text: presently do not have any substantial activities that require cybersecurity strategies; however the following will be adopted once we begin operations: recognize that cybersecurity risks pose a significant threat to the confidentiality, integrity and availability of our information systems, and to our ability to execute on our business strategy and protect stakeholder interests. Our approach to cybersecurity is anchored in formal policies, robust controls, ongoing risk assessment and clear governance structures.

companyName: ALEXANDER TECH CORP


text: cybersecurity program is designed to align with industry's best practices, including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). Key elements include: Regular risk assessments and vulnerability scans across our network and cloud environments. Formal policies covering access control, data protection, encryption, system configuration and change management. Tiered security controls (e.g., firewalls, endpoint protection, multi-factor authentication) to guard against unauthorized access.

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: Security awareness training for all personnel, with annual refreshers and real-time phishing simulations; and Third-party vendor assessments to ensure service providers meet our cybersecurity requirements. Response, Monitoring and Detection maintain a documented incident response plan detailing roles, responsibilities, communication protocols and escalation paths. We deployed continuous monitoring tools and log-management platforms to detect anomalous activity;


text: We conducted at least two tabletop exercises simulating a breach scenario and tested our response readiness; and We established notification procedures to comply with applicable laws and to inform affected stakeholders promptly in the event of an incident.


text: Risks and Outlook we have not experienced any material cybersecurity incidents during the fiscal year ended April 30, 2025, we acknowledge that evolving threats such as ransomware, social-engineering attacks and supply-chain vulnerabilities could materially disrupt our operations or expose sensitive information. We continue to: Invest in strengthening endpoint and network defenses;

stage1Category: Strategy Integration


text: Enhance logging, detection and response capabilities; and Revisit our risk assessments and incident response playbooks to address emerging threat vectors.


text: believe our cybersecurity governance, risk management processes and incident response program provide a strong foundation for managing risks, but no cybersecurity program can eliminate all risks entirely. We will continue to evolve our defenses in line with industry developments and regulatory expectations.

stage1Category: None/Other

stage1Method: majority


text: risk management is integrated into the Company's enterprise-wide risk management. Our Board has overall oversight responsibility for our risk management and management is responsible for identifying, considering, and assessing material risks to the Company.

companyName: NIOCORP DEVELOPMENTS LTD

ticker: NB


text: Our Chief Financial Officer is responsible for assessing and managing cybersecurity risks; however, as a smaller reporting company, we currently do not have a dedicated cybersecurity team. Our Chief Financial Officer reports to the Board regarding financial and operating risks, including cybersecurity risks. Our Chief Financial Officer has experience in managing public companies and assessing financial and operating risks.


text: cybersecurity risk management is designed to provide a framework for assessing, identifying, and managing material risks from cybersecurity threats and to respond to cybersecurity incidents, including material risks associated with the use of services provided by third-party service providers. We rely on the cybersecurity protections of many of our third-party service providers.


text: Our primary third-party service providers utilize two-factor authentication as well as login and password protections with email are in the process of evaluating our cybersecurity needs and developing appropriate measures to enhance our cybersecurity posture.


text: Our goal is to establish a cybersecurity framework that is commensurate with our size, complexity, and nature of our operations.


text: the year ended June 30, 2025, the Company had no material cybersecurity incidents or threats that have materially affected or were reasonably likely to materially affect our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident. As previously disclosed, on February 14, 2025, we became aware of unauthorized third-party access to our information systems, including portions of its email systems, that resulted in misdirected vendor payments. To date, the Cybersecurity Incident has not had a material impact on our business operations or financial condition.

stage1Category: Incident Disclosure


text: Cybersecurity Risk Management Strategy We have implemented and invested in, and will continue to implement and invest in, controls, procedures and protections (including internal and external personnel) that are designed to protect our systems, identify and remediate on a regular basis vulnerabilities in our systems and related infrastructure and monitor and mitigate the risk of data loss and other cybersecurity threats. We have engaged third-party consultants to conduct penetration testing and risk assessments. Our cybersecurity program is informed by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and measured by the Maturity and Risk Assessment Ratings associated with the NIST Cybersecurity Framework and the Capability Maturity Model Integration.

companyName: Diamondback Energy, Inc.

ticker: FANG


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, train or otherwise assist with aspects of our security controls; • security tools deployed in the IT environment for protection against and monitoring for suspicious activity; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • cybersecurity tabletop exercises for members of our cybersecurity incident response team and legal department; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: Cybersecurity Governance Our cybersecurity governance program is led by the Vice President and Chief Information Officer, with support from the internal information technology department. The Vice President and Chief Information Officer has over 20 years of technological leadership experience in the oil and gas industry, providing oversight of all information technology disciplines, including cybersecurity, networking, infrastructure, applications, and data management and protection. The Vice President and Chief Information Officer and his team, which consists of individuals who hold designations as Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), CompTIASecurity+, and Department of Defense (DoD)-Cybersecurity General, are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. In addition, our cybersecurity incident response team is responsible for responding to cybersecurity incidents in accordance with our Computer Security Incident Response Plan. Progress and developments in our cybersecurity governance program are communicated to members of the executive team. The audit committee of the board of directors receives quarterly updates on the status of our cybersecurity governance program, including as related to new or developing initiatives and any security incidents that may occur. Board members receive presentations on cybersecurity topics from the Vice President and Chief Information Officer as part of the board's continuing education on topics that impact public companies. Further, our code of business conduct and ethics expects all employees to safeguard our electronic communications systems and related technologies from theft, fraud, unauthorized access, alteration or other damage and requires them to report any cyberattacks or incidents, improper access or theft to our Chief Legal and Administrative Officer and the Vice President and Chief Information Officer. Our cybersecurity governance program also includes processes to assess cybersecurity risks related to third-party vendors and suppliers.

stage1Category: Management Role


text: Risks from cybersecurity threats have not materially affected, and are not currently anticipated to materially affect, our Company, including our business strategy, results of operations or financial condition. See, however, Item 1A. Risk Factors of this report for additional information regarding cybersecurity risks we face and their potential impact on our business strategy, results of operations and financial condition.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT and operational technology, or OT, environments; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, train or otherwise assist with aspects of our security controls; • security tools deployed in the IT and OT environments for protection against and monitoring for suspicious activity; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • cybersecurity tabletop exercises for members of our cybersecurity incident response team and legal department; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.


text: Cybersecurity Governance Our cybersecurity governance program is led by the Senior Vice President and Chief Information Officer, with support from the internal information technology department. The Senior Vice President and Chief Information Officer has over 20 years of technological leadership experience in the oil and gas industry, providing oversight of all information technology disciplines, including cybersecurity, networking, infrastructure, applications, and data management and protection. The Senior Vice President and Chief Information Officer and his team, which consists of individuals who hold designations as Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), CompTIASecurity+, and Department of Defense (DoD)-Cybersecurity General, are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. In addition, our cybersecurity incident response team is responsible for responding to cybersecurity incidents in accordance with our Computer Security Incident Response Plan. Progress and developments in our cybersecurity governance program are communicated to members of the executive team. Our management team takes steps to remain informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including third-party consultants engaged by us; and alerts and reports produced by security tools deployed in our IT and OT environments. While our board of directors is ultimately responsible for enterprise-wide risk oversight, the board's committees assist the board in fulfilling its oversight responsibilities in certain areas of risk. In particular, the board's audit committee is responsible, among other things, for risk management relating to legal and regulatory requirements, including cybersecurity, which plays an integral role in our risk management strategy and continues to be an area of increasing focus for our board, the audit committee and our management team.


text: The audit committee of the board of directors receives quarterly updates on the status of our cybersecurity governance program, including as related to new or developing initiatives and any security incidents that may occur. Board members receive presentations on cybersecurity topics from the Senior Vice President and Chief Information Officer as part of the board's continuing education on topics that impact public companies. Further, our code of business conduct and ethics expects all employees to safeguard our electronic communications systems and related technologies from theft, fraud, unauthorized access, alteration or other damage and requires them to report any cyberattacks or incidents, improper access or theft to our Chief Legal and Administrative Officer and the Senior Vice President and Chief Information Officer. Our cybersecurity governance program also includes processes to assess cybersecurity risks related to third-party service providers, suppliers and vendors. Our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments and conducting periodic reassessments during their engagement.

stage1Category: Board Governance


text: Risk Management and Strategy Our enterprise risk management program is designed to identify, measure, monitor and control significant risks across various aspects of the Company. Cybersecurity risk management processes are integrated into this program, given the increasing reliance on technology and potential of cyber threats. The cybersecurity risk management program contains eleven key elements: Information Security Policies, Strategic Planning, Risk Assessment, Audit and Examination, Business Continuity Planning, Incident Response Planning, Third-Party Due Diligence, Cyber Insurance Coverage, Employee Training and Testing, Patch and Vulnerability Management, and the Federal Financial Institutions Examination Council ("FFIEC") Cyber Assessment Tool ("CAT").

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: The Company is committed to protecting the information of clients, employees, and stakeholders from both conventional and cyber threats. This commitment is upheld through the implementation of our comprehensive Information Security Program ("ISP"), designed to ensure the confidentiality, integrity, and availability of critical information technology ("IT") systems and data.


text: The Information Security Governance Committee ("ISGC"), appointed by the Board, bears the responsibility for cybersecurity risk management and strategy. It aids the Board in fulfilling its oversight duties related to IT security, aligning with the Bank's business strategy, and adhering to regulatory requirements. The Virtual Chief Information Security Officer ("vCISO"), who is also appointed by the Board, oversees the ISP and coordinates the ISGC.


text: The ISGC's responsibilities encompass: • Review and approval of the ISP-related documents, including policies, strategies, plans and risk assessments; • Monitoring of control statuses and program gaps, including findings from audit reports and assessments; • Participation in program assessments, such as risk and business impact assessments; • Providing input on mitigation of current issues and threats; • Reporting, at least quarterly, to the Enterprise Risk Management Committee on ISGC activities and risk impacts on the Risk Appetite Statement. • Reporting, at least annually, to the Board on the status of the ISP, covering compliance, risk management, vendor management, audit and testing results, breaches and incidents, and recommended updates to the ISP.


text: The Company's approach to managing cybersecurity risks is shaped by insights from the FFIEC CAT, a tool designed for assessing and improving cybersecurity practices. This tool undergoes a thorough examination by an independent third-party on an annual basis to ensure an unbiased and comprehensive evaluation. In its most recent assessment in 2023, the FFIEC CAT identified that the Company is operating at an acceptable level of cyber maturity. This means the bank is effectively handling the inherent risks it faces in five critical areas: cyber risk management and oversight, collaboration on threat intelligence, implementation of cybersecurity controls, management of external dependencies, and resilience in handling cyber incidents.


text: To stay ahead of potential cybersecurity challenges, the Company has established a formal process. This process is activated whenever the FFIEC CAT or the ISGC identifies changes in inherent risks. In response, the Company proactively updates its cybersecurity objectives, policies, and tactical goals. This ensures that the Company's cybersecurity strategy remains responsive, continuously adapting to emerging threats and evolving industry standards.


text: Acknowledging the crucial role of third-party service providers, the Board-approved Vendor Management Policy, coupled with the ISP, guides the identification and management of risks posed by critical vendors. A third-party risk assessment, based on due diligence criteria and identified controls, is conducted regularly to assess inherent and residual risks. Contractual requirements ensure that providers maintain information security controls, providing reasonable assurance of data confidentiality, integrity, and availability. Third-party access is inventoried and monitored, with management reporting to the Board annually on the status and overall effectiveness of the Vendor Management Program.

stage1Category: Third-Party Risk


text: In the ordinary course of business, we rely heavily on electronic communications and information systems to conduct our operations and to store sensitive data. We employ a layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. A variety of preventive and detective tools are used to monitor, block, and alert us to suspicious activity, including potential advanced persistent threats. Despite our defenses, the severity and sophistication of cyber-attacks are on the rise. Attackers adapt quickly to changes in defense measures. While we have not identified significant compromises, substantial data losses, or major financial setbacks from cybersecurity attacks so far, our systems, along with those of our clients and service providers, face constant threats. There is no guarantee that our cybersecurity risk management program will completely safeguard the confidentiality, integrity, and availability of our information systems and solutions. Cybersecurity risks are anticipated to stay elevated due to the evolving nature of threats and the increased use of online and mobile banking services. See "Risks Related to Cybersecurity, Data and Fraud" under "Item 1A. Risk Factors" in this Form 10-K for a further discussion of risks related to cybersecurity.


text: The Board of Directors is responsible for the development, implementation, and maintenance of the ISP. Specifically, the Board is oversees: • Continuous administration of the ISP; • Perform an annual review and approval of the ISP policies; • Assignment of critical roles, including the vCISO; and • Review of reports provided by the ISGC at least annually.


text: Adherence to the ISP is of utmost importance, and any exceptions to policy must be recommended by the ISGC, approved by the Enterprise Risk Management Committee, and reported to the Board at least annually.


text: As previously stated, the ISGC, appointed by the Board, bears the responsibility for cybersecurity risk management and strategy. The vCISO oversees the ISP and coordinate with the ISGC. The ISGC includes key personnel including the vCISO, Chief Operating Officer, Technology Services Director, Information Technology Manager, Internal Audit Manager, Compliance Manager, and Information Security Specialists. The ISGC members bring diverse qualifications, certifications, and extensive experience to the table. This collective expertise ensures a comprehensive and well-rounded approach to our information security initiatives.


text: Our vCISO has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management and is accountable for managing our enterprise information security department and developing and implementing our information security program. The responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, client, vendor and employee education and awareness, and business continuity and disaster recovery. The ISGC, as a whole, consists of information security professionals with varying degrees of professional education, certifications and experience. This blend of diverse qualifications, certifications, and experience within the ISGC ensures a comprehensive and flexible approach to information security, positioning the Company to address emerging threats and maintain a robust defense against potential risks.


text: Risk Management and Strategy Our enterprise risk management program is designed to identify, measure, monitor and control significant risks across various aspects of the Company. Cybersecurity risk management processes are integrated into this program, given the increasing reliance on technology and potential of cyber threats.


text: Our cybersecurity risk management program contains eleven key elements: Information Security Policies, Strategic Planning, Risk Assessment, Audit and Examination, Business Continuity Planning, Incident Response Planning, Third-Party Due Diligence, Cyber Insurance Coverage, Employee Training and Testing, Patch and Vulnerability Management, and the Federal Financial Institutions Examination Council ("FFIEC") Cyber Assessment Tool ("CAT").


text: The Information Security Steering Committee ("ISSC"), appointed by the Board, bears the responsibility for cybersecurity risk management and strategy. It aids the Board in fulfilling its oversight duties related to IT security, aligning with the Bank's business strategy, and adhering to regulatory requirements. The Virtual Chief Information Security Officer ("vCISO"), who is also appointed by the Board, oversees the ISP and coordinates the ISSC.


text: The ISSC's responsibilities encompass: • Review and approval of the ISP-related documents, including policies, strategies, plans and risk assessments; • Monitoring of control statuses and program gaps, including findings from audit reports and assessments; • Participation in program assessments, such as risk and business impact assessments; • Providing input on mitigation of current issues and threats; • Reporting, at least quarterly, to the Enterprise Risk Management Committee on ISSC activities and risk impacts on the Risk Appetite Statement. • Reporting, at least annually, to the Board on the status of the ISP, covering compliance, risk management, vendor management, audit and testing results, breaches and incidents, and recommended updates to the ISP.


text: The Company's approach to managing cybersecurity risks is shaped by insights from the FFIEC CAT, a tool designed for assessing and improving cybersecurity practices. This tool undergoes a thorough examination by an independent third-party on an annual basis to ensure an unbiased and comprehensive evaluation. In its most recent assessment in 2023, the FFIEC CAT identified that the Company is operating at an acceptable level of cyber maturity. This means the Company is effectively handling the inherent risks it faces in five critical areas: cyber risk management and oversight, collaboration on threat intelligence, implementation of cybersecurity controls, management of external dependencies, and resilience in handling cyber incidents.


text: To stay ahead of potential cybersecurity challenges, the Company has established a formal process. This process is activated whenever the FFIEC CAT or the ISSC identifies changes in inherent risks. In response, the Company proactively updates its cybersecurity objectives, policies, and tactical goals. This ensures that the Company's cybersecurity strategy remains responsive, continuously adapting to emerging threats and evolving industry standards.


text: Further, to enhance cybersecurity awareness, reduce vulnerability, and foster consideration of cybersecurity threats, our employees and the Board of Directors attend annual trainings. Specific role-based trainings are mandatory for certain employees, tailored to their duties.


text: The Board of Directors oversees cybersecurity risk management as part of its broader risk oversight responsibilities. The Board receives at least annual reports from the ISSC on cybersecurity risks, emerging threats, regulatory developments, and the effectiveness of our information security program. The Board also reviews and approves the ISP annually to ensure alignment with business strategy and regulatory requirements.


text: The ISSC, chaired by the vCISO, is responsible for implementing cybersecurity risk management policies and strategies. The vCISO, appointed by the Board, has extensive experience in information security, holding various professional certifications, including a Certified Information Systems Security Professional ("CISSP"). The ISSC also includes senior executives from risk, compliance, IT, and internal audit functions, ensuring a multidisciplinary approach to managing cybersecurity threats.


text: Adherence to the ISP is of utmost importance, and any exceptions to policy must be recommended by the ISSC, approved by the Enterprise Risk Management Committee, and reported to the Board at least annually.


text: The ISSC includes key personnel including the vCISO, Chief Operating Officer, Technology Services Director, Information Technology Manager, Internal Audit Manager, Compliance Manager, and Information Security Specialists. The ISSC members bring diverse qualifications, certifications, and extensive experience to the table. This collective expertise ensures a comprehensive and well-rounded approach to our information security initiatives.


text: Our vCISO has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management and is accountable for managing our enterprise information security department and developing and implementing our information security program. The responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, client, vendor and employee education and awareness, and business continuity and disaster recovery.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity policies and procedures, which are integrated into the Company's overall risk management framework. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: Empire State Realty Trust, Inc.

ticker: ESRT


text: We partner with third parties to implement and assess the effectiveness of our cybersecurity prevention and response systems and processes. We have a Managed Service Provider (MSP) and Managed Security Services Provider (MSSP) that provide 24 x 7 x 365 Network Operations Center and Security Operations Center (SOC) and works with our information technology (IT) team to employ a variety of monitoring technologies to detect and be alerted to potential cyber threats, as well as establish and implement procedures for the mitigation and remediation of any cybersecurity incidents. We conduct an annual penetration test, regular phishing tests, and annual cybersecurity training for our employees.


text: Additionally, the management team of the Company has developed a cyber incident response plan to deploy in the event of a cyber threat. This plan is reviewed and updated at least annually and tested from time to time through tabletop exercises involving management and other key personnel, and may also include participation from the Board and outside experts. As part of regular business continuity planning, department heads are required to consider key technology systems used by their respective teams and the impact to the Company and other stakeholders in the event that such systems become compromised or unavailable. Additionally, we monitor and identify cybersecurity risks posed by third-party vendors who provide software and/or hardware to the Company or otherwise have access to our Company systems and have a cyber review process that is part of vendor onboarding.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Refer to the risk factor captioned "Cyberattacks and any failure to comply with related laws could negatively impact us." in Part I, ITEM 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: Our Board of Directors oversees our risk management process, including with respect to cybersecurity risks, directly and through its committees. The Audit Committee of our Board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports on our enterprise risk profile on a quarterly basis. Our Chief Technology Officer (CTO) is responsible for leading the assessment and management of cybersecurity risks, oversees teams across the Company supporting our cybersecurity policies and procedures around prevention, detection, mitigation and remediation of cybersecurity incidents, and reports at least quarterly to the Audit Committee on cybersecurity strategy and risks. Our CTO has over 25 years of experience in cybersecurity and information technology, is the Chair of the Real Estate Board of Cyber Committee, a Board Member of the Real Estate Cyber Consortium and is a Board Member of the Global Cyber Consortium.


text: As an externally managed company, our day-to-day operations are managed by our advisor and our executive officers under the oversight of our board of directors. Our executive officers are senior professionals of our advisor, our advisor is a subsidiary of DWS, and DWS is majority owned by Deutsche Bank. Deutsche Bank and its affiliates are collectively referred as Deutsche Bank Group. DWS aligns its information security management system to the latest information security policies defined by Deutsche Bank. The DWS Information Security Framework is managed under Deutsche Bank's framework. As such, we are reliant on Deutsche Bank Group for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details of the cybersecurity program applicable to Deutsche Bank Group.

companyName: RREEF Property Trust, Inc.


text: Cybersecurity governance Responsibility for cybersecurity matters sits within the Chief Security Office, where it forms the first Line of Defense within Deutsche Bank's Three Lines of Defense model. The Chief Security Officer has delegated authority from the Deutsche Bank Management Board ("Management Board") and reports directly to the Chief Technology, Data, and Innovation Officer, who is a member of the Management Board.


text: Deutsche Bank's Chief Security Officer has served in various roles in information security for more than 20 years. This includes the role as global Chief Information Security Officer ("CISO") / Chief Security Officer ("CSO") for three different large European financial institutions and a partner position in a global strategy and consulting firm, leading security work for financial service clients. The Chief Security Officer is supported by information security role holders at various seniority levels to help ensure that security requirements are met from a regional, divisional, and technical perspective.


text: The Chief Security Office develops Deutsche Bank Group's security strategy and oversees its implementation and operationalization globally via the organizational set-up, governance, and implemented security policies. The security strategy is reviewed continually to address changes in the threat landscape, technology, the regulatory environment, the overall corporate and IT strategy, and other internal and external parameters.


text: The Chief Security Office maintains a comprehensive metrics and reporting framework, underpinned by an extensive data set allowing for global, regional, and divisional views. Security metrics and reporting provided to Deutsche Bank Group s governance forums at all seniority levels support appropriate security risk awareness and decision taking. The Management Board receives a comprehensive quarterly information security risk posture report, as well as ad hoc information if required. Furthermore, the Chief Security Officer provides regular updates on material topics relating to security to the Supervisory Board's Committee responsible for technology, data and innovation.


text: Information security risk is managed as an operational risk under the non-financial risk management framework of Deutsche Bank Group. The Chief Security Office, in its responsibility as the first line of defense, executes against the non-financial risk management framework and leverages its various instruments whereas the non-financial risk management as the second line of defense provides oversight, review, and challenge. Accordingly, part of the non-financial risk committee's remit is to oversee and govern Deutsche Bank Group's cybersecurity risk profile, remediation programs and risk tolerance. Should a cybersecurity incident occur, Deutsche Bank Group has an established protocol for communicating such incident to the divisions of Deutsche Bank Group that may be impacted, including chief security officers and division heads. Those personnel in turn will notify potentially affected groups further downstream as applicable, including down to us if any our or our stockholders' information may be at risk.


text: Deutsche Bank Group's security policy framework defines the core principles of security risk management and the fundamentals for security management. The complete framework is reviewed annually. The framework is governed centrally and applied globally across all product groups and business and infrastructure divisions. The framework includes a clear description of the risk tolerance related to information security. It also sets out the roles, responsibilities and accountabilities of key personnel identified to manage information security risk; the strategy and measures to cope with information security breaches, and related communication procedure.


text: Additionally, Deutsche Bank Group's Information Security Management System has been certified according to ISO 27001 for all information security domains defined in that standard since 2012. To maintain the ISO 27001 certification, Deutsche Bank Group performs a full recertification process every three years, with the latest taking place in 2021. In the years a full certification process does not take place, the Deutsche Bank Group performs a certification-follow-up, designed to ensure compliance between certification intervals. The latest certification follow-up was in 2023. The next full recertification will take place in September 2024.


text: Deutsche Bank Group employs a variety of mechanisms to self-identify areas for improvements and control enhancements. These include security testing, security problem management and lessons learned. The effectiveness of Deutsche Bank Group s overall information security program is evaluated on a regular basis by third-party organizations that compare Deutsche Bank Group's approach with industry benchmarks. Deutsche Bank Group s independent internal audit function frequently includes the assessment of security controls in its audit plan.


text: Identifying, assessing and managing cybersecurity threats We and Deutsche Bank Group operate in an environment with increasing levels of digitization and a continually evolving landscape related to cybersecurity threats. Due to the dynamics and complexity of the current environment, the Deutsche Bank Group is continuously monitoring the security threat landscape. Deutsche Bank Group vigilantly observes technological developments, the geopolitical landscape and economic impacts driving security risks and assesses their relevance for potential impacts to Deutsche Bank Group and the wider financial ecosystem.


text: Deutsche Bank Group has a variety of prevention methods and controls in place, such as threat intelligence, data leakage prevention, cyber hygiene, and encryption solutions. These also include placing a strong emphasis on detection, backed by a robust incident-response process. Deutsche Bank Group actively shares best practices and threat information with national and international security organizations, government authorities, and peer organizations. These relationships help to ensure that Deutsche Bank Group's security technology and procedures reflect current industry best practices and keep pace with the threat environment.


text: Deutsche Bank Group's security incident management covers cybersecurity events that may affect it and its subsidiaries, its clients, business partners, or employees. The related management and reporting processes performed with the involvement of compliance, legal and data privacy are designed to enable a quick and effective response to cyberattacks and information security threats. Further, if DWS is notified of an incident, then a communication protocol will be followed to notify affected or potentially affected parties internal and external to DWS, including notification to us if our data or our stockholders data is at risk.


text: The audit committee of our board of directors is responsible for overseeing the implementation of the cybersecurity policies and procedures applicable to us, and related reporting. This includes quarterly reporting to our audit committee as well as ad hoc incident reporting whereby if we are notified of an incident, whether reported to us by Deutsche Bank Group or any of our third-party vendors, we will assess it and advise the audit committee of our board of directors depending on the severity of the incident. The audit committee can, in its discretion and at our expense, retain special legal or other consultants to advise the audit committee or to assist in the conduct of any investigation, subject to our board of directors determination to allocate assets to pay for such investigation.


text: To address evolving security threats, Deutsche Bank Group continually reviews and enhances its information security controls into every layer of technology, including identity and access management, data, infrastructure, devices, and applications. This is complemented by organizational controls and security training and awareness. The purpose of this layered approach is to provide end-to-end protection, as well as multiple opportunities to detect, prevent, respond to, and recover from cyberthreats.


text: Security risks are assessed on a regular basis, at least annually, taking internal as well as external risk drivers and events dynamically into account. A thorough analysis of the external threat landscape, which leverages industry standard threat assessment frameworks, provides a foundation for the assessment of financial industry relevant risk scenarios. These are evaluated against Deutsche Bank Group's capabilities to cope with these risks. In case of emerging developments, additional risk reviews are conducted.


text: Reliance on third parties' products and services that support critical operations can affect the risk posture, because these can be the target of new and evolving cybersecurity attacks. This risk, along with expanded regulatory requirements, has necessitated an increased use of technology to better identify information security risks across third parties and where necessary, pro-actively perform outreach with them. Deutsche Bank Group has a third-party risk management process designed to identify, monitor, and mitigate risks arising from working with third parties, which includes oversight of third parties' operations related to the services provided. In addition, where appropriate, Deutsche Bank Group will seek to include in its contractual arrangements with certain third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices.


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Deutsche Bank Group in managing these risks, see "Part 1. Item 1A. Risk Factors – General Risk Factors – Cybersecurity risks and data protection could result in the loss of data, interruptions in our business, damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations" in this Annual Report on Form 10-K.


text: As an externally managed company, our day-to-day operations are managed by our advisor and our executive officers under the oversight of our board of directors. Our executive officers are senior professionals of our advisor, our advisor is a subsidiary of DWS, and DWS is majority owned by Deutsche Bank. Deutsche Bank and its affiliates are collectively referred as Deutsche Bank Group. DWS aligns its information security management system to the latest information security policies defined by Deutsche Bank. The DWS Information Security Framework is managed under Deutsche Bank's framework. As such, we are reliant on Deutsche Bank Group for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details of the cybersecurity program applicable to Deutsche Bank Group.


text: Cybersecurity governance Responsibility for cybersecurity matters sits within the Chief Security Office, where it forms the first Line of Defense within Deutsche Bank's Three Lines of Defense model. The Chief Security Officer ("CSO") has delegated authority from the Deutsche Bank Management Board ("Management Board") and reports directly to the Chief Technology, Data, and Innovation Officer, who is a member of the Management Board. The Management Board is accountable for the implementation of the information security framework, with oversight from the Deutsche Bank Supervisory Board. There are multiple mechanisms in place for the CSO to escalate security issues directly to the Management Board if required.


text: Deutsche Bank's Chief Security Officer has served in various roles in information security for more than 20 years. This includes the role as global Chief Information Security Officer ("CISO") / CSO for three different large European financial institutions and a partner position in a global strategy and consulting firm, leading security work for financial service clients. The Chief Security Officer is supported by information security role holders at various seniority levels to help ensure that security requirements are met from a regional, divisional, and technical perspective.


text: The Chief Security Office develops Deutsche Bank Group's security strategy and oversees its implementation and operationalization globally via the organizational set-up, governance, and implemented security policies. The security strategy, which is reviewed on a regular basis, incorporates developments in the threat landscape, technology, the regulatory environment, the overall corporate and IT strategy, and other internal and external parameters.


text: Additionally, Deutsche Bank Group's Information Security Management System has been certified according to ISO 27001 for all information security domains defined in that standard since 2012. To maintain the ISO 27001 certification, Deutsche Bank Group performs a full recertification process every three years, with the latest taking place in 2024. With the last recertification, Deutsche Bank upgraded its Information Security Management System to the 2022 version of ISO 27001. Furthermore, the Deutsche Bank Group performs an annual surveillance audit designed to ensure compliance between certification intervals.


text: Deutsche Bank Group employs a variety of mechanisms to self-identify areas for improvements and control enhancements. These include security testing, security problem management and lessons learned. The effectiveness of Deutsche Bank Group s overall information security program is evaluated on a regular basis by third-party organizations that compare Deutsche Bank Group's approach with industry benchmarks. Deutsche Bank Group s independent internal audit function is mandated to regularly assess security controls as part of its audit plan.


text: Identifying, assessing and managing cybersecurity threats We and Deutsche Bank Group operate in an environment with increasing levels of digitization and a constantly evolving landscape related to cybersecurity threats. Due to the dynamics and complexity of the current environment, the Deutsche Bank Group is continuously monitoring the security threat landscape. Deutsche Bank Group vigilantly observes technological developments, the geopolitical landscape and economic impacts driving security risks and assesses their relevance for potential impacts to Deutsche Bank Group and the wider financial ecosystem.


text: Deutsche Bank Group has a variety of prevention methods and controls in place, such as threat intelligence, network security, identity and access management, data leakage prevention, cyber hygiene, and encryption solutions. These also include placing a strong emphasis on detection, backed by a robust incident-response process. Deutsche Bank Group actively shares best practices and threat information with national and international security organizations, government authorities, and peer organizations. These relationships help to ensure that Deutsche Bank Group's security technology and procedures reflect current industry best practices and keep pace with the threat environment.


text: To address evolving security threats, Deutsche Bank Group continually reviews and enhances its information security controls into every layer of technology, including databases, infrastructure, devices, and applications. This is complemented by organizational controls and security training and awareness. The purpose of this layered approach is to strengthen end-to-end protection by utilizing multiple opportunities to detect, prevent, respond to, and recover from cyberthreats.


text: Safeguarding our critical networks and the information that platform users share with us is vital to our business. One key way that Uber addresses this need is through its cybersecurity risk management program ("Cybersecurity Program").

companyName: Uber Technologies, Inc

ticker: UBER


text: Uber's Chief Information Security Officer ("CISO") is responsible for the Cybersecurity Program, which is coordinated and primarily executed by the global organization of engineers focused on risk management using the NIST Framework (Identify, Protect, Detect, Respond, and Recover) and activities such as automation, secure development, and advanced analytics and monitoring. The CISO has served in such role since February 2021 and has more than 20+ years of engineering and/or cybersecurity experience, including previously as CISO and Deputy Chief Technology Officer at a Fortune 500 company.


text: The Cybersecurity Program is also supported by Uber's Chief Privacy Officer and Associate General Counsel, Privacy & Cybersecurity ("CPO"), who has served in that role since August 2018. The CPO has three decades of experience as a legal advisor to multinational corporations, including serving as Chief Privacy & Security Counsel for a Fortune 100 technology company prior to her role at Uber.


text: The Cybersecurity Program is supported by other members of Uber's senior management team as well, including the Chief Legal Officer, Head of Platform Engineering, and EU Data Protection Officer. Uber's Board of Directors oversees the Cybersecurity Program through regular updates.


text: This Cybersecurity Program is a critical component of Uber's enterprise risk management program, through which Uber reviews business, cybersecurity, information technology, privacy, legal, and geopolitical risks, among others. The Cybersecurity Program is designed to assess, identify, and manage risks from cybersecurity threats.


text: Key elements of this program include: • Oversight and Governance. Uber's Board oversees the Cybersecurity Program, and Uber's risk profile with respect to cybersecurity matters, through regular reports and reviews. These include presentations by the CISO to the Board and Audit Committee on an alternating quarterly basis, quarterly reports of certain cybersecurity incidents to the Board, and annual reports by the CPO to the Board.


text: The CISO also provides quarterly updates to Uber's senior management regarding cybersecurity risks, as well as interim updates during regular meetings with Uber's engineering, product and internal audit leadership. The CISO and CPO also jointly chair Uber's Privacy and Cybersecurity Council, which provides a venue for cross-functional insight and input into the Cybersecurity Program and our privacy program as they relate to Uber's business operations.


text: • Internally conducted environment and vulnerability assessments. These include semi-annual assessments performed by Uber's security engineering teams. The findings from these assessments are reported to Uber's senior management, including the CISO, and the Board or Audit Committee. In addition, our internal audit function periodically conducts additional reviews and assessments, which are reported to the Audit Committee. • Independent third-party audits and assessments by industry-leading firms. These include regular assessments of Uber's information systems, business systems and cybersecurity infrastructure; reviews to identify opportunities to strengthen Uber's cybersecurity posture; and cybersecurity audits for purposes of maintaining Uber's Payment Cards Industry (PCI), ISO 27001 and 27002, and SOC1 and SOC2 certifications. • Cyber incident management. This includes efforts by Uber's security engineering team, at the direction of the CISO, to review potential incidents identified by Uber's internal teams, Uber's third-party service providers or external researchers through Uber's Bug Bounty program; identify those which represent potential or actual threats to Uber's systems, data or users; investigate and mitigate the cause and impact of such incidents; and implement safeguards to help prevent recurrence. Uber's CPO and legal team support such efforts, including in connection with legal or disclosure obligations triggered in connection with any such incidents. • Third Party Risk Management. Uber performs due diligence regarding its third-party suppliers, service providers and business partners. This includes requiring submission of evidence demonstrating third parties' ability to meet Uber's cybersecurity and data handling requirements. In addition, Uber's third-party suppliers and service providers who process Uber personal data are contractually obligated to notify Uber if they experience certain incidents impacting Uber personal data.


text: We are committed to continuously evaluating and enhancing our cybersecurity measures as our business evolves. However, investors should be aware that our current capabilities may not fully address all cybersecurity risks. We encourage investors to consider the inherent risks associated with our limited resources and lack of formal cybersecurity policies when evaluating our Company.

companyName: FLEXPOINT SENSOR SYSTEMS INC

ticker: FLXT


text: For a discussion regarding risks from cybersecurity threats, see our risk factors, including the risk factors titled "—We have experienced, and may experience security or privacy breaches or other unauthorized or improper access to, use of, disclosure of, alteration of or destruction of our proprietary or confidential data, employee data, or platform user data, which could cause loss of revenue, harm to our brand, business disruption, and significant liabilities", "—Cyberattacks, including computer malware, ransomware, viruses, denial of service attacks, spamming, phishing and social engineering attacks could harm our reputation, business, and operating results", "—We currently are subject to a number of inquiries, investigations, and requests for information from the DOJ, other federal, state and local government agencies and other foreign government agencies, the adverse outcomes of which could harm our business" and "—We face risks related to our collection, use, transfer, disclosure, and other processing of data, which could result in investigations, inquiries, litigation, fines, legislative and regulatory action, and negative press about our privacy and data protection practices" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Safeguarding our critical networks and the information that platform users share with us is vital to our business. One key way that Uber addresses this need is through its cybersecurity program, which includes a cybersecurity risk management program.


text: Uber's Chief Information Security Officer ("CISO") is responsible for the cybersecurity program, which is coordinated and primarily executed by the global organization of engineers focused on risk management using the NIST Framework (Govern, Identify, Protect, Detect, Respond, and Recover) and activities such as automation, secure development, and advanced analytics and monitoring. The CISO has served in such role since February 2021 and has more than 20+ years of engineering and/or cybersecurity experience, including previously as CISO and Deputy Chief Technology Officer at a Fortune 500 company.


text: The cybersecurity program is also supported by Uber's Chief Privacy Officer and Associate General Counsel, Privacy & Cybersecurity ("CPO"), who has served in that role since August 2018. The CPO has over three decades of experience as a legal advisor to multinational corporations, including serving as Chief Privacy & Security Counsel for a Fortune 100 technology company prior to her role at Uber.


text: The cybersecurity program is supported by other members of Uber's senior management team as well, including the Chief Legal Officer, Chief Architect Officer, and Global Data Protection Officer. Uber's Board of Directors oversees the cybersecurity program through regular updates.


text: This cybersecurity program is a critical component of Uber's enterprise risk management program, through which Uber reviews business, cybersecurity, information technology, privacy, legal, and geopolitical risks, among others. The cybersecurity program is designed to assess, identify, and manage risks from cybersecurity threats.


text: Key elements of this program include: • Oversight and Governance. Uber's Board oversees the cybersecurity program, and Uber's risk profile with respect to cybersecurity matters, through regular reports and reviews. These include presentations by the CISO to the Board and Audit Committee on an alternating quarterly basis, quarterly reports of certain cybersecurity incidents to the Board, and annual reports by the CPO to the Board.


text: The CISO also provides quarterly updates to Uber's senior management regarding cybersecurity risks, as well as interim updates during regular meetings with Uber's engineering, product and internal audit leadership. The CISO and CPO also jointly chair Uber's Privacy and Cybersecurity Council, which provides a venue for cross-functional insight and input into the cybersecurity program and our privacy program as they relate to Uber's business operations.


text: • Internally conducted environment and vulnerability assessments. These include regular assessments performed by Uber's security engineering teams. The findings from these assessments are reported to Uber's senior management, including the CISO, and the Board or Audit Committee. In addition, our internal audit function periodically conducts additional reviews and assessments, which are reported to the Audit Committee. We also conduct table-top exercises to simulate the response to cybersecurity incidents; participants may include, among others, the CISO, the CPO, and representatives from communications, investor relations, finance and legal. • Independent third-party audits and assessments by industry-leading firms. As a global organization, Uber undergoes annual audits to maintain its certification as a Payment Card Industry Data Security Standard (PCI DSS 4.0) Level 1 Merchant and Service provider. Uber also undergoes annual audits to maintain its ISO 27001 certification for its core mobility, delivery, and enterprise businesses, and SOC 2 attestations that vary depending on the Uber product. • Cyber incident management. This includes efforts by Uber's security engineering team, at the direction of the CISO, to review potential incidents identified by Uber's internal teams, Uber's third-party service providers or external researchers through Uber's Bug Bounty program; identify those which represent potential or actual threats to Uber's systems, data or users; investigate and mitigate the cause and impact of such incidents; and implement safeguards to help prevent recurrence. Uber's CPO and legal team support such efforts, including in connection with legal or disclosure obligations triggered in connection with any such incidents. • Third Party Risk Management. Uber performs due diligence regarding its third-party suppliers, service providers and business partners. This includes requiring submission of evidence demonstrating third parties' ability to meet Uber's cybersecurity and data handling requirements. In addition, Uber's third-party suppliers and service providers who process Uber personal data are contractually obligated to notify Uber if they experience certain incidents impacting Uber personal data.


text: Carlyle's CISO, in coordination with our Chief Financial Officer, Chief Compliance Officer, and Principal Accounting Officer, among certain other senior executives of our Investment Adviser, is responsible for leading the assessment and management of cybersecurity risks. The current Carlyle CISO has over 30 years of experience in information security and is a Certified Information Systems Security Professional. As described above, Carlyle's CISO leads our cybersecurity program, chairs Carlyle's ISSC that is comprised of senior management and other sector representatives, and provides cybersecurity status reporting to our Audit Committee as necessary and at least annually.

companyName: Carlyle Secured Lending, Inc.

ticker: CGBD


text: For a discussion regarding risks from cybersecurity threats, see our risk factors, including the risk factors titled "— We have experienced, and may experience security or privacy breaches or other unauthorized or improper access to, use of, disclosure of, alteration of or destruction of our proprietary or confidential data, employee data, or platform user data, which could cause loss of revenue, harm to our brand, business disruption, and significant liabilities", "—Cyberattacks, including computer malware, ransomware, viruses, denial of service attacks, spamming, phishing and social engineering attacks could harm our reputation, business, and operating results", "—We currently are subject to a number of inquiries, investigations, and requests for information from the DOJ, other federal, state and local government agencies and other foreign government agencies, the adverse outcomes of which could harm our business" and "—We face risks related to our collection, use, transfer, disclosure, and other processing of data, which could result in investigations, inquiries, litigation, fines, legislative and regulatory action, and negative press about our privacy and data protection practices" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Risk Management, Strategy and Procedures We, our Investment Adviser and its affiliates regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, standards, processes, and practices, which are integrated into our overall risk management system. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, protect against, detect, respond to, and recover from security incidents. These efforts are implemented by Carlyle's Global Technology & Solutions ("GTS") team in partnership with our business, legal, and compliance teams, and are essential for us to conduct investment activities, manage internal administration activities, and connect our global enterprise. Our systems, data, network, and infrastructure are monitored and administered by formal controls and risk management processes that log events and help protect the our data. In addition, our business continuity plans are designed to allow critical business functions to continue in an orderly manner in the event of an emergency. The GTS team works closely with Carlyle's business segment teams, including our Investment Adviser, to maintain operational resilience through business continuity planning and annual information technology disaster recovery and incident response plan testing, which collectively support the goal of mitigating risk were an emergency to occur. The GTS team has procedures in place to report cybersecurity threats or incidents on a periodic basis. These efforts are underpinned by the implementation of security best practices, where possible, such as: • Multi-factor authentication for remote access, privileged access management for system administrators, application whitelisting, laptop encryption, and advanced malware defenses on endpoints; • Incident preparedness and response planning and risk mitigation; • Independent and continuous security testing, assessment and vulnerability management; • Regular security awareness training, including phishing simulations, for Carlyle authorized users; • Restrictions on access to personal email accounts, cloud storage, social media, risk-based categories of websites and USB storage devices; • Device and system access management policies and procedures that restrict access upon employee or contractor separation from the company; and • Compliance attestations by Carlyle personnel on firm policies, such as Carlyle's acceptable use policy, upon hire and annually.


text: In addition, Carlyle partners with third parties to assess the effectiveness of its cybersecurity program, which includes the Company. Third party assessments will include audits and assessments performed under the direction of Carlyle's internal audit team, which co-sources with third-party cybersecurity experts in conducting its reviews. GTS also administers Carlyle's cyber third-party risk management program, which assesses external service providers before onboarding and provides ongoing monitoring in accordance with certain risk-based cybersecurity criteria.


text: To our knowledge cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. The sophistication of cyber threats continues to increase and there can be no assurance that the various procedures and controls we utilize to mitigate these threats will be sufficient to prevent disruptions to our systems. Consequently, given that the magnitude of cybersecurity incidents or threats are difficult to predict, we are unable to determine at this time whether risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For an additional description of cybersecurity risk and potential related impacts on us, see Part I, Item 1A of this Form 10-K "Risk Factors—Risks Related to Our Business and Structure—Cybersecurity risks and cyber incidents may adversely affect our business or those of our portfolio companies by causing a disruption to our operations, a compromise or corruption of confidential information and/or damage to business relationships, or those of our portfolio companies, all of which could negatively impact our business, results of operations or financial condition."


text: Risk Management Oversight and Governance Our Board of Directors oversees our enterprise risk management strategy, including our strategy on cybersecurity risks, directly and through its committees. In this respect, the Audit Committee of the Board of Directors (the "Audit Committee") oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports from Carlyle on our enterprise risk profile on an annual basis. In addition, Carlyle's Chief Information Security Officer ("CISO") leads our cybersecurity program, chairs Carlyle's Information Security Steering Committee ("ISSC"), and provides cybersecurity status reporting to our Audit Committee at least annually. The ISSC meets quarterly and ensures that cybersecurity initiatives are in alignment with Carlyle's strategic priorities.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies, standards, processes, and practices throughout our operations that are designed to address cybersecurity threats, events, and incidents. In particular, our cybersecurity program supports security governance, security awareness and training, security engineering and architecture, security risk management, vulnerability management, security monitoring, and incident response capabilities. In addition, our incident response plan contains escalation and reporting protocols, including reporting to our disclosure committee to consider materiality of cybersecurity incidents. Policies and procedures are in place to assist the disclosure committee with these materiality assessments and any resulting reporting requirements.


text: Risk Management, Strategy and Procedures We, our Investment Adviser and its affiliates regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, standards, processes, and practices, which are integrated into our overall risk management system. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, protect against, detect, respond to, and recover from security incidents. These efforts are implemented by Carlyle's Global Technology & Solutions ("GTS") team in partnership with our business, legal, and compliance teams, and are essential for us to conduct investment activities, manage internal administration activities, and connect our global enterprise. Our systems, data, network, and infrastructure are monitored and administered by formal controls and risk management processes that log events and help protect the our data. In addition, our business continuity plans are designed to allow critical business functions to continue in an orderly manner in the event of an emergency. The GTS team works closely with Carlyle's business segment teams, including our Investment Adviser, to maintain operational resilience through business continuity planning and annual information technology disaster recovery and incident response plan testing, which collectively support the goal of mitigating risk were an emergency to occur. The GTS team has procedures in place to report cybersecurity threats or incidents on a periodic basis. These efforts are underpinned by the implementation of security best practices, where possible, such as: • Multi-factor authentication for remote access, privileged access management for system administrators, application whitelisting, laptop encryption, mobile device management software, and advanced malware defenses on endpoints; • Incident preparedness and response planning and risk mitigation; • Independent and continuous security testing, assessment and third-party risk and vulnerability management; • Regular security awareness training, including phishing simulations, for Carlyle authorized users; • Restrictions on access to personal email accounts, cloud storage, social media, risk-based categories of websites, and USB storage devices; • Device and system access management policies and procedures that restrict access upon employee or contractor separation from the company; and • Compliance attestations by Carlyle personnel on firm policies, such as Carlyle's acceptable use policy, upon hire and annually.


text: To our knowledge cybersecurity threats, including as a result of any previous detected or undetected cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, however, we may learn new facts about these detected or undetected incidents and these facts may lead us to change this materiality assessment. The sophistication of cyber threats continues to increase and there can be no assurance that the various procedures and controls we utilize to mitigate these threats will be sufficient to prevent disruptions to our systems. Consequently, given that the magnitude of cybersecurity incidents or threats are difficult to predict, we are unable to determine at this time whether risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For an additional description of cybersecurity risk and potential related impacts on us, see Part I, Item 1A of this Form 10-K "Risk Factors—Risks Related to Our Business and Structure—Cybersecurity risks and cyber incidents may adversely affect our business or those of our portfolio companies by causing a disruption to our operations, a compromise or corruption of confidential information and/or damage to business relationships, or those of our portfolio companies, all of which could negatively impact our business, results of operations or financial condition."


text: Carlyle's CISO, in coordination with our Chief Financial Officer, Chief Compliance Officer, and Principal Accounting Officer, among certain other senior executives of our Investment Adviser, is responsible for leading the assessment and management of cybersecurity risks. The current Carlyle CISO has over 22 years of experience in information security and that includes key roles managing cybersecurity risk in both government and the private sector. As described above, Carlyle's CISO leads our cybersecurity program, chairs Carlyle's ISSC that is comprised of senior management and other sector representatives, and provides cybersecurity status reporting to our Audit Committee as necessary and at least annually.


text: Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CISO is responsible for overseeing our Information Security budget, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Freshworks Inc.

ticker: FRSH


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our customers and employees (Information Systems and Data).


text: Our Chief Information Security Officer (CISO), our information security team, and third-party service providers help identify, assess, and manage our cybersecurity threats and risks, including through the use of our cybersecurity risk assessment program. Our CISO along with this team, as applicable, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including automated and manual tools, third-party threat feeds, internal audits, access control assessments, and evaluating threats reported to us by various third party enterprise threat reporting services.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: dedicated cybersecurity staff, including a 24X7 security operations center monitoring for and responding to threat activity, incident response plans and processes, vulnerability management, secure software development, static and dynamic code scanning for vulnerabilities, open-source software scanning, internal and third-party penetration testing, a bug bounty program, internal audit and assurance of security controls, disaster recovery/business continuity plans, attainment and maintenance of industry-standard security certifications, identity and access management, asset management, tracking and disposal, encryption, access controls, third-party risk management, phish testing and reporting, employee security awareness training, and maintaining cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risks are considered a part of our overall business strategy, financial planning, and capital allocation.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats. Our information security leadership inventories and prioritizes information security risks and evaluates material risks from cybersecurity threats, and reports those quarterly to the audit committee of our board of directors (Audit Committee), which evaluates our overall enterprise risk.


text: We use third-party service providers to perform a variety of security functions throughout our business, such as SaaS security providers, cloud-native application protection platforms, dark web monitoring, and software code scanning. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessments and imposition of contractual obligations. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, which may impose contractual obligations related to cybersecurity on the provider. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology, systems, or those of third parties upon which we rely or our data are or were to be compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our CISO and our information security team. Our CISO has served in various roles in information technology and information security for more than 20 years, including serving as the Chief Information Security Officer at a publicly traded SaaS company and large e-commerce company. Our CISO works with our broader Information Technology team on IT security issues and also works with our product organization, finance, legal and internal controls teams.


text: As a Company with a single-officer operation and no formal cybersecurity policies in place, we recognize the importance of safeguarding our digital assets and protecting sensitive information. While we strive to maintain the security of our systems and data, our resources and infrastructure are limited. We rely on basic security measures, such as password protection and firewalls to mitigate potential risks.


text: Our cybersecurity incident response process is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances including our CISO, our Chief Financial Officer and our Chief Legal Officer. Upon consultation with our Chief Financial Officer and our Chief Legal Officer, our CISO works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response process includes reporting to the Audit Committee for certain cybersecurity incidents.


text: The Audit Committee receives reports as part of its quarterly meetings from our CISO concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. Our board also receives periodic reports (at least annually) from our CISO regarding the our overall cybersecurity landscape, including material related to cybersecurity threats, risk, and mitigation.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: dedicated cybersecurity staff, including a 24/7 security operations center monitoring for and responding to threat activity, incident response plans and processes, vulnerability management, secure software development, static and dynamic code scanning for vulnerabilities, open-source software scanning, internal and third-party penetration testing, a bug bounty program, internal audit and assurance of security controls, disaster recovery/business continuity plans, attainment and maintenance of industry-standard security certifications, identity and access management, asset management, tracking and disposal, encryption, access controls, third-party risk management, phish testing and reporting, employee security awareness training, and maintaining cybersecurity insurance.


text: The Audit Committee receives reports as part of its quarterly meetings from our CISO concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. Our board also receives periodic reports (at least annually) from our CISO regarding the overall cybersecurity landscape, including material related to cybersecurity threats, risk, and mitigation.


text: The cybersecurity threat environment is volatile and dynamic, requiring a robust and dynamic framework to reduce and mitigate cybersecurity risk. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. We seek to mitigate cybersecurity risk and associated reputational and compliance risk by, among other things maintaining privacy policies, management oversight, accountability structures, and technology design processes to protect private and personal data;

companyName: Village Bank & Trust Financial Corp.


text: actively monitoring and mitigating cybersecurity threats and risks with a three lines of defense structure to provide oversight, governance, challenge and testing; using a third-party cybersecurity oversight program;


text: maintaining oversight of our information security program by senior management, our board-level Risk Committee, and our Board of Directors; and We had no material cybersecurity incidents in 2023.


text: Risk Management and Strategy Our cybersecurity risk management strategy is integrated into our enterprise risk management framework and is embedded in each of our three lines of defense. We use a combination of management expertise and Board oversight, as discussed below, as well as outside partners to assist us in overseeing our cybersecurity risk management program. We deploy safeguards designed to protect customer information and our own corporate information and technology. We have programs and processes in place designed to mitigate known attacks, and we use both internal and external resources to scan for vulnerabilities in our applications, systems, and platforms. We implement backup and recovery systems and require the same of our third-party service providers.


text: W e use independent third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements and industry guidelines. We also engage with outside risk experts and industry groups, including other peer institutions, as needed, to help us evaluate potential future threats and trends, particularly with respect to emerging information security and fraud risks. We generally have agreements in place with our service providers that include requirements related to cybersecurity and data privacy. We cannot guarantee, however, that such agreements will prevent a cyber incident from impacting our systems or information. Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed to our service providers in relation to any data that we share with them.


text: While to date, we have not experienced a significant compromise, attack, or loss of data related to cybersecurity attacks, due to the nature of our business, we are under constant threat of an attack and could experience a significant cybersecurity event in the future. Potential risks we could face from a cybersecurity event are discussed in "Risk Factors" above.


text: Through established governance structures, including our incident response plan, we have processes and procedures to help facilitate appropriate and effective oversight of cybersecurity risk. These processes and procedures enable our three lines of defense and management to review and manage cybersecurity risks, monitor threats, and provide for further escalation to executive management, our board-level Risk Committee, or to the full Board, as appropriate.


text: Role of the Board of Directors Our Board of Directors plays a critical role in the oversight of risk, including risks from cybersecurity threats, and has established a risk oversight structure that seeks to ensure that cybersecurity risks are identified, monitored, assessed, and mitigated appropriately. In that regard, our Board is actively engaged in the oversight of our cyber risk profile, which includes risks from cybersecurity threats, enterprise cyber strategy, and key cyber initiatives. Our Board regularly receives reports on such matters from our Information Security Officer, and other relevant personnel. Our Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters.


text: Our Board Risk Committee is responsible for assisting the Board in its oversight of risk, including cybersecurity threats, and for overseeing our enterprise risk management framework. The Board Risk Committee actively engages with our Chief Risk Officer and other members of management to discuss major risk exposures, establish risk management principles, and determine our risk appetite, and regularly reports on its activities, and makes recommendations to, the full Board. The Board Risk Committee receives a quarterly summary analysis of cybersecurity risks, threats, and incidents. In addition, the Board Risk Committee is engaged, as needed, in accordance with our Incident Response Plan.


text: Role of Management Our cybersecurity risk management program is built on three lines of defense, which collectively are designed to assess, identify, assess, and manage our material risks from cybersecurity threats. Our Chief Risk Officer is responsible for implementing our enterprise risk management framework and reports directly to our Chief Executive Officer.


text: Our first line of defense is our employees. Employees receive training, at least annually, on information security. In addition, our Information Security Officer provides ongoing information security education and awareness for teammates, such as online training classes, mock phishing attacks and information security awareness materials.


text: The second line of defense independently evaluates, monitors, and challenges our risk mitigation efforts to proactively identify cybersecurity risks, including early-stage engagement and risk management with emerging threats. Second line teammates provide effective challenge to the cybersecurity risk management efforts of the first line through ongoing engagement in problem incidents, regular reviews of cybersecurity risk reporting, and inquiries into the sufficiency of risk management activities. Our second line of defense leads our Management Risk and Compliance Committee, which governs our technology and operational risk tolerances, including cybersecurity and third- and fourth party provider risks. This committee includes the Information Security Officer, the SVP of IT and the Chief Risk Officer. The Committee is responsible for escalating key risks to our Executive Leadership Team.


text: Internal Audit serves as the third line of defense and provides independent assurance on how effectively we are mitigating, managing, and challenging our cybersecurity risks.


text: Cybersecurity, and in particular cybersecurity risk management, is an important part of operations and a focus area for the Company. Cybersecurity risks are evaluated on an ongoing basis by the Company's Technology department, both internally and with the assistance of external firms.

companyName: Alexander & Baldwin, Inc.

ticker: ALEX


text: The Company engages a national security firm in an effort to improve its cybersecurity posture and keep current with evolving cybersecurity risks. The Company's cybersecurity program is examined on a regular basis, and new procedures and tools are adopted on an ongoing basis to address the changing cybersecurity landscape. The Company's technology team tests the effectiveness of its tools with periodic exercises, such as an extensive, simulated attack exercise.


text: The Company's Board of Directors oversees the overall risk management process, including cybersecurity risks, which it administers in part through its Audit Committee. One of the Audit Committee's responsibilities involves reviewing the Company's policies regarding risk assessment and risk management, including with respect to cybersecurity risks. Risk oversight plays a role in all major decisions of the Company's Board of Directors, and the evaluation of risk is a key part of its decision-making process.


text: Cybersecurity risks are considered as part of the risk management process across all levels of the organization but are also facilitated through a formal process in which the Company identifies significant risks through regular discussions with management and also develops responses and mitigating actions to address such risks. In conjunction with the Company's Internal Audit department, management compiles a report of significant, enterprise risks that is shared with the Company's Board of Directors and its Audit Committee annually or as needed. In addition, cybersecurity and information security risks are among the matters presented by the Chief Technology Officer ("CTO") for discussion with the Company's Board of Directors annually and its Audit Committee quarterly or as needed. The CTO, who reports to the Chief Financial Officer, is responsible for leading the assessment and management of cybersecurity risks. The Company's current CTO has more than twenty years of experience managing technology initiatives in diverse industries, and he designed and led the approach for the modernization of the Company's technology platforms and security posture since 2017.


text: As many security threats involve social engineering, the Company has a multifaceted security training program for its employees. Mandatory cybersecurity training classes are administered semi-annually. Tests of employees' ability to thwart attacks are run successively throughout the year, and remedial refresher courses are required when employees fail the tests. In addition, security awareness assessment is required as part of the annual employee review process.


text: Given the nature of our operations and size, we may be more susceptible to cybersecurity threats. We acknowledge the possibility of breaches or unauthorized access to our systems, which could result in the loss or compromise of sensitive information. Any such incident could have a material adverse effect on our business, financial condition, and reputation.


text: The Company does not believe that any risks from cybersecurity threats to date, including as a result of any previous cybersecurity incidents of which the Company is aware, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial conditions. Refer to the risk factor captioned, "Security breaches through cyber attacks or intrusions, or other significant disruptions of the Company's information technology ("IT") networks, communications, and related systems could impair our ability to operate, adversely affect our financial condition, and damage our reputation," in Part I, Item IA. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: The Company engages a national security firm to improve its cybersecurity posture and keep current with evolving cybersecurity risks. The Company's cybersecurity program is examined on a regular basis, and new procedures and tools are adopted on an ongoing basis to address the changing cybersecurity landscape. The Company's technology team gauges the effectiveness of its tools with periodic testing and evaluations.


text: Cybersecurity risks are considered as part of the risk management process across all levels of the organization but are also facilitated through a formal process in which the Company identifies significant risks through regular discussions with management and also develops responses and mitigating actions to address such risks. In conjunction with the Company's Internal Audit department, management compiles a report of significant, enterprise risks that is shared with the Company's Board of Directors and its Audit Committee annually or as needed. In addition, cybersecurity and information security risks are among the matters presented by the Chief Technology Officer ("CTO") for discussion with the Company's Board of Directors annually and its Audit Committee quarterly or as needed. The CTO, who reports to the Chief Financial Officer, is responsible for leading the assessment and management of cybersecurity risks. The Company's current CTO has more than twenty-five years of experience in IT across diverse industries, and he has designed and led the approach for the modernization of the Company's technology platforms and security posture since 2017.


text: As many security threats involve social engineering, the Company has a multifaceted security training program for its employees. Mandatory cybersecurity training classes are administered semi-annually, and a security awareness assessment is given annually. Tests of employees' ability to thwart attacks are run successively throughout the year, and remedial refresher courses are required when employees fail the tests. Compliance reporting on these programs is included in the annual review process.


text: The Company does not believe that any risks from cybersecurity threats to date, including as a result of any previous cybersecurity incidents of which the Company is aware, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial conditions. Refer to the risk factor captioned, "Security breaches through cyber attacks or intrusions, or other significant disruptions of the Company's IT networks, communications, and related systems could impair our ability to operate, adversely affect our financial condition, and damage our reputation," in Part I, Item IA. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: Risk Management and Strategy Cybersecurity risk was identified as a significant enterprise risk based on the results of our most recent enterprise risk assessment. As a significant enterprise risk, management has worked to identify the underlying drivers of cybersecurity risk, identify the activities in place to manage it, and assess its residual risk level. We have developed and implemented comprehensive strategies and processes to assess, identify, manage and mitigate cybersecurity risks, aligning with the National Institute of Standards and Technology Cybersecurity Framework ("NIST-CSF"). These processes include: • implementing security event monitoring, incident response processes, access management controls, vulnerability identification and remediation, third-party risk monitoring, and user awareness and training; • providing regular security training and awareness content for all associates, with mandatory training for new hires; • maintaining cybersecurity risk insurance to mitigate potential breach-related costs; • engaging consultants to perform periodic external assessments using industry-recognized frameworks like NIST-CSF; and • monitoring program maturity through periodic reviews against the Capability Maturity Model Integration framework.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: Payment Card Industry compliance and incident response. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO, who has over 25 years of experience in the field of cybersecurity, including prior service in the military in cybersecurity roles, and relevant industry certifications commensurate with his role. Our CISO reports directly to the CIO who has over 20 years of technology leadership experience in various industries.

companyName: Bloomin' Brands, Inc.

ticker: BLMN


text: Risk Assessments We identify and categorize existing third-party service providers based on criticality to our operations and prioritize those that pose the highest risks. We leverage a third-party risk management solution to facilitate our risk assessment process for new third parties which includes interviews and questionnaires with internal business contacts and contacts from the third party to perform an inherent risk assessment. We determine applicable security controls based on the inherent risk level to drive the residual risk score to an acceptable level where possible. The goal of the assessment process is to evaluate the risks associated with each third party, including operational, financial, legal, and reputational risks.