain consistent with applicable generally adopted industry best practices. Our collaborations with these third parties include: • regular audits, threat assessments and penetration testing; • consultation on security enhancements; • bug bounty program for identifying security weaknesses in our products and services; • designing partnership with third party vendors; • using our in-house security tools as customers; and • global incident response experts for potential critical cybersecurity events.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For more detailed information about the cybersecurity risks we face, please see Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including Risks Related to Privacy, Data Protection and Cybersecurity: "A breach of our security measures or unauthorized access to proprietary and confidential data, or a perception that any security breach or other incident has occurred, may result in our platform or products being perceived as not secure, lower customer use or stoppage of use of our products, and significant liabilities."


text: Our Board of Directors considers cybersecurity as part of its overall risk oversight function and believes it has established robust oversight mechanisms to support effective governance in managing risks associated with cybersecurity threats. All of our Board members have experience in the technology industry and our CTO, Yoav Landman, is a member of our Board. Data protection under their guidance and oversight remains a strategic priority at the highest levels of our organization. The Board has delegated to the Audit Committee the responsibility to oversee the information security program (see below) and is also updated regularly regarding matters discussed with the Audit Committee.


text: The Audit Committee is responsible for oversight of our information security program and receives reports at least quarterly from executive management, including the CSO, CTO, and CIO, concerning cybersecurity matters. The Audit Committee's charter directs that the committee oversee and periodically review the Company's risks related to privacy, cybersecurity, and information and technology security, including: • discussing with management the Company's plans to mitigate cybersecurity risks and response to data breaches; • reviewing any reports from management on data breaches, and • overseeing the disclosure of any significant risks and incidents to the extent required by applicable law, including SEC rules and regulations.


text: Our CSO, who reports directly to our CTO, works closely with our CIO who reports directly to our Chief Executive Officer. Over the past two decades, our CIO has held various positions in information technology and information security, including as CIO in two public companies, managing and controlling cybersecurity long-term programs and risks. Both our CTO, who is a co-founder of JFrog and is also a member of our Board, and our CSO have extensive experience assessing and managing cybersecurity programs and cybersecurity risks, and they work closely to define the initiatives of our cybersecurity program, the CSO organization structure and cyber business continuity plan planning. Our CTO is updated regularly on the status of our cybersecurity program. This allows us to address emerging threats and make informed decisions in real-time and to protect our systems on a timely basis.


text: Finally, our VP of Internal Audit leads an annual internal audit plan which includes a cybersecurity, privacy, or information technology security component. Internal audit findings are reported to the Audit Committee on a quarterly basis.


text: Cybersecurity Risk Management and Strategy The Company employs a tiered structure of management and oversight for cybersecurity, characterized by distinct layers of responsibility and decision making, which includes operation staff, management, and senior management and board-level governance. As discussed in more detail below under "Cybersecurity Governance," this involves management responsibility through a specialized Cyber Risk Committee (the "CRC") and oversight of that committee by a group of the most senior leaders of the Company, which comprise the Company's Executive Committee. At the Company's Board of Directors (the "Board") level, the Audit Committee oversees our cybersecurity risk management program.

companyName: REGENCY CENTERS LP


text: Our strategy for managing cybersecurity risk is integrated into the Company's overall risk management program and structure, as depicted in the Corporate Governance section of our Proxy under "Risk Oversight."


text: The Company, through its Chief Information Security Officer ("CISO"), other Company employees experienced in information network security, and the use of third-party expertise, references various recognized cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework. These frameworks are used to benchmark and tailor the Company's cybersecurity strategies and program to our risk profile and specific operational needs and goals. Our core cybersecurity strategy focuses on five key pillars: identification, protection, detection, response, and recovery, each tailored to meet the specific challenges and needs of our business. The primary goal of this strategy is to proactively safeguard the confidentiality, security, and availability of the information we collect and store. This proactive approach includes attempts to identify, prevent, and mitigate cybersecurity threats, as well as preparing to quickly respond to cybersecurity incidents to minimize their impact. Under the leadership of our CISO and CRC, we regularly evaluate and enhance our cybersecurity practices to facilitate adaptation to the constantly evolving landscape of cybersecurity threats.


text: We have adopted a risk-based strategy to manage cybersecurity risks associated with third parties. We prioritize our cybersecurity efforts relating to third parties based on the likelihood and potential impact of cybersecurity threats. This includes reviewing the security protocols of key vendors, service providers, and external users of our systems.


text: The CRC engages third-party expertise from time to time as it deems necessary or appropriate to test our cybersecurity defenses, to evaluate the cybersecurity programs of current and potential vendors and service providers, and to seek specialized legal advice regarding cybersecurity.


text: Since at least January 1, 2022, we are not aware of any cybersecurity incidents that have materially affected the Company. Based on our current understanding of the cyber risk environment and our preparedness level, we do not believe it to be reasonably likely in the near term that a cybersecurity threat will materially impact our business strategy, results of operations or financial condition. Nonetheless, we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – The unauthorized access, use, theft or destruction of tenant or employee personal, financial or other data, or of Regency's proprietary or confidential information stored in our information systems or by third parties on our behalf, could impact operations, and expose us to potential liabilities and material adverse financial impact."


text: Cybersecurity Governance The Audit Committee of the Board is charged with overseeing our cybersecurity risk management program. The CRC Chair and the CISO provide the Audit Committee with regular updates. These updates cover the overall status of the Company's cybersecurity program, as well as developments and potential new risks and trends. In the event of a significant cybersecurity threat or incident, the CRC would escalate communication frequency and intensity with the Audit Committee, Board, and the Company's Executive Committee (discussed below).


text: As designated by the Company's Executive Committee and the Audit Committee, our CRC leads Regency's cybersecurity risk management program. This includes risk identification, assessment, management, prevention and mitigation, as well as securing necessary resources and reporting on cybersecurity preparedness to the Executive Committee (which is currently comprised of the CEO, CFO, and several of the Company's other senior leaders) and the Audit Committee.


text: CRC membership, which is subject to change from time to time, includes management leadership possessing a diverse range of education, experience and expertise, and is currently comprised of Company's CISO, chief accounting officer, head of internal audit, general counsel and chief compliance officer, head of litigation, head of human resources, head of IT operations and the manager of network security. The collective experience of this committee encompasses areas such as IT, network security, change and incident management, public company governance, accounting, financial controls, insurance, risk management, communications, human capital, and legal matters including securities, privacy and technology contracting.


text: Our Director and VP of IT oversee and manage the Company's cybersecurity risk monitoring and mitigation processes and regularly collaborate with other departments, including business units and the information technology department, as necessary, to facilitate the risk monitoring and mitigation processes and to ensure the policies and procedures for our information security program are integrated into our overall risk management assessment. The information security team performs a bi-annual third-party assessment using industry standard frameworks of our information security program. Results are shared with the Company's management and with the Board of Directors.

companyName: DIODES INC /DEL/

ticker: DIOD


text: Cybersecurity risk oversight continues to remain a top priority for the Board of Directors. The Board of Directors is responsible for oversight of the Company's information security program, including risks of cybersecurity threats. The Risk Oversight Committee and Audit Committee, which support the Board of Directors in the oversight of the Company's information security program are focused on risks from cybersecurity threats, including incident response planning, timely identification and assessment of incidents, incident recovery, and business continuity considerations. The Risk Oversight Committee members have varied expertise and experience including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. The Risk Oversight Committee has delegated day-to-day oversight of our information security program to our executive officers, including the Vice President of Information Technology ("VP of IT") along with our Global Cybersecurity Director ("Director"). The Director reports to the VP of IT and is a 31-year veteran of the information technology industry having served in the military and with a Fortune 500 company with over 20 years of cybersecurity experience including leading incident responses, policy development, and building security architectures. The VP of IT and the Director regularly meet with our President and Chief Financial Officer to inform them of matters related to cybersecurity risks and incidents. These meetings are designed to ensure that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant known cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that the Board of Directors has oversight and can provide guidance on critical cybersecurity issues. We believe our information security team is well positioned to identify risks from cybersecurity threats based on numerous job qualifications and on-going training.


text: Our incident response team, headed by the Director and VP of IT, reports material cybersecurity incidents to our executive officers and to our Board of Directors. The Company has an information security advisory board comprised of senior leaders within the Company. These senior leaders include representation from functions including product line, sales and marketing, manufacturing, legal, finance, human resources, supply chain, information technology, and regional representation. Responsibilities of the advisory board include: • advise on creation and implementation of information security policy; • advise on information security strategic roadmap and investments; • review, advise, and promote security education, training, and awareness; • review and advise on ongoing legal, regulatory, compliance, threat landscape, risks, industry news, and trends concerning cyber security; and • review and advise on the mitigation of cybersecurity risks and potential incidents.


text: The Company has internal disclosure committees made up of members of management to assist in fulfilling its obligations to maintain disclosure controls and procedures and to coordinate and oversee the process of preparing our periodic securities filings with the SEC. The disclosure committees are composed of members of management and is chaired by our Vice President and Corporate Controller. The disclosure committees meet on a quarterly basis and more often if necessary. The Company has policies and procedures in place to ensure that our disclosure committees are appropriately informed of any matters that should be considered in advance of applicable public filings, including cybersecurity and data privacy matters, and to address the proper handling and escalation of information to management and the Board of Directors, the Risk Oversight Committee, and/or the Audit Committee.


text: Management provides cybersecurity-related legal, regulatory, compliance, risk, and relevant industry and internal threat updates to the Board of Directors on a quarterly basis, or more frequently as needed. The reports provide information regarding the state of the Company's information security program, the nature, timing, and extent of cybersecurity incidents, if any, and the Company's resolution to such matters.


text: The VP of IT has a monthly meeting with the Company's President to provide an update of cybersecurity incidents and risks, irrespective of materiality. The Company's Board of Directors is provided a quarterly update on cybersecurity roadmaps and progress.


text: Risk Management and Strategy The Company has a robust cybersecurity program that has direct involvement from the Board of Directors and senior management. Our business operations and relationships with customers and suppliers are heavily reliant on technology, and any failure or disruption in our technological systems could have significant negative impacts on our business.


text: Protecting information, including information of our customers, is a top priority. To assess, identify, and manage the risks of cybersecurity threats to our information systems and the associated costs, we maintain a cybersecurity program that: • defines cybersecurity risks that threaten the security of customer and employee data or the function of our products and services; • identify security vulnerabilities across software and hardware environments; • determine threat likelihood and potential severity of each risk; • catalog information assets to include hardware, software, and types of data the Company collects, stores, and transmits, as well as the locations where the data is stored; • assess the risk to business operations and information protection; • analyze the risk and prioritize based on financial, operational, strategic, reputational impact, and probability of occurrence; • establish security controls to eliminate or mitigate identified risks; • monitor and periodically review security controls; and • collaborate with HR for employee awareness and training.