text: Our cybersecurity program is led by a team of skilled cybersecurity professionals, including dedicated internal cybersecurity resources and external advisors. In the normal course of business, we may collect and store sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third-party information and employee information. We maintain a robust cybersecurity incident response plan, which details the incident response procedures, tactical and strategic team membership, and points of contact related to the response processes. The Company also maintains a detailed decision-tree-based playbook which is a supplement to the plan and focuses on specific types of incidents and the appropriate response steps. Cybersecurity is an important part of our Enterprise Risk Management ("ERM") program, and the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach. The Company's cybersecurity policies, standards, processes, and practices for assessing, identifying and managing material risks from cybersecurity threats and responding to cybersecurity incidents are fully integrated into the Company's ERM program. The plan and playbook are structured to align with the National Institute of Standards and Technology ("NIST") Cybersecurity framework practices. The plan and playbook are reviewed at least annually. In addition, we maintain insurance that includes cybersecurity coverage.

companyName: Metallus Inc.

ticker: MTUS


text: The Company adheres to a periodic, third-party facilitated testing exercise of the cybersecurity incident response plan and playbook with the Company's tactical and strategic team members. The teams are comprised of key members of the organization and external advisors who hold critical importance in the handling of cybersecurity events. The exercise covers response procedures for prevalent cybersecurity incidents including but not limited to phishing, third-party breaches, and a standard incident response process. The documentation helps leaders make appropriate, pre-planned decisions. To assist, appendices detailing generalized incident response checklists and workflows from the Cybersecurity & Infrastructure Security Agency ("CISA") and the NIST are referenced and used as a framework. Lastly, the response plans contain instructions on collecting and incorporating lessons learned after a successful identification and remediation of a security event. The information security team also works in partnership with the Company's internal audit team to review information technology-related internal controls with our external auditor as part of our overall internal controls process.

secItem: Item 1C


text: In addition, the rapid evolution and increased adoption of artificial intelligence ("AI") and similar machine learning technologies may intensify our cybersecurity risks. In 2024, we established an AI council comprised of a cross-functional group of employees with an objective to deliver value by providing education regarding the uses, benefits and risks of AI and similar technologies in our business, establishing a governance framework and principles for our use of AI, and enabling deliberate experimentation with new technologies employing AI. At this time, our use of AI is focused primarily on data analytics and improving product quality and asset reliability.

stage1Category: Risk Management Process

stage1Method: unanimous


text: In light of the pervasive and increasing threat from cyberattacks, the Board of Directors, with input from management, assesses the measures implemented by us to mitigate and prevent cyberattacks. The Company's Information Technology ("IT") leadership team consults with and provides regular updates to the Board of Directors, as well as our chief executive officer and other members of our senior management team, as appropriate, on technology and cybersecurity matters, the status of projects to strengthen our information security systems, assessments of the information security program, timely reports regarding any cybersecurity incident that meets established reporting thresholds, and emerging threat landscape. In addition, the Company has an IT governance committee, which is comprised of the chief executive officer, IT and other officers of the Company. The IT governance committee meets quarterly, and as necessary, to discuss the cybersecurity program and other relevant topics. The IT team also consults regularly with the Board of Director's cybersecurity expert in between meetings. Our program is evaluated by internal and external experts with the results of those reviews reported to senior management and the Board of Directors, at least semi-annually. The Board of Directors has oversight responsibility for our data security practices and we believe the Board of Directors has the requisite skills and awareness into the design and operation of our data security practices to fulfill this responsibility effectively.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.


text: See "Risk Factors – General Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information security systems.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data of our customers and employees ("Information Systems and Data").

companyName: Definitive Healthcare Corp.

ticker: DH


text: Our Information Security function is overseen by our Chief Technology Officer ("CTO"), our information security team, security management, engineering operations, legal, risk management, and various third-party service providers, including our virtual Chief Information Security Officer ("vCISO"). In doing so, they identify, assess and manage the Company's cybersecurity threats and risks, using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, conducting internal and/or external audits and threat assessments for internal and external threats, utilizing third-party threat assessments, conducting threat and vulnerability assessments, using external intelligence feeds, and using third parties to conduct tabletop incident response exercises and other tests.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan and incident response policy, incident detection and response capabilities, a vulnerability management policy, disaster recovery/business continuity plans, risk assessments, implementation of security standards and certifications for certain platforms, encryption of certain data, network security controls and data segregation for certain environments, access controls for certain systems, physical security, asset management, tracking and disposal, systems monitoring, incident response table-top exercises, vendor risk management program, employee training, penetration testing, cybersecurity insurance, and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. Cyber risk is addressed as a critical component of the Company's enterprise risk management program and is based upon entity-level controls found in our SOC2 compliance program, addressing all five trust service criteria: security, availability, confidentiality, privacy, and processing integrity. The Company recently received an unqualified opinion from an industry-recognized audit firm attesting to our SOC2 Type II compliance as of the date of such report.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms (such as outside legal counsel), penetration testing firms, threat intelligence service providers, dark web monitoring services, forensic investigators, cybersecurity software providers, managed cybersecurity service providers, and cybersecurity consultants.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires, risk assessments for each vendor, reviewing certain vendors' security assessments and written information security programs, the imposition of information contractual obligations, and, in certain instances, security assessment calls with select vendors' security personnel. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider, including providing third-party attestations of compliance with certain cybersecurity frameworks, such as SOC2 or ISO 27001.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our "Risks Related to Data Privacy and Cybersecurity" under Part 1. Item 1A. Risk Factors in this Annual Report.


text: Our audit committee of the board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of Information technology and Director of Information Security, each Senior Principal Security and Infrastructure Architect with over 20 years' experience managing large scale enterprise information technology and security systems and programs.

stage1Category: Management Role

stage1Method: majority


text: The CTO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The CTO is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Financial Officer, Chief Legal Officer and Chief Executive Officer in their role as executive leadership for the Incident Response Team. The executive leadership team will work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policy include reporting to the audit committee for certain cybersecurity incidents.


text: The audit committee receives quarterly reports concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

stage1Category: Board Governance


text: As part of our Enterprise Risk Management ("ERM") process, we identify risks and assign responsibility for managing each risk to the appropriate level of management. Cybersecurity is a risk identified in our ERM process. Management has implemented a comprehensive cybersecurity risk management strategy in line with industry standards and regulatory requirements. This strategy includes: • conducting an independent cybersecurity maturity assessment to evaluate the health of our overall cyber programs and developing a solid roadmap to continuously improve our defensive posture; • performing regular risk assessments, where we identify potential vulnerabilities and evaluate the likelihood of various cyber threats; • implementing security controls including email and browser protection, audit log monitoring, malware defenses, controlled use of administrative privileges, encryption protocols, and multi-factor authentication; and • implementing progressively challenging employee training and awareness programs, including simulated phishing campaigns, to reduce the risk of human error in the recognition and reporting of potential threats.

companyName: Acadia Healthcare Company, Inc.

ticker: ACHC


text: We continuously monitor our networks and systems and integrate threat intelligence feeds to evaluate evolving cyber threats. We conduct regular testing and simulation exercises, including engaging third-party service providers to perform penetration testing, to identify and address weaknesses in our defenses and engage third-party service providers to perform cybersecurity risk assessments, which are based on the National Institute of Standards and Technology framework. Cyber risks are considered and addressed for those third-party relationships deemed critical to our operations, as well as those with access to or custody of confidential data or customer non-public information, including PHI, and those services or products accessed in a cloud environment or involving generative artificial intelligence or other machine learning technologies.


text: Depending on the environment or system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, vulnerability management, disaster recovery and business continuity plans, risk assessments, achievement of certain security certifications, encryption of certain data, network security controls, data segregation for certain data, access controls, physical controls, systems monitoring, employee training, penetration testing, and asset management and disposal.

companyName: Silence Therapeutics plc

ticker: SLN


text: The Audit and Risk Committee of the board of directors has responsibility of oversight for our enterprise risk assessment and risk management systems. Our Chief Information Officer ("CIO"), Senior Director of Information Security and other delegated positions are responsible for assessing and managing our material risks from cybersecurity risks. Our CIO has 15 years of experience in cybersecurity and a degree in management information systems. We also have a Cybersecurity Infrastructure Committee that meets monthly. We have implemented an incident response strategy as an element of our overall risk management approach. Our incident response plan entails clearly-defined roles and responsibilities, established communication protocols and measures to mitigate the impact of any cybersecurity incidents. We have experienced adverse IT events in the past, but to date, we have seen no material impact on our business or operations from these attacks or events. We prioritize the detection, response, and recovery from potential breaches and carry cybersecurity insurance which includes cyber breach response services. The scope and coverage of our cybersecurity insurance is reviewed on an annual basis. Risks and potential threats are identified and measured through these monitoring, testing, and response processes procedures and significant risks, and threats are reported by the CIO to the Audit and Risk Committee.


text: Governance Related to Cybersecurity Risks Our board of directors is responsible for overseeing the Company's risk management process. Our board of directors focuses on our general risk management strategy and the most significant risks facing the Company, and works to ensure that appropriate risk mitigation strategies are implemented by management. Our board of directors also is apprised of particular risk management matters in connection with its general oversight and approval of corporate matters.

companyName: Paramount Group, Inc.

ticker: PGRE


text: Our board of directors has delegated oversight of the Company's risk management process to the Audit Committee of our board of directors (the "Audit Committee"). Among its duties, the Audit Committee reviews with management the Company's policies with respect to risk assessment and management of risks that may be material to us, including cybersecurity risk management. The Audit Committee receives, at a minimum, quarterly reports about legal and compliance matters, which can include reporting on cybersecurity incidents occurring or threats that have been thwarted or are being monitored during the prior period, as reported internally by the Chief Information Technology Officer ("CITO").


text: The CITO, who has served in this role for over nine years, regularly reports cybersecurity updates to our Chief Operating Officer who, in his dual role as Chief Financial Officer, is our primary liaison with the Audit Committee. To inform about these updates and help guide cybersecurity related activities across our organization, the CITO has assembled a cybersecurity focus group and steering committee that meets on a quarterly basis and is made up of experienced representatives from various of our cybersecurity risk management consultants, external network security experts and cloud storage providers. These meetings are chaired by the CITO and include discussion of our cybersecurity needs, taking into account the latest industry trends.


text: On an annual basis, the CITO presents to the Audit Committee a detailed overview of our IT department's operations, including staffing and risks inherent in this functional area in order to apprise the Audit Committee, among other things, of our cybersecurity risks, how they arise throughout our business and what management's mitigation strategies are. The Audit Committee periodically engages third-party specialists to perform maturity assessments of our cybersecurity program. The Audit Committee reports on these matters to our board of directors as needed. In addition, the CITO periodically presents directly to our board of directors on our cybersecurity program.


text: Cyber Risk Management and Strategy We face risks associated with security breaches through cyber attacks, cyber intrusions or otherwise, as well as other significant disruptions of our IT networks and related systems. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our data and systems. For more information about the cybersecurity risks we face, see Item 1A, Risk Factors. To help manage these risks, we have implemented and maintain a cybersecurity risk management program that includes processes for the identification, assessment, and treatment of cybersecurity risks. These assessments are aligned with industry standards and leading practices, and provide a comparison based on practices at comparable organizations and recommendations for management to consider. In addition to these external assessments, compliance readiness is assessed at a minimum annually by our CITO, in the form of penetration testing and vulnerability assessments. This program extends to a review of the cybersecurity measures in place at the properties that we own as well as our corporate headquarters, and selected senior managers also have participated in a tabletop exercise curated by our external security consultant to test and improve our incident response planning. We also maintain processes around third-party vendor risk management, such as the submission of vendor questionnaires to critical vendors and the inclusion of contractual security requirements as appropriate.


text: Certain information about our assessment and management of material risks from cybersecurity threats is included in risk management reports as applicable to senior leadership and the audit committee.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: threat intelligence providers, cybersecurity consultants and software providers, managed cybersecurity service providers, and penetration testing service providers.


text: The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of company data and systems along with other material risks to company operations, at least annually or whenever there are material changes to the Company's systems or operations. Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material breaches. As part of our risk management process, the Company engages outside providers to conduct periodic penetration testing and other cybersecurity audits. The Company stores company data in cloud environments with security appropriate to data involved and has adopted controls around, among other things, vendor risk assessment, information classification, access and acceptable use and backup and recovery.

companyName: LifeStance Health Group, Inc.

ticker: LFST


text: The Company's Senior Vice President of IT Security ("SVP of IT Security") has over 35 years of experience in the informational technology field, with 19 years of healthcare IT experience with an emphasis in IT security and computer forensics. The SVP of IT Security has operational responsibility for ensuring the adequacy and effectiveness of the company's risk management, control and governance processes, who periodically reports to the Operational Risk Committee ("ORC"), responsible for applying the policy decisions and, in coordination with the Chief Digital Officer and Chief Executive Officer, reports to the Board of Directors at least annually or more regularly at the discretion of the ORC.


text: The Audit Committee of the Board of Directors is briefed on cybersecurity risks at least once each calendar year and also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds. The SVP of IT Security reports quarterly to the Audit Committee and such report addresses overall assessment of the Company's compliance with this and other cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, recommendations for changes and/or updates to policies and procedures.


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats to our information systems. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and systems along with other material risks to our operations, at least annually or whenever there are material changes to our systems or operations. These processes include plans to be used in the event of a cybersecurity incident, including incident reporting and business continuity. As part of our risk management process, we engage outside providers to conduct periodic internal and external penetration testing. We store our data in cloud environments with security appropriate to the data involved and have adopted controls around, among other things, vendor risk assessment, access and acceptable use and backup and recovery. Although we have experienced cybersecurity incidents in the past, cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition.

companyName: TransMedics Group, Inc.

ticker: TMDX


text: Our executive team, along with our Audit Committee, assess and manage cybersecurity risk as part of our overall business strategy, financial planning and capital allocation. Our Audit Committee and Board of Directors engage with members of the executive team and are briefed on cybersecurity risks at least once each calendar year and with respect to any potentially material cybersecurity incidents. Our Chief Information Officer reports regularly, and at least annually, to our Audit Committee and such report may address overall assessment of our compliance with our cybersecurity policies, and include topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures. Our Chief Information Officer has served in various senior information technology roles, responsible for information security for over 20 years.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our clinical trial and related data, or Information Systems and Data.


text: Our information security function, which is led by our Vice President and Head of Information Technology, known as our Head of IT, and supported by our security management, risk management, and legal teams, helps identify, assess, and manage our cybersecurity threats and risks, including through the use of our risk register. The information security function identifies and assesses cybersecurity threats and risks by monitoring and evaluating our threat environment and risk profile using various methods including, for example: automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats, evaluating threats reported to us, coordinating with law enforcement concerning threats, internal and external audits, leveraging internal and third party threat assessments, conducting vulnerability identification assessments, and leveraging external threat intelligence.


text: Additional controls include vulnerability scanning, identity and access management, mobile device management and other various security controls. We also conduct periodic phishing tests and social awareness training for all employees, which include how to report and escalate suspected incidents.

companyName: Sterling Bancorp, Inc.


text: We use third-party service providers to perform a variety of functions throughout our business, such as software-as-a-service providers, hosting companies, contract research organizations, and contract manufacturing organizations. Depending on the nature of the services provided, the sensitivity of the critical systems, information and assets at issue, and the identity of the provider, we may conduct a review of security assessments provided by the vendor, review the vendor's written security program and/or requested security assessment and security questionnaire responses, and impose contractual obligations on vendors regarding their cybersecurity practices.

stage1Category: Third-Party Risk


text: For a description of the risks from cybersecurity threats that may materially affect us, please, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "Cybersecurity risks and the failure to maintain the confidentiality, integrity, and availability of our computer hardware, software, data and internet applications and related tools and functions, or those of third parties with whom we work, could result in damage to our reputation and/or subject us to costs, fines or lawsuits."

stage1Category: None/Other


text: Our board of directors addresses the review of our IT and cybersecurity risk management as part of its general oversight function. The board of directors' audit and risk committee is responsible for overseeing our cybersecurity risk management processes.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Head of IT, who has achieved ACC Internetworking Engineer and Global Secure Systems Internetworking Engineer qualifications and has over 25 years of experience leading international IT departments and owning responsibility for organizations' cybersecurity efforts.


text: Our Head of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Head of IT is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Executive Leadership Team, or ELT. The ELT works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified, in addition to notifying the audit and risk committee of the board of directors, as appropriate.


text: The board of directors' audit and risk committee receives annual reports from our Head of IT, concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit and risk committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: As required by Item 106 of Regulation S-K, the following sets forth certain information regarding our cybersecurity strategy, risk management, and governance.

companyName: PJT Partners Inc.

ticker: PJT


text: Cybersecurity Strategy and Risk Management Our Cybersecurity and Technology Risk Program (the "Program") is designed to protect critical assets, scale with business growth and identify and mitigate threats, enabling us to securely conduct the Company's business. The Program's design applies concepts from the frameworks of the National Institute of Standards and Technology ("NIST") as guidelines, incorporating their applicable principles while adapting certain elements to align with our specific operational needs and objectives. The Program and other cybersecurity processes have been integrated into our overall risk management framework.


text: Information Security Policies and Procedures As part of the Program, the Company has adopted Information Security Policies and Procedures ("ISP") that utilize concepts set forth in the NIST Special Publications and Internal/Interagency Reports and other industry-accepted guidance.


text: The ISP sets forth the controls and activities designed to protect our systems and data, such as establishing network perimeter security, managing system access, monitoring user activity and maintaining physical security. Other components of the Program related to assessing, identifying and managing risks from cybersecurity threats include annual cybersecurity training for all employees, regular review and update of our business critical and financial systems and the use of a variety of tools and methods to manage access to, and maintain the integrity of, our information systems. Our employees are critical in helping mitigate our cybersecurity risk and we continue to raise awareness and engagement through our formal training, frequent phishing campaigns and communication from our information security team with reinforcement from senior leaders across the Company. We also perform annual external penetration tests to identify certain potential vulnerabilities, and maintain a business continuity plan, which is tested annually.


text: The Company engages third parties to test and advise on the Program, including to conduct our annual external penetration test. At times, the Company may engage external experts to support the Program by, for example, facilitating an internal audit, advising on a cybersecurity incident or advising on legal and regulatory requirements.


text: Cyber Incident Response Plan The Company has adopted a written Cyber Incident Response Plan (the "Plan") to guide our response to cybersecurity incidents. The Plan established the Cyber Incident Response Team ("CIRT"), which is responsible for leading the Company's response in the event of a cybersecurity incident and is comprised of the Company's Chief Technology Officer ("CTO"), Chief Information Security Officer ("CISO") and Chief Operating Officer as well as other senior management.


text: Cybersecurity Risks We do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed more fully in "Part I. Item 1A. Risk Factors—Risks Relating to Our Business—Our business is subject to various cybersecurity and other operational risks" of this filing, the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents may be insufficient. Accordingly, our controls and procedures may not be able to address or limit all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Our Board retains responsibility for the oversight of management's role in assessing and managing cybersecurity risk. The Board is aware of the threats presented by cybersecurity incidents and is committed to taking measures to help prevent and mitigate the effects of any such incidents. The Company's management team, and either the CTO or the CISO or both, report at least twice annually to the Board on risks and issues including to evaluate the status of our cybersecurity efforts. The Board also discusses cybersecurity issues with external experts.


text: Management Oversight The CIRT also acts as a cybersecurity risk committee. The CIRT has responsibilities that include receiving and reviewing reports from the CTO and CISO on their management, monitoring and coordination of the Company's cybersecurity and technology risk management and any required remedial or corrective actions, reviewing reports from the CTO and CISO on the effectiveness of the ISP and serving as the primary response and escalation point for cybersecurity matters under the ISP.


text: CIRT members regularly report to the Operational Risk Committee, which is part of our overall risk management framework. The Operational Risk Committee is responsible for incorporating risk management considerations into our business activities. The Operational Risk Committee reports to the Executive Committee, our principal management-level policy-making committee that reports directly to the Board. Under the Plan, the Executive Committee is responsible for escalating and informing the Board about significant cybersecurity incidents and steps being taken by management to address them. In the event of an ongoing threat incident, the CIRT may engage directly with members of the Executive Committee in real-time.


text: Our CISO leads management's efforts to assess and manage cybersecurity risks through execution and enforcement of the Program, implementation of the ISP, reporting cybersecurity risks to senior managers of the Company, and meeting at least twice annually with the Board to discuss cybersecurity risks. The CISO works closely with the CTO, the Company's Executive Committee and other senior managers, including through his participation in the Operational Risk Committee and the CIRT. In addition to the processes described above, our CISO leads a team of information security specialists with which he holds dedicated cybersecurity meetings and regularly reviews key cybersecurity metrics. The information security team monitors public cybersecurity threats and meets with external experts periodically to review these threats and to stay abreast of the evolving threat landscape. Our CISO brings over 25 years of experience in the field of cybersecurity and technology infrastructure having held similar roles at leading global asset managers and investment banks. He has a broad technical background in information security strategy, risk management, and enterprise system design.


text: Information technology systems, including our mobile or online platforms, mobile payment and ordering systems, loyalty programs and various other online processes and functions, are critical to our business and operations. The Company faces risks associated with cybersecurity, including operational interruptions, financial losses, personal information leakage and non-compliance risks. For additional details on risks from cybersecurity threats, please refer to "Item 1A. Risk Factors — The occurrence of security breaches and cyber-attacks could negatively impact our business." and "—Unauthorized access to, or improper use, disclosure, theft or destruction of, our customer or employee personal, financial or other data or our proprietary or confidential information that is stored in our information technology systems or by third parties on our behalf could result in substantial costs, expose us to litigation and damage our reputation."

companyName: Yum China Holdings, Inc.

ticker: YUMC


text: Our information technology systems are protected through technological safeguards and management measures. We detect, identify, assess and mitigate cybersecurity risks by adopting standard risk management methodologies, which are developed based on the international cybersecurity management system standard ISO 27001 as well as the asset-oriented risk assessment framework. To minimize potential impact on business operations in the event of a cybersecurity incident, we have formulated, and regularly tested, our incident response plan. We also established a framework for data security and personal information protection, including measures to prevent data loss and detect and block abnormal accounts and activities, as well as systems and processes to prevent, detect and mitigate vulnerabilities. Our employees participate in regular cybersecurity training to enhance their awareness of cybersecurity risks. We engage in the periodic assessment of these processes and practices that are designed to address cybersecurity threats and incidents.


text: We regularly engage external consultants to assess and independently verify our cybersecurity risk management, striving for continuous optimization of our cybersecurity policies, cybersecurity risk management processes, and technical measures. These engagements assist us in ensuring our cybersecurity management practices and technical measures comply with applicable laws, regulations, industry standards and the Company's policies. The Company has maintained ISO/IEC 27001 certification since 2018 for certain online business.


text: We have established processes designed to manage cybersecurity threats associated with the use of third-party service providers. These processes include security evaluations before third-parties' admission, ongoing oversight and assessment of their security status, and adopting necessary security measures at termination of services.


text: Our Board of Directors maintains overall responsibility for overseeing the Company's risk management framework, and cybersecurity represents an important component of the Company's overall risk management framework. The Board regularly reviews risks that may be material to the Company. The Audit Committee assists the Board in the oversight of cybersecurity and other technology risks. Through receiving regular reports from the Chief Technology Officer ("CTO") and the Chief Legal Officer, the Audit Committee discusses with management cybersecurity risk mitigation and incident management, and reviews management reports regarding the Company's cybersecurity governance processes, incident response system and applicable cybersecurity laws, regulations and standards, status of projects to strengthen internal cybersecurity management, the evolving threat environment, vulnerability assessments, specific cybersecurity incidents and management's efforts to monitor, detect and prevent cybersecurity threats. On top of that, significant cybersecurity incidents will be immediately reported to the Board in accordance with the Company's incident response plan.


text: Yum China Compliance Oversight Committee (the "Compliance Committee"), primarily comprised of leaders and representatives from our information technology, supply chain, legal, finance, HR and public affairs functions, as well as internal audit group, is responsible for assisting the Board and Audit Committee in overseeing the Company's cybersecurity risks. The Compliance Committee meets regularly to discuss legal and regulatory developments on cybersecurity, assess the Company's emerging cybersecurity risks and mitigation plans, and determine strategy to promote cybersecurity compliance. Through ongoing communications, the Compliance Committee is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. Our CTO, as a member of the Compliance Committee, served various positions in the Company's information technology department for more than 20 years and began leading the department in 2017.


text: To its knowledge, the Company has not experienced a material cybersecurity breach within the last three years, nor identified any risks from cybersecurity threats that have materially affected us, including our business strategy, results of operations or financial condition. The Company maintains cybersecurity insurance as part of its overall insurance programs.


text: Risk Management and Strategy We recognize the importance of developing, implementing, and maintaining measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data and to address potential cybersecurity incidents that may materially affect our business.

companyName: Organogenesis Holdings Inc.

ticker: ORGO


text: Our information security team manages and enhances our cybersecurity infrastructure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. We utilize cybersecurity tools, including the NIST Cybersecurity Framework, in assessing the threat landscape and continuously monitoring our environment.


text: We face a number of cybersecurity risks in connection with our business. We have, from time to time, experienced threats to our data and systems, including malware and computer virus attacks. However, such risks and threats have not materially affected our business strategy, results of operations, or financial condition to date.


text: Third-party service providers and consultants Cybersecurity partners are a key part of our cybersecurity infrastructure. We partner with cybersecurity companies and leverage their technology and expertise to better protect the Company. From time to time, we engage certain vendors to monitor our environment, which includes an outsourced security operations center. We may also from time to time engage partners for periodic penetration testing and vulnerability assessments. Our third-party service providers, suppliers, and vendors face their own risks from cybersecurity threats that could potentially impact Organogenesis. We are developing and implementing processes for overseeing and managing these risks and are committed to maintaining robust governance and oversight of these risks. Those processes include assessing the third parties' cybersecurity practices and where applicable, requiring the third parties to implement appropriate cybersecurity controls and otherwise agree to contractual requirements designed to address cybersecurity risks in our agreements with them including conducting ongoing monitoring of their compliance with those requirements.


text: We have also identified the potential for cybersecurity risks stemming from the use of artificial intelligence (AI) tools developed by third parties. We have implemented policies and training programs to govern the use of AI by our employees. Additionally, the Company's Audit Committee regularly reviews our uses of AI as part of its ongoing risk oversight responsibility.


text: Our cybersecurity organization, led by our Assistant Vice President of IT and our Director of Information Security, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Within our team, our current Director of Information Security has professional cybersecurity certifications. The Company's Board of Directors administers risk management oversight through the Audit Committee of the Board. Our Audit Committee receives quarterly updates about the effectiveness of the Company's cybersecurity and information security programs, vulnerability and threat detection, progress relative to the Company's cybersecurity roadmap, and the status of projects to strengthen our information security systems. The Audit Committee discusses with Company management and the Board the Company's processes with respect to risk assessment and risk management.


text: We maintain a cyber risk management program which includes processes for identifying, assessing, and managing risks for all of our information technology ("IT") systems, services and applications, including cybersecurity threats. Our program aligns with industry standards, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the IMO guidelines.

companyName: Excelerate Energy, Inc.

ticker: EE


text: These processes include analyzing potential risks from the use of IT components and our use of third-party service providers, engaging third-party service providers to identify potential cybersecurity threats, conducting penetration tests to detect vulnerabilities, conducting employee trainings, monitoring network activities, ensuring patches are applied timely, analyzing and reacting to threat intelligence, and layering controls to prevent unauthorized access to IT assets. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition.


text: Our IT risk management processes are integrated into our Enterprise Risk Management (ERM) program, which is designed to identify and evaluate potentially material risks, the potential impact of these risks on the enterprise, as well as steps to control and mitigate those risks. Our ERM program is overseen by our Enterprise Risk Committee ("ERC"). Our ERC is comprised of various members of senior management, including our Chief Information Officer ("CIO") and internal audit and compliance department leaders. The ERC is responsible for the governance of enterprise risks assessments, identification and management of internal risks, and development of related mitigation strategies. See "Risk Factors – Information system failures, cyber incidents or breaches in security could adversely affect us" for further information on how cybersecurity threats could harm our business, financial condition, and results of operations.


text: If a cybersecurity incident were to occur, we would utilize our incident response plan. This plan governs our process of assessing the incident and our internal and external communications strategy. Our response would be led by our CIO, in coordination with other senior leaders. Depending on the nature and severity of an incident, we may escalate notification to our board of directors.


text: The cyber risk management program is overseen by our CIO who has over 20 years of experience in leading all aspects of IT. This is done in coordination with our Vice President, IT Audit and Security, who has over 25 years of experience in cybersecurity and other IT security roles, including the management of cybersecurity and compliance teams.


text: The Audit Committee of our board of directors ("Audit Committee") is responsible for the oversight of risks from cybersecurity threats and the process by which the board is informed about such risks. Our CIO reports to the Audit Committee on a periodic basis on data protection and cybersecurity matters. In addition, the Audit Committee receives regular updates on exposures, threats and mitigation plans directly from our IT department.


text: We rely on both internal information technology systems and networks, and those of third-party vendors and contractors, to acquire, transmit, store and otherwise process information in connection with our business activities. Our ability to effectively manage our business depends on the security, reliability and adequacy of our and our third-party contractors' and vendors' technology systems. As such, we have implemented an information security program designed to identify, assess, and manage risks from cybersecurity threats.

companyName: Xenon Pharmaceuticals Inc.

ticker: XENE


text: We perform risk assessments relating to cybersecurity and technology risks at least annually. Our cybersecurity risk management program has been developed based on industry standards, including those published by the National Institute of Standards and Technology ("NIST"). Highlights of the program include: • Corporate policies and procedures that guide our use of information systems, confidentiality and security strategy; • Identifying critical assets and high-risk threats, and implementing technical prevention and detection controls and response and recovery practices; • A third-party risk management process to assist in making risk-informed technology product and services decisions on third parties who provide, manage, store or have access to material data or information, including the completion of security questionnaires and independent assessments of controls, audits and/or contract terms; • Defined data loss prevention standards in place to detect and prevent data loss, including requiring third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices; • Security awareness training for employees to identify cybersecurity concerns and take appropriate actions; and • Evaluating our program's effectiveness by performing regular internal and third-party assessments of our controls, including external penetration testing and consultation on security enhancements.


text: The Audit Committee of our Board of Directors bears the primary responsibility for oversight of cybersecurity risks. The Audit Committee is composed of board members with diverse expertise, including risk management, technology and finance, equipping them to oversee cybersecurity risks effectively. Management's oversight is performed through an IT Strategy Committee, a subset of executive management including our Chief Financial Officer, or CFO, and Chief Legal Officer, and relevant functional expertise, including our Senior Vice President, Information Systems, or SVP, IS. Our SVP, IS, is the primary member of the IT Steering Committee charged with responsibility for assessing, monitoring and managing our cybersecurity risks. With over 20 years of experience in information technology strategy and operations, his background includes extensive experience as an IT executive at various companies. At least annually, the SVP, IS, and the CFO provide a comprehensive report to the Audit Committee regarding cybersecurity risk assessments, planned enhancements to our cyber security program, and incident reports and remediation, if any.


text: The SVP, IS, oversees processes for the regular monitoring of our information systems, including potential vulnerabilities. In the event of a cybersecurity incident, the IT organization and designated members of executive management follow an established Cybersecurity Incident Response Plan. This plan includes immediate actions to contain the threat, mitigate the impact and assess materiality, and requires retrospective review and identification of corrective actions to reduce future risk.


text: During the fiscal year ended December 31, 2024, we did not experience any material impact to our business, financial position or operations resulting from previously identified cyberattacks or other information security incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material breaches. For a discussion of these risks, see "Item 1A—Risk Factors—Risk Related to Our Business and Industry—Our business and operations could suffer in the event of an actual or perceived information security incident such as a cybersecurity breach, system failure, or other compromise of our systems and/or information, including information held by a third-party contractor or vendor."

stage1Category: Strategy Integration


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. This program includes: • Robust Firewalls and Intrusion Detection Systems: The company has invested in state-of-the-art firewalls and intrusion detection systems designed to prevent unauthorized access to its networks. • Regular Security Assessments: The company conducts regular security assessments to identify vulnerabilities and address them promptly. This includes penetration testing, vulnerability scanning, and third-party audits. • Employee Training and Awareness: The company provides comprehensive cybersecurity training to all employees to educate them about potential risks, phishing attacks, and best practices for protecting sensitive information. • Incident Response Plan: The company has developed an incident response plan that outlines the steps to be taken in the event of a cybersecurity breach. This includes isolating affected systems, investigating the breach, and notifying relevant stakeholders. • Cyber Insurance: The company has obtained cyber insurance coverage to mitigate the financial impact of a cybersecurity breach. This insurance policy covers expenses related to incident response, legal fees, and potential customer compensation.

companyName: Arcellx, Inc.

ticker: ACLX


text: By implementing these risk management strategies, we aim to minimize the likelihood and impact of a cybersecurity breach, thereby safeguarding our assets and maintaining the trust of our stakeholders.


text: We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Director of Information Technology, who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: Bain Capital seeks to remain aware of the evolving global threat landscape through vendor relationships, partnerships with threat intelligence providers and membership of industry forums/groups, as well as research performed by members of the Information Security Team. Bain Capital is currently an active member of the Financial Services Information Sharing and Analysis Center (FS-ISAC) and the Alternative Investment ISAC.

companyName: Bain Capital Specialty Finance, Inc.

ticker: BCSF


text: We engage assessors, consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. To oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with its work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function primarily through the audit committee.


text: Our Director of Information Technology and members of our cybersecurity committee (a management committee), which includes legal and privacy representatives, are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers. Our Director of Information Technology has expertise in security frameworks and standards (such as the Cybersecurity Framework established by the National Institute of Standards and Technology at the U.S. Department of Commerce), proficiency in security tools such as security information and event management systems, intrusion detection systems and vulnerability scanners, and has experience with threat intelligence, threat modeling, risk assessment, and risk management practices, as well as analyzing logs, investigating security incidents, and performing forensic analysis.


text: Our Director of Information Technology and members of our cybersecurity committee oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Director of Information Technology and members of our cybersecurity committee are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: Security Awareness Training, Patch Management Process, Endpoint Detection and Response, Managed Detection and Response, Incident Response Plan, Data Encryption, Access Control, Network Security, and Vulnerability Management.


text: Our Director of Information Technology, our Controller, and members of our cybersecurity committee provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: Risk Management and Strategy The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company relies on the cybersecurity strategy and policies implemented by Bain Capital, the parent of the Advisor and Administrator, which apply to the Company and its operations.


text: Bain Capital has adopted and implemented an Information and Cybersecurity Program ("Cybersecurity Program") that prioritizes detection and analysis of and response to cybersecurity threats, management of security risks and resilience against cyber incidents, including those that may impact the Company. The Cybersecurity Program aligns with National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and is reviewed and adjusted as needed and is approved by the Bain Capital's Chief Information Security Officer ("CISO").


text: Bain Capital's Cybersecurity Program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help prevent and respond to cybersecurity threats and incidents, including threats or incidents that may impact the Company, the Advisor or the Administrator. Bain Capital's cybersecurity risk management processes, which are part of Bain Capital's overall risk management system, seek to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessments of cybersecurity risks, including those which may impact the Company, the Advisor, or the Administrator, are reported to the Bain Capital Credit Risk Oversight Committee ("ROC") for awareness, review or action, as appropriate. In addition, the Company relies on Bain Capital to periodically engage with third-party consultants and key vendors to assist it in assessing, enhancing, implementing and monitoring its cybersecurity risk management processes and responding to incidents.


text: Internal and external networks, including the networks on which the Company relies, are assessed for vulnerabilities. Bain Capital also engages with independent third parties to conduct relevant technical assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on Bain Capital's Vendor Risk Management Program in conjunction with a Third Party Risk Management (TPRM) steering committee to assess risks posed when engaging with external vendors and/or third parties, including identifying and overseeing risks from cybersecurity threats associated with the Company's use of such entities.


text: In the event of a cybersecurity incident impacting the Company, the Advisor has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational and risk functions of Bain Capital, which may include coordinating with the relevant employees of the Advisor and management of the Company. The incident response plan includes notification to the applicable members of cybersecurity leadership, including Bain Capital's CISO, and, as appropriate, escalation to other relevant individuals.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with Bain Capital's CISO, as well as other risk management, legal, information technology, and/or compliance personnel of Bain Capital.


text: Material Impact of Cybersecurity Risks During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or that are reasonably likely to materially affect the Company, including our business strategy, operational results, and financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors— General Risk Factors— We are highly dependent on information systems, and systems failures or cyber-attacks could significantly disrupt our business, which may, in turn, negatively affect the value of our common stocks and our ability to pay distributions."


text: The Company's Board of Directors ("Board") provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO"), which incorporates updates provided by Bain Capital's CISO regarding the overall state of the Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents potentially impacting the Company.


text: Bain Capital's CISO and Information Security Team are responsible for the Cybersecurity Program applicable to the Company and, along with the Company's CCO, are responsible for assessing and managing material risks from cybersecurity threats that impact the Company. The CCO of the Company oversees the Company's oversight function generally and relies on Bain Capital's CISO to assist with assessing and managing material risks from cybersecurity threats. The Company's CCO has been responsible for this oversight function as CCO to the Company for 10 years and has more than 14 years' experience in information security, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company. Members of Bain Capital's management also possess relevant expertise in various disciplines that are key to effectively managing such risks, such as extensive experience in managing compliance risks in the financial sector, including those related to cybersecurity. Bain Capital's CISO has deep expertise in cybersecurity, holding the CISSP certification and having completed an Executive Master's in Cyber Security from Brown University and having received a Chief Risk Officer Certificate from Carnegie Mellon. Members of Bain Capital's Information Security Team hold various industry certifications and regularly attend trainings and industry conferences.


text: We maintain processes for identifying, assessing, and managing material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K) as part of our broader enterprise risk management program under the oversight of the Audit Committee of the Company's Board of Directors. These processes include a wide variety of mechanisms, controls, technologies, systems, and methods that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting data. We also use systems and processes to oversee and identify risks from cybersecurity threats associated with our third-party service providers.

companyName: Xperi Inc.

ticker: XPER


text: Our corporate information security organization is led by our Chief Information Officer ("CIO"), who brings over 30 years of information technology experience across a wide range of industry sectors, including semiconductor and technology. Before joining Xperi, our CIO was the Chief Information Security Officer for a large technology company. Our CIO oversees our cybersecurity strategy and the development of our cybersecurity capabilities, encompassing risk management and mitigation, incident prevention, detection, and remediation. Our CIO and corporate information security organization collaborate with technical and business stakeholders across our businesses to analyze risks and devise detection, mitigation, and remediation strategies. Additionally, they engage outside legal counsel, experts, consultants, and other third parties to conduct regular audits, assist with forensic investigations, and address cybersecurity threats and incidents. When necessary, they seek input from external experts and consultants on security industry and threat trends.


text: Significant incidents are reviewed by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as being or becoming potentially material is promptly escalated for further assessment and reported to designated members of senior management. Senior management is responsible for assessing the materiality of an incident, complying with any regulatory requirements, and communicating relevant information to the Audit Committee, as appropriate. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters.


text: Although the risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition to date, there can be no assurance that they will not be materially affected by such risks or a material incident in the future, or that we have not experienced an undetected cybersecurity incident. As discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to the Company, including potentially to our results of operations and financial condition. See "Risk Factors — If we or our third-party providers experience significant disruptions of our IT Systems or data security incidents, this could result in harm to our reputation, subject us to liability, cause us to modify our business practices, and otherwise materially adversely affect our business, results of operations, and financial conditions."


text: The Company's Board of Directors has oversight of our strategic and business risk management and has delegated cybersecurity risk management oversight to the Audit Committee of the Board. The Audit Committee oversees the guidelines and policies governing the process by which management assesses and manages our exposure to risk, including material risks from cybersecurity threats. The Audit Committee receives regular updates from management, including our CIO, regarding our cybersecurity risk management program, including cybersecurity risks, threats, incidents, and mitigation strategies.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our development programs and clinical trials (Information Systems and Data).

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: Our Information Technology (IT) department and Senior Director of IT, with the assistance of our legal department, help identify, assess and manage our cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating our and our industry's risk profile, evaluating threats reported to us and coordinating with law enforcement about such threats as may be appropriate, conducting internal and external audits, conducting internal threat assessments to evaluate for both internal and external threats, having third parties conduct threat assessments, and conducting vulnerability assessments designed to identify vulnerabilities.


text: Depending on the environment, systems and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, an incident response policy; incident detection and response processes; a vulnerability management policy; a disaster recovery plan; risk assessments; encrypting certain data; network security controls; data segregation; maintaining access and physical controls; asset management, tracking and disposal; systems monitoring; employee training; penetration testing conducted by third parties; maintaining cybersecurity insurance; and having dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program; (2) the IT department and Senior Director of IT discuss cybersecurity risk with management, including our legal department to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports certain risks to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms (including legal counsel), cybersecurity consultants, cybersecurity software providers, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as hosting companies, contract research organizations (CROs), and contract manufacturing organizations (CMOs). We have processes to manage cybersecurity risks associated with our use of certain of these providers. These processes include reviewing certain vendors' written security program and security assessments, and imposing certain contractual obligations related to cybersecurity on the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management processes may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see the section of this Annual Report on Form 10-K titled "Risk Factors", including, but not limited to, the risk factor titled "If our internal information technology systems or sensitive information, or those of our third-party CROs or other contractors or consultants, are or were compromised, we could experience adverse consequences from such compromise, including but not limited to, a material disruption of our product candidates' development programs, regulatory investigations or actions, litigation, fines and penalties, reputational harm, loss of revenue or profits, and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our personnel, including our Senior Director of IT, who has 20 years of experience in IT and cybersecurity and is a member of the Information Systems Audit and Control Association (ISACA).


text: Our Senior Director of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our General Counsel is responsible for approving budgets and, along with our Senior Director of IT, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability and patch management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CEO and General Counsel. Such management members work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from our Senior Director of IT concerning significant cybersecurity threats, related risks and the processes we have implemented to address them. The audit committee also has access to various reports, summaries and presentations related to cybersecurity threats, risks and mitigation.


text: Risk Management and Strategy We have implemented and maintain a comprehensive information security program designed to protect the confidentiality, integrity, and availability of our critical systems and information, as well as to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our systems and processes are assessed by independent third parties for compliance with: the International Standard Organization ("ISO") 27001; System and Organization Controls ("SOC") 2, Type 2; and Payment Card Industry Data Security Standards ("PCI DSS") Level 1.

companyName: Red Violet, Inc.

ticker: RDVT


text: Our information security program includes the following key elements to help identify, manage, mitigate, and respond to cybersecurity threats: • Risk assessments—We conduct risk assessments designed to help identify material cybersecurity risks, quantify the impact and probability of each risk, develop mitigating controls, and periodically reassess previously identified risks. • Testing—We conduct regular testing of our systems and controls to help identify and address potential vulnerabilities. • Technical safeguards—We utilize various technical safeguards to help protect our information systems from cybersecurity threats. We regularly review our technical safeguards and update them in accordance with recognized best practices and standards. • Business continuity and disaster recovery planning—We maintain business continuity and disaster recovery plans and periodically test those plans. • A cybersecurity incident response plan—We maintain a policy governing actions required for reporting and managing cybersecurity incidents. We have designated an Incident Response Team with clearly defined roles and responsibilities for managing all material aspects of our reporting and response plan. • Employee training and awareness programs—We provide training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees participate in annual training, including insider threat awareness, simulated phishing exercises, and other awareness training. • Third-party risk management —We maintain a third-party risk management program that is designed to help identify, assess, manage, mitigate, and respond to risks associated with the Company's suppliers and other third parties.


text: We regularly review our information security program and associated policies, making periodic updates as we deem necessary and appropriate in accordance with recognized best practices and standards.


text: Our information security program and cyber risk management program is managed and overseen by Jeff Dell, our Chief Information Officer ("CIO") and a team of information security personnel reporting to the CIO. Our CIO reports directly to the CEO and is responsible for the assessment and management of material risks for cybersecurity threats. Mr. Dell brings over 30 years of experience in information technology and information security, working as an executive within data-driven companies for the last 20 years, including serving as CIO since our formation in August 2017 and continuing through our Spin-off from cogint. Mr. Dell holds a Bachelor of Science in Business from Arizona State University and has earned GCIA, GCWN, GWAPT and CISSP certifications. For additional information regarding Mr. Dell's business experience, see Part 1, Item 1 Business – Information About Our Executive Officers included in this Annual Report.


text: Management holds monthly Information Security Management System (ISMS) meetings which include members of the executive management team as well as the CIO and other key individuals reporting to the CIO. Cybersecurity risks, threats, and vulnerabilities, as well as existing mitigating controls, are discussed in ISMS meetings. Our CIO also provides quarterly reports of our information security program, as well as any material cybersecurity risks, to the Board of Directors.


text: We did not experience a material cybersecurity incident during the year ended December 31, 2024, which has materially affected or is reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the possibility of future cybersecurity incidents, as well as cybersecurity and technology risks more generally, could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. See "Item 1A. Risk Factors – Cybersecurity and Technology Risks" for more information.


text: Risk management and strategy Cytokinetics recognizes the critical importance of developing, implementing, and maintaining cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity, and availability of our critical data.

companyName: CYTOKINETICS INC

ticker: CYTK


text: Managing Material Risks & Integrated Overall Risk Management Our cybersecurity team, led by our Chief Information Security Officer, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example, through manual and automated tools, internal and external audits, third-party threat assessments and third-party conducted red/blue team testing and tabletop incident response exercises and by subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments for internal and external threats and conducting vulnerability assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining an incident response plan, a vulnerability management policy, disaster recovery and business continuity plans and a vendor risk management program; conducting employee training, systems monitoring and penetration testing; implementing security standards, network security controls, access controls and physical security; encrypting and segregating data; though asset management, tracking and disposal; and maintaining cybersecurity insurance.


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a culture of cybersecurity risk management. This integration is designed to make cybersecurity considerations an integral part of our decision-making processes. Our risk management team works closely with our IT department and cybersecurity team to evaluate and address cybersecurity risks connected with our business objectives and operational needs.


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Cytokinetics engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights. Our collaboration with these third parties includes periodic audits, threat assessments, and consultation on security enhancements.


text: Oversee Third Party Risk Because we are aware of the potentially material risks from cybersecurity threats associated with third-party service providers, Cytokinetics implements processes to oversee and manage these risks. Depending on the nature of the services provided and the identity of the service provider, we may conduct security assessments of the provider before engagement and may monitor their compliance with our cybersecurity policies after engagement. The monitoring includes periodic assessments by our Chief Information Security Officer and on an ongoing basis by our security specialists. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Risks from Cybersecurity Threats For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the discussion under the headings "Our internal computer systems, or those of our CROs, CMOs, supply chain partners, collaboration partners or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our drug development programs" and "Significant disruptions of information technology systems or breaches of data security could adversely affect our business".


text: Cytokinetics' Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats. Our Board has established oversight mechanisms designed to ensure effective governance in managing material risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: In the event of a cybersecurity incident impacting us, the Corporation's cybersecurity risk management policy provides processes for responding to such an incident and facilitates coordination among the Corporation's officers and our third-party IT service provider. Depending on the nature of the incident, it may also be reported to the Board, if appropriate.

companyName: RAND CAPITAL CORP

ticker: RAND


text: Board of Directors Oversight The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise, including, risk management, technology, and finance. The Audit Committee reports to the Board of Directors periodically regarding cybersecurity topics presented to the Audit Committee, and all materials made available to the Audit Committee are available to rest of the Board of Directors.


text: Management's Role Managing Risk Our Chief Information Security Officer, Chief Executive Officer and Chief Financial Officer play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide cybersecurity briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including as applicable: the current cybersecurity landscape and emerging threats, the status of ongoing cybersecurity initiatives and strategies, incident reports and learnings from any cybersecurity events, and compliance with regulatory requirements and industry practices. In addition to our scheduled meetings, the Audit Committee, our Chief Information Security Officer, Chief Executive Officer and Chief Financial Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates from one another, as appropriate, on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Cytokinetics. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Management Personnel in Cybersecurity Primary responsibility for assessing, monitoring and managing our risks from cybersecurity threats rests with our Chief Information Security Officer, Mr. Eric Brown, Vice President of Information Technology. With over 10 years of experience in the field of cybersecurity and over 20 years of experience in IT more broadly, Mr. Brown brings a wealth of expertise to his role. His background includes extensive experience as an enterprise Chief Information Security Officer. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Chief Information Security Officer has overall responsibility for the Company's IT department and operations, including oversight over the cybersecurity team to ensure efforts to contain and remediate security incidents are sufficient and effective.


text: Monitor Cybersecurity Incidents The CISO is responsible for informing himself from appropriate sources about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CISO implements and oversees processes for the monitoring of our information systems. This includes the deployment of security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions designed to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors Our Chief Information Security Officer, in his capacity, regularly informs our executive management team of material cybersecurity risks and incidents. This is how executive management is kept abreast of our cybersecurity posture and potentially material cybersecurity risks facing Cytokinetics. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated by any of our executive officers to the Audit Committee, so that the Audit Committee can oversee and provide guidance on critical cybersecurity issues.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan based on National Institute of Standards and Technology (NIST) 800-61.

companyName: Commerce.com, Inc.

ticker: CMRC


text: We design and assess our program based on a combination of the International Organization for Standardization (ISO) 27001, Center for Internet Security (CIS) 18, and the National Institute of Standards and Technology Cybersecurity Framework (NIST). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register. Additionally, the cybersecurity team monitors activity on a continual basis and works with security management to prioritize our risk profile and mitigate cybersecurity threats that are more likely to lead to a material impact to our business on a monthly basis; executive management evaluates material risks from cybersecurity threats against our overall business objectives on a periodic basis and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk periodically.

companyName: Personalis, Inc.

ticker: PSNL


text: Our cybersecurity risk management program includes but is not limited to: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • an annual tabletop exercise conducted by a third party to simulate a cyber emergency and practice our response to such a scenario; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for relevant service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, could materially affect us, including our operations, business strategy, results of operations, or financial condition. See Risk Factors – "We store and process confidential information, including personal information of our customers and their shoppers. If we or our third-party providers fail to protect the security of this information and/or experience a data security incident, our reputation may be harmed and we may be exposed to material financial penalties and legal liability, which could materially adversely affect our business, results of operations, and financial condition."


text: Cybersecurity Governance Our Board of Directors and Audit Committee jointly oversee management's implementation of our security organization, which is charged with assessing and taking steps to mitigate the data privacy and cybersecurity risks that we face as a software-as-a-service platform.


text: The Board and Audit Committee receive regular reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also regularly receives briefings from management on our cyber risk management program. Board and Audit Committee members receive presentations on cybersecurity topics from our Chief Technology Officer and others within the Chief Technology Officer's team, as well as other internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.