text: We recognize that the safety and security of our systems, technology and infrastructure (and those of key third-party service providers upon which we rely), as well as our content and confidential or sensitive user and employee information, is critical to maintaining the trust and confidence of our users and subscribers, consumers, advertisers and investors (among other stakeholders). As a result, Company management has established programs and related processes designed to manage cybersecurity issues, including the assessment, identification and management of cybersecurity risks, together with related mitigation and recovery efforts. Our board of directors, directly and through our audit committee, oversees Company management in the execution of its cybersecurity responsibilities, including the assessment of the Company's approach to cybersecurity risk management.


text: As part of the ongoing refinement of our information security program, we engage (as appropriate) various third-party risk management services to assist with the identification of potential cybersecurity issues, such as those involving software vulnerabilities, configuration errors, data exposure and credential theft (among others), as well as consult with external legal counsel, third-party experts and other advisors to assist with incident response and recovery efforts, forensic investigations, extortion negotiations and crisis management or readiness for the same. We also maintain a cyber insurance policy to help manage, in part, costs associated with significant cybersecurity incidents that may occur.

companyName: IAC Inc.

ticker: IAC

secItem: Item 1C


text: In addition, as discussed in more detail below under the caption "Cybersecurity Governance," the assessment, identification and management of cybersecurity risks have been integrated into our overall enterprise risk management ("ERM") efforts.


text: Technical safeguards and incident response and recovery efforts. As part of our information security program, we have implemented a number of tools and procedures designed to identify and remediate vulnerabilities and misconfigurations in our applications and infrastructure, as well as manage access and identities throughout their lifecycles. These tools and procedures are intended to be consistent with ISO and NIST frameworks, In addition, we have implemented an incident response policy that outlines established processes for addressing cybersecurity issues that leverages a cross-functional cybersecurity incident response team and outside advisors intended to allow the Company to take action in a timely and decisive manner in compliance with applicable laws, rules and regulations during the response, investigation and remediation of a given cybersecurity incident.


text: Third-party risk management efforts. In addition to the assessment, identification and management of our own cybersecurity related risks, we also consider and evaluate cybersecurity risks associated with certain third-party service providers upon which we rely for a wide variety of technical and business functions. Our efforts in this regard consist of (among other efforts): (i) security assessments to determine whether key third-party service provider information security procedures meet our expectations, (ii) the use of a monitoring service that detects evidence of the compromise of key third-party provider systems, technology and infrastructure, (iii) assessments designed to identify business and technical risks to our systems, technology and infrastructure posed by key third-party service providers and (iv) the development of strategies to determine the potential adverse impact of, and develop mitigation strategies for, any cybersecurity incidents experienced by key third-party service providers on our business, financial condition and results of operations.


text: Education, training and preparedness efforts. Education, training and preparedness are an important part of our information security program. In connection with our education and training efforts, we have developed and implemented a set of Company-wide policies and procedures regarding cybersecurity matters that impose responsibility on our employees through the course of their work to: (i) protect our systems, technology, infrastructure and data from cybersecurity threats, (ii) quickly report known or suspected cybersecurity incidents or other suspicious activity through designated channels and respond effectively to such events and (iii) use Company and personal information technology in a secure manner. In addition, we generally mandate information security training for our employees and our software developers generally receive additional technical training, each on an annual basis. In connection with our preparedness efforts, we periodically conduct tabletop exercises with the goal of helping management effectively respond to cybersecurity incidents that may occur. We also maintain documented incident response policies to help ensure that our response activities are consistent and appropriate. Governance. See the disclosure under the caption "Cybersecurity Governance" below.

stage1Category: Risk Management Process

stage1Method: unanimous


text: Cybersecurity Governance Our board of directors is responsible for overseeing Company management's execution of its cybersecurity responsibilities, including our approach to cybersecurity risk management. Our board of directors executes this oversight in coordination with our audit committee, which pursuant to its charter, assists the board of directors with risk assessment and risk management policies as they relate to cybersecurity risk exposure (among other risk exposures), as well as part of its regularly scheduled meetings and through discussions with Company management on an as needed basis.

stage1Category: Board Governance


text: In addition, the assessment, identification and management of cybersecurity risks has been integrated into our ERM efforts. As part of that annual process, cybersecurity risks across our businesses are included in the risk universe that our Executive Risk Committee (consisting of members of Company senior management) evaluates to identify our top enterprise risks and develop related mitigation plans. The cybersecurity and other risks are reviewed during the year through our ERM process and discussed with our audit committee at least semi-annually and with our board of directors at least annually.


text: Our Chief Information Security Officer ("CISO") is responsible for the development and implementation of our information security program on a Company-wide basis, together with a dedicated team of experienced, Company-wide information security analysts. Our CISO has over twenty-five years of experience leading the development, implementation and oversight of information security programs and members of the information security team have relevant certifications, educational and industry experience.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity and, will, from time to time, brief the full Board on our cybersecurity risk management program. From time to time, our Committee members receive presentations on cybersecurity topics from our internal or external experts as part of its continuing education on topics that impact public companies.

companyName: Opendoor Technologies Inc.

ticker: OPEN


text: Our CISO is also responsible for reporting on the status of our information security program and related efforts and processes to Company senior management periodically, and to the audit committee on a quarterly basis. In addition, our CISO reports cybersecurity matters to Company senior management and the audit committee on an as-needed basis. At each regularly scheduled meeting of our board of directors, the Chair of our audit committee provides quarterly updates regarding significant matters discussed, reviewed, considered and approved by the committee since the last regularly scheduled board meeting (including cybersecurity matters, as and if applicable), as well as timely updates outside of quarterly updates on an as needed basis. Lastly, our CISO promptly informs Company management and our audit committee of cybersecurity incidents that meet established reporting thresholds or when otherwise determined appropriate, as well as provides ongoing updates regarding such incidents until they have been resolved.


text: Cybersecurity Risks As discussed above and under " Item 1A —Risk Factors—Risk Factors—General Risk Factors," we face a number of cybersecurity risks across our various businesses, and from time to time we have experienced threats to and unauthorized intrusions of our systems, technology and infrastructure. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. While we have implemented a risk management process designed to mitigate cybersecurity risks that arise from utilizing third-party service providers, suppliers, and vendors, our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.

stage1Category: Third-Party Risk

stage1Method: majority


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes multiple layers of security controls, including network segmentation, security monitoring, endpoint protection, and identity and access management, as well as a cybersecurity incident response plan.


text: We assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). While we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business, this does not imply that we meet any particular technical standards, specifications, or requirements, and our maturity varies across our cybersecurity program.


text: Our cybersecurity risk management program considers cybersecurity risks alongside other company risks as part of our overall cybersecurity risk assessment process, and shares common methodologies, reporting channels and governance processes that apply to other risks impacting the company, such as regulatory, financial and operational risks.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of vulnerability scans and penetration testing; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management, including annual incident training, regular phishing email simulations and tabletop exercises to simulate incident responses; • a robust cybersecurity incident response plan that includes documented procedures for preparing for, detecting, responding to and recovering from cybersecurity incidents, as well as processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident; and OPENDOOR TECHNOLOGIES INC. • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. See "Item 1A. Risk Factors" for additional discussion regarding the risks we face from cybersecurity threats.

stage1Category: Strategy Integration


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives reports at least annually from our Chief Technology Officer and management on our cybersecurity risk management and strategy, including, as applicable, progress towards our risk-mitigation goals, results from third-party assessments, and the emerging threat landscape. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our Chief Technology Officer, in coordination with our Head of Security and our internal security staff, is responsible for assessing and managing our material risks from cybersecurity threats, and has primary responsibility for our overall cybersecurity risk management program and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants.

stage1Category: Management Role


text: Our Chief Technology Officer, who possesses a 25-year track record in overseeing technology, 15 of which includes oversight of information security systems, reports directly to our Chief Executive Officer. This extensive experience spans both public and private companies and includes over a decade as the dedicated key individual responsible for cybersecurity. Our Head of Security, who leads our internal security staff and reports directly to our Chief Technology Officer, has over 20 years of software development experience, ten of which have focused on cybersecurity, and includes managing information security systems, developing cybersecurity strategy and implementing effective information and cybersecurity programs.


text: Our Chief Technology Officer and Head of Security supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, and alerts and reports produced by security tools deployed in the IT environment, such as regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; OPENDOOR TECHNOLOGIES INC.


text: • the use of vulnerability scans and penetration testing; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management, including annual incident training, regular phishing email simulations and tabletop exercises to simulate incident responses; • a robust cybersecurity incident response plan that includes documented procedures for preparing for, detecting, responding to and recovering from cybersecurity incidents, as well as processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have experienced a limited number of immaterial cybersecurity incidents in the past, regularly experience cybersecurity attempts, and expect that we will continue to experience varying degrees of cybersecurity attempts and incidents in the future. To date, we have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. See "Item 1A. Risk Factors" for additional discussion regarding the risks we face from cybersecurity threats.


text: The Committee receives updates at least annually from our Chief Technology and Product Officer and management on our cybersecurity risk management and strategy, including, as applicable, progress towards our risk-mitigation goals, results from third-party assessments, and the emerging threat landscape. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity and, will, from time to time, brief the full Board on our cybersecurity risk management program. From time to time, our Committee members receive presentations on cybersecurity topics from our internal or external experts as part of its continuing education on topics that impact public companies.


text: Our Chief Technology and Product Officer, in coordination with our internal security staff, is responsible for assessing and managing our material risks from cybersecurity threats, and has primary responsibility for our overall cybersecurity risk management program and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our Chief Technology and Product Officer, who possesses a 20-year track record in product development and engineering, eight years of which consist of overseeing technology, including the oversight of information security systems, reports directly to our Chief Executive Officer. This extensive experience spans both public and private companies.


text: Our Chief Technology and Product Officer supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, and alerts and reports produced by security tools deployed in the IT environment, such as regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises.


text: Risk Management and Strategy Due to the sensitivity of the personal information, including protected health information, or PHI, that the Company and its subsidiaries store and transmit, in the ordinary course of business, identifying, assessing, and managing material cybersecurity risks is an important component of the Company's overall cybersecurity and enterprise risk management program.

companyName: CLOVER HEALTH INVESTMENTS, CORP. /DE

ticker: CLOV


text: We maintain a cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework's guidance and HIPAA, which applies to the Company and each of its subsidiaries. The cybersecurity program seeks to protect the enterprise against threats from cybersecurity risks, to comply with applicable laws and regulations, and to establish and enhance our processes for responding to cybersecurity events.


text: Among other things, the program includes the following components: • security event monitoring and detection; • extended detection and response; • vulnerability scanning; • security awareness and privacy training for personnel; • phishing simulations; and a cybersecurity incident response team. The Company also engages third-party vendors and consultants, respectively, to perform audits and penetration tests.


text: The Company and its subsidiaries' third-party service providers collect, process, and store certain information, including PII, PHI, or other confidential and proprietary information. We maintain a third-party vendor security risk management program to assess the cybersecurity risk and measures taken by such service providers. The program includes a dedicated third-party risk assessor, security risk reports, and formal business owner risk response.


text: During the period covered by this report, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Risks from cybersecurity threats, however, in the future may, among other things, cause material disruptions to our or our subsidiaries' operations, which may materially affect our liquidity, results of operations and financial condition, as well as damage our reputation. For additional information related to risks from cybersecurity threats, please refer to Item 1.A. — "Risks Related to Our Business and Industry — Our failure to protect our sites, networks, and systems against security breaches, or otherwise to protect our confidential or health information or the confidential or health information of our beneficiaries, providers, or other third parties, would damage our reputation and brand, and substantially harm our business and results of operations."


text: The Company's Board of Directors (the "Board") oversees the Company's overall risk management program, and has assigned oversight of cybersecurity risk management to its Audit Committee. The Audit Committee reviews the adequacy and effectiveness of the Company's cybersecurity policies and internal controls regarding information and cybersecurity, and together with the full Board, regularly receives reports from our and our subsidiaries' management, including our Chief Information Security Officer (the "CISO") on cybersecurity matters, including, but not limited to: Security Awareness, Internal Risk, Third-Party Risk, IR / DR Readiness, Access Control IAM/PAM, HIPAA Security Rule Compliance, Phishing, Security Monitoring, Vulnerability Management, Application Security, Governance, Data Security, and Cloud Security.


text: Depending on the circumstances, information regarding cybersecurity risks and incidents may be elevated from the CISO and his team through a variety of different channels, including risk response forms as part of our formal security risk process, discussions with the Audit Committee and reports to the Board on a quarterly basis.


text: The Company's CISO is responsible for developing and managing the cybersecurity program, including security incident response, remediation, and setting security policy and standards required by applicable law or regulation. The CISO holds a dual-accredited Executive MBA, and Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), Certified Data Privacy Solutions Engineer (CDPSE) certifications. The security team holds multiple certifications including but not limited to CISSP, CRISC, CCSFP, and AWS CP, a bug bounty hall of fame member, and a range of experience with different firms. The CISO is informed by the cybersecurity team about the prevention, detection, mitigation, and remediation of cybersecurity incidents through general communications, and reporting. The cybersecurity team is made aware of security risks and incidents by various means including our SIEM, assessments, audit, threat feeds, and security team connections and network.


text: Among other things, the program includes the following components: • security event monitoring and detection; • extended detection and response; • vulnerability scanning; • security awareness and privacy training for personnel; • phishing simulations; and • a cybersecurity incident response team. The Company also engages third-party vendors and consultants, respectively, to perform audits and penetration tests.


text: The Company and its subsidiaries' third-party service providers collect, process, and store certain information, including PII, PHI, or other confidential and proprietary information. We maintain a third-party vendor security risk management program to assess the cybersecurity risk and measures taken by such service providers. The program includes a third-party risk assessor, security risk reports, and formal business owner risk response.


text: During the period covered by this report, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Risks from cybersecurity threats, however, in the future may, among other things, cause material disruptions to our or our subsidiaries' operations, which may materially affect our liquidity, results of operations and financial condition, as well as damage our reputation. For additional information related to risks from cybersecurity threats, please refer to Item 1.A. — "Risks Related to Our Business and Industry — Our failure to protect our sites, networks, and systems against security breaches, or otherwise to protect our confidential or health information or the confidential or health information of our members, providers, or other third parties, could damage our reputation and brands, and substantially harm our business and results of operations."


text: The Company's Board of Directors (the "Board") oversees the Company's overall risk management program, and has assigned oversight of cybersecurity risk management to its Audit Committee. The Audit Committee reviews the adequacy and effectiveness of the Company's cybersecurity policies and internal controls regarding information and cybersecurity, and together with the full Board, regularly receives reports from our management, including our Chief Information Security Officer (the "CISO") on cybersecurity matters, including, but not limited to: AI Security, Security Awareness, Internal Risk, Third-Party Risk, IR / DR Readiness, Access Control IAM/PAM, HIPAA Security Rule Compliance, Phishing, Security Monitoring, Vulnerability Management, Application Security, Governance, Data Security, and Cloud Security.


text: The Company's CISO is responsible for developing and managing the cybersecurity program, including security incident response, remediation, and setting security policy and standards required by applicable law or regulation. The CISO holds a dual-accredited Executive MBA, and Certified Information Security Manager ("CISM"), Certified Information Systems Auditor ("CISA") and Certified Data Privacy Solutions Engineer ("CDPSE") certifications. The security team holds multiple certifications including but not limited to CISSP, CRISC, CCSFP, and AWS CP, a bug bounty hall of fame member, and a range of experience with different firms. The CISO is informed by the cybersecurity team about the prevention, detection, mitigation, and remediation of cybersecurity incidents through general communications, and reporting. The cybersecurity team is made aware of security risks and incidents by various means including our SIEM, assessments, audit, threat feeds, and security team connections and network.


text: The Company's information security program is managed by a dedicated Chief Technology Officer ("CTO"), who has over 25 years of professional experience within information technology roles, including 15 years of security consulting experience. The CTO leads the information technology department, which is responsible for enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Company's Cybersecurity Incident Response Committee (the "CIRC"), which is comprised of the Company's CTO, Chief Financial Officer, General Counsel, Senior Vice President of Financial Reporting and Technical Accounting, and Senior Director of Internal Audit, meets periodically and more often, as needed, in the event cybersecurity incidents are identified.

companyName: MP Materials Corp. / DE

ticker: MP


text: As part of the Company's overall risk assessment process, the enterprise risk management framework considers cybersecurity risk alongside other company risks. The Company's internal audit department collaborates with the Company's information technology department to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations. The Company actively engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to evaluate and enhance the effectiveness of its information security policies and procedures.


text: In addition, the Company's vendor management program addresses cybersecurity risks associated with its use of third-party service providers including suppliers, software and cloud-based service providers. The Company proactively evaluates the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, threat intelligence during contracting, and vendor selection processes. Security issues are documented and tracked, and periodic monitoring of third parties is conducted in an effort to mitigate risk.


text: The Company's CTO provides periodic reports to the Audit Committee of the Company's Board of Directors, as well as the CIRC, as appropriate. These periodic reports include updates on the Company's cyber risks and threats, the status of projects to strengthen its information security systems, assessments of the information security program, and the emerging threat landscape. The information security program is regularly evaluated by the CTO with the results of those reviews reported to the CIRC, the Audit Committee of the Company's Board of Directors, and the Board of Directors, as appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected nor are they reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: The Company's information security program is managed by a dedicated Chief Technology Officer ("CTO"), who has over 25 years of professional experience within information technology roles, including 15 years of security consulting experience. The CTO leads the information technology department, which is responsible for enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Company's Cybersecurity Incident Response Committee (the "CIRC"), which is comprised of the Company's CTO, Chief Financial Officer, General Counsel, Senior Vice President of Financial Reporting and Technical Accounting, and Vice President of Internal Audit, meets periodically and more often, as needed, in the event cybersecurity incidents are identified.


text: As part of the Company's overall risk assessment process, the enterprise risk management framework considers cybersecurity risk alongside other company risks. The Company's internal audit department collaborates with the Company's information technology department to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations. The Company actively engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to evaluate and enhance the effectiveness of its information security policies and procedures. Additionally, the Company provides cybersecurity awareness training to its employees, incident response personnel, and senior management.


text: Furthermore, the Company's vendor management program addresses cybersecurity risks associated with its use of third-party service providers including suppliers, software, and cloud-based service providers. The Company proactively evaluates the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, threat intelligence during contracting, and vendor selection processes. Security issues are documented and tracked, and periodic monitoring of third parties is conducted to mitigate risk.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats (including those associated with third-party service providers), and have integrated these processes into our overall enterprise risk management systems and processes. We routinely assess material risks from cybersecurity threats, including taking reasonable steps to detect any potential unauthorized occurrence on or behaviors conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Skillz Inc.

ticker: SKLZ


text: Risk Management and Strategy We have implemented policies and processes designed to detect, prevent, and respond to cybersecurity incidents. All these policies are reviewed annually and updated as needed to address emerging risks or gaps in compliance. The Company has not experienced a material cybersecurity incident to date. If a material cybersecurity breach occurs, the incident will be reviewed to determine whether further escalation is appropriate. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive leadership team and if deemed necessary, the Board of Directors. We plan to consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and make the final materiality determination regarding disclosure and other compliance decisions. We also plan to keep our independent public accounting firm informed of such incidents as appropriate. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. Although our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: Role of the Board and Management Our Board of Directors has the ultimate responsibility for oversight of our risk management framework. The Board receives information and periodic updates and actively engages with management with respect to the effectiveness of the Company's cybersecurity and information security framework, data privacy, and risk management. In addition, as necessary, the Board of Directors receives reports summarizing threat detection and mitigation plans, audits of internal controls, training and certification, and other cyber priorities and initiatives, as well as timely updates from management on material incidents relating to information systems.


text: Role of Other Employees Members of the Company's technology and security team periodically discuss cybersecurity program updates and challenges, to watch for potential threats from both external and internal sources, to monitor compliance in existing or emerging business practices, and to respond to stakeholder inquiries. This is composed of individuals with over 10 years of software, infrastructure, and security experience. The Company is continuously monitoring trends and stays current with the various cybersecurity threats and related mitigation opportunities. The Company periodically engages a third-party service provider to perform an external vulnerability scan of the Company's network to identify known threats and to date no critical vulnerabilities have been identified during these assessments.


text: We take a comprehensive approach to cybersecurity risk management. While securing our customers and stakeholders' data is a top priority, like many companies with a public presence, we are subject to human-targeted and AI-assisted cyberattacks. Our board of directors (the "Board") and our management are involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices designed to assess, identify, and manage material risks from cybersecurity threats. We have devoted significant financial and personnel resources to implement and maintain security measures in an effort to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments in our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be effective, as cyber criminals are becoming more sophisticated and effective every day and increasingly targeting enterprise software companies. Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that such incidents will not materially affect us, including our business strategy, results of operations, or financial condition. For the year ended December 31, 2024, we are not aware of any material cybersecurity incidents that had a significant impact on our operations or financial condition. For more information on our cybersecurity related risks see the risk factor entitled "We rely on information technology ("IT") and other systems and platforms, and any failures, errors, defects or disruptions in our or our vendors' or other partners' systems or platforms could diminish our brand and reputation, subject us to liability, disrupt our business, affect our ability to scale our technical infrastructure and adversely affect our business, financial condition, operating results and growth prospects" in Part I, Item 1A Risk Factors of this Annual Report on Form 10-K, above.


text: Risk Management and Strategy Our policies, standards, processes and practices designed to assess, identify, and manage material risks from cybersecurity threats are integrated into our overall risk management program. These policies, standards, processes, and practices are based on maintaining a security-in-depth methodology as informed by the National Institute of Standards and Technology ("IST") Cybersecurity Framework, the International Organization for Standardization ("ISO")/IEC 27001 and other applicable industry standards. Key controls include: (a) Zero trust network architecture for employee privileged and non-privileged application access (b) Mandatory employee security awareness training and phishing simulations, plus follow-up remedial training if necessary,(c)Periodic third-party network and host vulnerability scans and (d) 24/7 Security Operations Center monitoring all corporate endpoints which escalates to senior engineering resources as necessary for incident response and remediation. We also maintain a cyber insurance policy to mitigate financial exposure from any security incidents.


text: We use third-party service providers to assist us from time to time to identify and monitor material risks from cybersecurity threats, including legal counsel and other professional services firms, threat intelligence services, and cybersecurity consultants.

companyName: MediaAlpha, Inc.

ticker: MAX


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet periodically to develop strategies designed to preserve the confidentiality, integrity and availability of Company and customer information, identify, prevent and mitigate cybersecurity threats, and to attempt to effectively respond to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in an informed and timely manner.


text: We conduct a cybersecurity risk assessment at least annually that takes into account information from internal resources (e.g., vulnerability scans, incident reporting), known information security vulnerabilities, and information received from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants).


text: Technical Safeguards We periodically assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are periodically evaluated and improved as necessary, based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: Incident Response and Recovery Planning We have established comprehensive incident response ("IR") and recovery plans and continue to periodically test and evaluate the effectiveness of those plans. Our IR plan provides our team with strategies for how to respond to incidents appropriately.


text: Third-Party Risk Management We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers may be subject to security risk assessments at the time of onboarding, contract renewal, or upon detection of an increase in risk profile, according to our vendor security review process. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties.


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We periodically remind and reinforce with our employees the importance of handling and protecting customer and employee data, including through annual privacy and security training designed to enhance awareness of how to prevent, detect, report, and respond to cybersecurity threats. We also conduct periodic phishing training and follow-up with remedial testing and training as necessary.


text: External Assessments Our cybersecurity policies, standards, processes and practices are periodically assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. For example, in 2022, 2023 and 2024 we conducted independent cyber maturity assessments to review our controls against portions of the NIST Cybersecurity Framework. We also have achieved PCI SAQ-A Compliance every year since 2019. The results of significant assessments are reported to management, the Board and Audit Committee. Cybersecurity processes are adjusted, as appropriate, based on the information provided from these assessments.


text: Our Principal Security Engineer ("PSE") is responsible for the day-to-day assessment and management of our material cybersecurity risks. Since November 2021 until May 2025, the Principal Security Engineer (the "PSE-1") that served in this role had more than 18 years of experience in various information technology, cybersecurity and systems engineering roles. PSE-1's previous experience includes building and leading cybersecurity functions at large enterprises, startups, and research and development centers, as well as leading software teams which were acquired by Fortune 50 enterprises. PSE-1 also had expertise in building and designing secure software, scalable and resilient systems, incident response practices, privacy programs and other critical security disciplines and practice areas. The Principal Security Engineer holds a master's degree in physics and systems engineering. Since May 2025, the Company's Manager of IT ("PSE-2") has assumed the responsibilities of the Principal Security Engineer role. With more than 18 years of experience in information technology and over 12 years in IT management across technology-driven and interactive entertainment organizations, PSE-2 has frequently led both IT operations and cybersecurity initiatives, often as the sole technical lead. Responsibilities have included securing infrastructure, implementing security controls, and supporting secure business operations.


text: To ensure robust oversight, we are establishing a Security Council, led by our Principal Security Engineer, that is comprised of senior leaders, including our Chief Executive Officer, Controller, Chief Financial Officer, and Interim General Counsel. The Security Council has primary management oversight responsibility for assessing and managing risks related to information security, fraud, vendor oversight, data protection and privacy, and our cybersecurity program, as well as responsibility for management of our information security systems.


text: Risk management and strategy We have implemented and maintain information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature ("Information Systems and Data").

companyName: Origin Materials, Inc.

ticker: ORGN


text: The Board is responsible for overseeing the Company's enterprise risk. The Security Council reports to the Board on cybersecurity risks. In addition to our ongoing ordinary course cybersecurity oversight procedures, we also have a security incident response framework in place. We use this incident response framework as part of the process we employ to keep our management and the Board informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The framework is a set of coordinated procedures and tasks that our incident response team, under the direction of the Security Council, executes in the event of a cybersecurity incident that is designed to provide timely and accurate information flow, escalation for remediation and consideration of public disclosures, and resolution of cybersecurity incidents. Our cybersecurity framework includes periodic compliance assessments with our policies and standards and applicable state and federal statutes and regulations. In addition, we seek to validate compliance with our internal data security controls through the use of security monitoring utilities and internal and external audits. We also conduct annual cybersecurity tabletop exercises, with the intent of validating our IR policies and procedures.


text: The Director of IT and General Counsel are responsible for helping to identify, assess and manage the Company's cybersecurity threats and risks by monitoring and evaluating our threat environment using, among other things, manual processes, automated tools, internal audits, threat and vulnerability assessments, evaluating threats reported to us, evaluating our and our industry's risk profile, and subscribing to reports and services that identify cybersecurity threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include, for example, an incident response plan and team, data encryption, risk assessments, network security and access controls, physical security, asset management, tracking, and disposal, systems monitoring, employee training including tabletop exercises and other simulated cybersecurity threats, and cybersecurity insurance. In addition, to oversee and identify any risks associated with our use of third-party service providers, we review Service Organization Controls ("SOC") reports of such third-party service providers when onboarding the provider and annually thereafter. We also maintain proper essential information sharing and access controls, aiding in the secure exchange of information between us and our third-party service providers.


text: Assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Director of IT coordinates with our General Counsel and representatives of the Company's departments and teams to evaluate the Company's risk profile and identify and mitigate cybersecurity threats. Our General Counsel evaluates material risks from cybersecurity threats and reports to both the Company's executive management team and the Audit Committee of the Board of Directors. We also use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, data backup and recovery providers, cyber insurers, and legal counsel.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function and has delegated to the Audit Committee primary responsibility for monitoring the Company's cybersecurity risk management processes, including mitigation of cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of the Company's management. In particular, the Director of IT and General Counsel are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes and technologies, and reviewing security assessments and other security-related reports. In addition, the General Counsel provides regular reports to the Audit Committee concerning the Company's cybersecurity posture and significant threats and risks and the processes to address them.


text: Our security incident response plan ("SIRP") is designed to escalate certain cybersecurity incidents to members of the Company's executive management team depending on the circumstances. The General Counsel, Director of IT, and relevant department heads work with our incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. The SIRP provides for escalation of potentially material cybersecurity incidents to the Audit Committee.


text: Our VP of Technology and Director of IT, together with our managed service provider ("MSP"), are responsible for helping to identify, assess and manage the Company's cybersecurity threats and risks by monitoring and evaluating our threat environment using, among other things, manual processes, automated tools, internal audits, threat and vulnerability assessments, evaluating threats reported to us, evaluating our and our industry's risk profile, and subscribing to reports and services that identify cybersecurity threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data. These include, for example, an incident response plan and team, data encryption, risk assessments, network security and access controls, physical security, asset management, tracking, and disposal, systems monitoring, employee training including tabletop exercises and other simulated cybersecurity threats, and cybersecurity insurance. In addition, to oversee and identify any risks associated with our use of third-party service providers, we review Service Organization Controls ("SOC") reports of such third-party service providers when onboarding the provider and annually thereafter. We also maintain proper essential information sharing and access controls, aiding in the secure exchange of information between us and our third-party service providers.


text: Assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Director of IT coordinates with our VP of Technology and representatives of the Company's departments and teams to evaluate the Company's risk profile and identify and mitigate cybersecurity threats. Our General Counsel evaluates material risks from cybersecurity threats and reports to both the Company's executive management team and the Audit Committee of the Board of Directors. We also use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, data backup and recovery providers, cyber insurers, and legal counsel.


text: Our Board of Directors (the "Board") addresses the Company's cybersecurity risk management as part of its general oversight function and has delegated to the Audit Committee primary responsibility for monitoring the Company's cybersecurity risk management processes, including mitigation of cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of the Company's management. In particular, the VP of Technology and Director of IT are responsible for hiring appropriate personnel and helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes and technologies, and reviewing security assessments and other security-related reports. In addition, the General Counsel provides regular reports to the Audit Committee concerning the Company's cybersecurity posture and significant threats and risks and the processes to address them.


text: Our security incident response plan ("SIRP") is designed to escalate certain cybersecurity incidents to members of the Company's executive management team depending on the circumstances. Our VP of Technology, Director of IT, General Counsel, and MSP, along with relevant department heads, work with our incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. The SIRP provides for escalation of potentially material cybersecurity incidents to the Audit Committee.


text: Risk Management and Strategy We have a dedicated team focused on cybersecurity and we maintain a cybersecurity program designed to protect our systems, technology infrastructure, operations and the data entrusted to us by our employees and counterparties. Our cybersecurity program is led by our Chief Technology Officer, who is a part of our senior leadership team and works closely with our team to develop and advance our cybersecurity strategy and regularly reports to our board of directors and the audit committee of our board of directors on cybersecurity matters.

companyName: Royalty Pharma plc

ticker: RPRX


text: Cybersecurity threats are assessed as part of our enterprise risk management assessments. Our cybersecurity strategy includes procedures for identifying material cybersecurity risks, prioritizing risks and analyzing risk mitigation. Our cybersecurity strategy also includes developing and implementing policies and procedures, escalating any issues as necessary that present a material risk and ensuring that all employees have sufficient cybersecurity training. We have engaged consultants and other third parties in connection with our enterprise risk management assessments, including with respect to cybersecurity.


text: We conduct regular testing to identify vulnerabilities before they can be exploited by attackers. We examine and validate our program with third parties, measuring it against industry standards and established frameworks to help identify areas for focus, improvement and compliance. We have comprehensive plans to ensure that any non-routine events are properly escalated. These plans are validated through cyber incident exercises to consider the types of decisions that would need to be made in the event of a cyber incident. We have engaged in scenario planning exercises around cyber incidents with cybersecurity consultants in this process.


text: Our security awareness platform aims to reduce vulnerabilities in our systems if they are the target of phishing or social engineering through simulations of attacks coupled with employee training. We assess third party vendors who have access to our data or systems to measure their adherence to relevant industry practices and standards, including due diligence and monitoring compliance with security assessments.


text: In 2023, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors—Cybersecurity vulnerabilities or other failures in information systems could result in information theft, data corruption and significant disruption of our business operations."


text: The board of directors has adopted a Cyber Security and Personal Data Breach Policy in order to reflect the importance of appropriate security, processes and procedures to the protection of data and assets, and in an effort to establish a foundation for successful protection against cyber-crime and to minimize any potential negative impacts of a successful cyber-attack. Our cybersecurity program is overseen by our Chief Technology Officer who reports directly to our Chief Executive Officer and periodically briefs the audit committee and the board of directors on our cybersecurity program and cybersecurity issues. Our Chief Technology Officer has over 25 years of professional experience in various roles across multiple industries involving leading strategic technology initiatives. Several of our directors have experience with managing and mitigating cybersecurity and technology risks, which provides our board of directors with insight into such risks and aid in overseeing our information security, operations and systems, as well as our continuing investment in and development of our cybersecurity program. The board of directors receives updates or training, as necessary, on cybersecurity issues from management, experts and legal advisors, as required. The audit committee is responsible for overseeing our enterprise risk management program, which includes consideration of technology and cybersecurity risks. The audit committee receives updates about the results of assessments conducted by outside advisors who provide independent assessments of our technology systems.


text: In 2024 and 2023, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors—Cybersecurity vulnerabilities or other failures in information systems could result in information theft, data corruption and significant disruption of our business operations."


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board of Directors has delegated to the Audit Committee oversight of cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats, and management provides regular reports to the Audit Committee and the Board of Directors regarding cybersecurity and other information technology risks and the processes the Company has implemented to address them.

companyName: Mission Produce, Inc.

ticker: AVO


text: Our Board of Directors considers cybersecurity risk to be an important potential risk to our business. The Board of Directors has delegated to the Audit Committee oversight of cybersecurity and other information technology risks affecting the Company. The Audit Committee periodically evaluates our cybersecurity strategy to ensure its effectiveness. Management provides regular reports to the Audit Committee and the Board of Directors regarding cybersecurity and other information technology risks.


text: Our Chief Information Officer oversees our information security program. His teams are responsible for leading enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes. We devote significant resources to protecting and continuing to improve the security of our computer systems, software, networks, and other technology assets. Our security efforts are designed to preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, the Company and protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt, or degrade service, sabotage systems, or cause other damage. Our information security program is integrated into our overall enterprise risk management program and shares common reporting channels and governance processes that apply to other legal, compliance, strategic, operational, and financial risk areas.


text: We identify and address information security risks by employing a defense-in-depth methodology that provides multiple, redundant defensive measures and prescribes actions to take in case a security control fails or a vulnerability is exploited. We leverage internal resources, along with strategic external partnerships, to mitigate cybersecurity threats to the Company. We have partnerships for Security Operations Center (SOC) services and various third-party assessments. We deploy both commercially available solutions and proprietary systems to manage threats to our information technology environment actively.


text: Certain of our information technology applications are externally audited as part of our Sarbanes-Oxley audit program and our controls include information security standards. We design and assess our information security program based on the National Institute of Standards and Technology Cyber Security Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We regularly engage appropriate external resources regarding emerging threats to navigate the diverse cybersecurity landscape. In addition to ensuring adequate safeguards are in place to minimize the chance of a successful cyber-attack, the Company has established well-defined response procedures to effectively address cyber events that may occur despite these robust safeguards. These response procedures are designed to identify, analyze, contain, and remediate such cyber incidents to ensure a timely, consistent, and compliant response to actual or attempted data incidents impacting the Company. The Company devotes appropriate resources and enlists partners to adapt to the evolving threat landscape.


text: The Company takes data protection seriously and ensures employees understand their role in keeping the Company safe from cyber-attacks. We employ a robust information security and training program for our employees, including mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. As part of this commitment, we require our employees to complete a Cybersecurity Awareness eCourse and acknowledge our Information Security policies. In addition, we have an established schedule and process for regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees.


text: We have experienced no material information security breaches in the last three years. As such, we have not spent any material amount of capital on addressing information security breaches in the last three years, nor have we incurred any material expenses from penalties and settlements related to a material breach during this same time. We also carry third-party cybersecurity insurance.


text: Cybersecurity Governance Blackstone has a dedicated cybersecurity team, led by Blackstone's CSO, who works closely with Blackstone senior management, including Blackstone's Chief Technology Officer ("CTO"), to develop and advance the firm's cybersecurity strategy, which applies to us and the Adviser.

companyName: Blackstone Private Credit Fund


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Information Officer (CIO), who has 30 years of information technology experience and 15 years of cybersecurity experience, who oversees our information security program and is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer and other executive officers are responsible for setting budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents as appropriate.


text: Risk management and strategy Our Information Technology and Information Security teams, led by our CIO, are responsible for leading enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes and helps identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's risk register. We have implemented and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to protect and continue to improve the security of our computer systems, software, networks, and other technology assets. Our security efforts are designed to preserve the confidentiality, integrity, and continued availability of the critical information owned by, or in the care of, the Company, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and customer and business partner data, and protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt, or degrade service, sabotage systems, or cause other damage. Our information security program is integrated into our overall enterprise risk management program and shares common reporting channels and governance processes that apply to other legal, compliance, strategic, operational, and financial risk areas.


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and critical data, including, for example, an incident response plan, incident detection and response processes, disaster recovery plans, risk assessments, encryption of certain data, network security controls, access controls, physical security, systems monitoring, penetration testing, cybersecurity insurance, vendor risk management processes, and employee training, and employment of a defense-in-depth methodology. We leverage internal resources, along with strategic external partnerships, to mitigate cybersecurity threats to the Company. We have partnerships for Security Operations Center (SOC) services and various third-party assessments of our cybersecurity practices. We deploy both commercially available solutions, such as firewall and antivirus software, and proprietary systems to manage threats to our information technology environment actively.


text: Certain of our information technology applications are externally audited as part of our Sarbanes-Oxley audit program and our controls include information security standards. We regularly engage appropriate external resources regarding emerging threats to navigate the diverse cybersecurity landscape.


text: The Company has established well-defined response procedures to effectively address cyber events that may occur despite these robust safeguards. These response procedures are designed to identify, analyze, contain, and remediate such cyber incidents to ensure a timely, consistent, and compliant response to actual or attempted data incidents impacting the Company. Further, we also carry third-party cybersecurity insurance.


text: We employ an information security and training program for our employees, including mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. As part of this commitment, we require our employees to complete a Cybersecurity Awareness eCourse and acknowledge our Information Security policies. In addition, we have an established schedule and process for regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees.


text: We use third-party service providers to perform a variety of functions throughout our business, including software and cloud data service providers, for certain areas of our business, including sourcing/procurement, supply chain, manufacturing, distribution, information technology support services and administrative functions (such as payroll processing, health and benefit plan administration and certain finance and accounting functions). We have vendor management processes to manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "System security risks, data protection breaches, cyber-attacks (including artificial intelligence (AI)-enabled threats), AI-related operational errors, and systems integration issues could disrupt our internal operations or services provided to customers, and any such disruption could reduce our expected revenue, increase our expenses, damage our reputation and adversely affect our stock price."

stage1Category: None/Other


text: Cybersecurity Risk Management and Strategy As an externally managed closed-end management investment company that has elected to be treated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our executive officers under the oversight of our Board of Trustees. Our executive officers are senior Blackstone Credit & Insurance professionals and each of the Adviser and Administrator is a subsidiary of Blackstone. As such, we are reliant on Blackstone for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Blackstone has provided to us regarding its cybersecurity program that are relevant to us.


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data entrusted to it, including by us and the Adviser, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, annual employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.


text: Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology and Center for Internet Security, as guidelines. Further, Blackstone engages in cyber incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Blackstone's Chief Security Officer (the "CSO") and members of Blackstone's senior management, Legal and Compliance, Technology and Innovations ("BXTI"), and Global Corporate Affairs participate in these exercises. Learnings from these tabletop exercises and any events Blackstone experiences are reviewed, discussed, and incorporated into its cybersecurity framework as appropriate. In addition to Blackstone's internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to analyze data on the interactions of users of Blackstone information technology resources, including Blackstone employees, and conduct penetration tests and scanning exercises to assess the performance of Blackstone's cybersecurity systems and processes.


text: Blackstone has a comprehensive Security Incident Response Plan (the "IRP") designed to inform the proper escalation (including, as appropriate, to our senior management) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a Security Incident Response Team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually by Blackstone's CSO and members of BXTI and Blackstone's Legal and Compliance.


text: Blackstone maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to track cybersecurity risks at the firm, and integrates these processes into the firm's overall risk management practices described above. Blackstone's CSO periodically discusses and reviews cybersecurity risks and related mitigants with its enterprise risk committee and incorporates relevant cybersecurity risk updates and metrics in the semi-annual enterprise-wide risk management report.


text: Blackstone has a process designed to assess, the cybersecurity risks associated with the engagement of third-party vendors, including those of companies externally managed by Blackstone such as us. This assessment is conducted on the basis of, among other factors, the types of services provided, and the extent and type of Blackstone data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Blackstone may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Blackstone also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data.


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Blackstone in managing these risks, see "Item 1A. Risk Factors – Risk Related to our Business – Cybersecurity and data protection risks could result in the loss of data, interruptions in our business, and damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations."


text: Blackstone's CSO and CTO have extensive experience in cybersecurity and technology, respectively. Blackstone's CSO, Adam Fletcher, is a Senior Managing Director in BXTI and is responsible for all aspects of cyber and physical security across Blackstone. Prior to his appointment as CSO in 2017, Mr. Fletcher was Blackstone's Deputy CSO. Before joining Blackstone in 2014, Mr. Fletcher led the International Security organization for Equifax from 2012 to 2014. Mr. Fletcher received a BS in Operations Research and Industrial Engineering from Cornell University.


text: Blackstone's CTO, John Stecher is a Senior Managing Director and head of BXTI. Mr. Stecher is responsible for all aspects of technology across Blackstone. Mr. Stecher also advises Blackstone's investment teams and acts as a resource to Blackstone portfolio companies, and companies externally managed by Blackstone such as us, on technology-related matters. Before joining Blackstone in 2020, Mr. Stecher was a Managing Director and the Chief Technology Officer and Chief Innovation Officer at Barclays. He was also a member of the Barclays Technology Management Committee. Prior to joining Barclays in 2017, Mr. Stecher held a variety of senior management and engineering roles across Goldman Sachs' capital markets and technology divisions. Mr. Stecher received a BS in Computer Science from the University of Wisconsin – Madison and a MS in Computer Science from the University of Minnesota.


text: BXTI conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The CSO and CTO review Blackstone's cybersecurity framework annually as well as on an event-driven basis as necessary. The CSO and CTO also review the scope of Blackstone's cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Blackstone's information and systems.


text: Our Board of Trustees is responsible for understanding the primary risks to our business. The Board of Trustees is responsible for reviewing periodically our and the Adviser's information technology security controls and related compliance matters, with management. Blackstone's CSO, or designee, reports to the Board of Trustees, or a committee thereof, at least annually on cybersecurity matters, including risks facing us and the Adviser and, as applicable, certain incidents. In addition to such periodic reports, the Board of Trustees or a committee thereof may receive updates from management as to our and the Adviser's cybersecurity risks and Blackstone cybersecurity program developments.


text: Cybersecurity Risk Management and Strategy As an externally managed closed-end management investment company that has elected to be treated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our executive officers under the oversight of our Board. Our executive officers are senior Blackstone Credit & Insurance professionals and each of the Adviser and Administrator is a subsidiary of Blackstone. As such, we are reliant on Blackstone for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Blackstone has provided to us regarding its cybersecurity program that are relevant to us.


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data entrusted to it, including by us and the Adviser, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, new hire and annual employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.


text: Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology and Center for Internet Security, as guidelines. Further, Blackstone engages in cybersecurity incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cybersecurity incident response processes. Blackstone's Chief Security Officer (the "CSO") and members of Blackstone's senior management, Legal and Compliance, Technology and Innovations ("BXTI") and Global Corporate Affairs participate in these exercises. Learnings from these tabletop exercises and any events Blackstone experiences are reviewed, discussed, and incorporated into its cybersecurity incident response processes, as appropriate. In addition to Blackstone's internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to analyze data on the interactions of users of Blackstone information technology resources, including Blackstone employees, and conduct penetration tests and scanning exercises to assess the performance of Blackstone's cybersecurity systems and processes.


text: Blackstone has a comprehensive Security Incident Response Plan (the "IRP") designed to inform the proper escalation (including, as appropriate, to our senior management) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a Security Incident Response Team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually by members of BXTI and Blackstone's Legal and Compliance.


text: Blackstone maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to identify, track and treat cybersecurity risks at the firm, and integrates these processes into the firm's overall risk management practices described above. Blackstone's CSO periodically discusses and reviews cybersecurity risks and related mitigants with its enterprise risk committee and incorporates relevant cybersecurity risk updates and metrics in the semi-annual enterprise-wide risk management report.


text: Blackstone has a process designed to assess, the cybersecurity risks associated with the engagement of third-party vendors, including those of companies externally managed by Blackstone such as us. This assessment is conducted on the basis of, among other factors, the types of services provided, and the extent and type of Blackstone data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Blackstone may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing its requirements and industry best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Blackstone also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data.


text: Cybersecurity Governance Blackstone has a dedicated cybersecurity team, led by Blackstone's CSO, who works closely with Blackstone senior management, including Blackstone's Chief Technology Officer ("CTO"), to develop and advance the firm's cybersecurity program and strategy, which applies to us and the Adviser.


text: Blackstone's CSO and CTO have extensive experience in cybersecurity and technology, respectively. Blackstone's CSO is a Senior Managing Director in BXTI and is responsible for all aspects of cyber and physical security across Blackstone. He has over 25 years of information security, technology and engineering experience, including having previously led the international security organization at a large credit bureau.


text: Blackstone's CTO is a Senior Managing Director and the head of BXTI. The CTO has over 23 years of information security, technology and engineering experience, including having previously served as the Chief Technology and Chief Innovation Officer at a large financial institution. Blackstone's CTO is responsible for all aspects of technology across Blackstone, advises Blackstone's investment teams and acts as a resource to Blackstone portfolio companies, and companies externally managed by Blackstone such as us, on technology-related matters.


text: BXTI conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The CSO and CTO are responsible for the review of Blackstone's cybersecurity framework annually as well as on an event-driven basis as necessary. The CSO and CTO also review the scope of Blackstone's cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Blackstone's information and systems.


text: Our Board is responsible for understanding the primary risks to our business. The Board is responsible for reviewing periodically our and the Adviser's information technology security controls and related compliance matters, with management. Blackstone's CSO, or designee, reports to the Board, or a committee thereof, at least annually on cybersecurity matters, including risks facing us and the Adviser and, as applicable, certain incidents. In addition to such periodic reports, the Board or a committee thereof may receive updates from management as to our and the Adviser's cybersecurity risks and Blackstone cybersecurity program developments.


text: As a global technology and services leader, our business is heavily dependent upon information technology networks and systems. Protecting our systems, data, and information, as well as the information and data of our game-changers, clients, and partners, is a key priority.

companyName: Concentrix Corp

ticker: CNXC


text: We have established and maintain a corporate-wide information security management system and an integrated risk management framework with practices that are derived from industry standards, including ISO 31000, ISO 27001, HITRUST, PCI DSS, and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and data privacy regulations, including the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the General Data Protection Regulation ("GDPR"). The data security controls from these standards and regulations are evaluated as a component of our risk management framework, based on the needs of our business and our clients, the nature of our industry, and applicable regulations.


text: Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate.

companyName: Blue Owl Capital Corp III


text: Risk Management and Strategy We have implemented and maintain an Information Security Management System ("ISMS") that covers information security, data protection, cybersecurity, application security, and other areas as necessary. As a part of our ISMS, we evaluate our security risk strategy on an ongoing basis to facilitate our response to the changing cybersecurity threat landscape and build a culture of security within Concentrix, we allocate and evaluate available resources, including technology, infrastructure, and personnel, to support information security initiatives, we regularly identify security risks and prepare and continuously update mitigation and response plans, including with respect to risks related to the use of our third party service providers, we report, investigate, and respond to suspected or confirmed information security risks, and we maintain a business continuity management process to counter potential interruptions to business activities and a data privacy program to protect personal and sensitive information. We regularly evaluate the ISMS for compliance with applicable regulatory, legislative, and contractual requirements, as well as recent trends and developments in security.


text: Our management team gathers information to support our efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents from various sources, including reports from internal security personnel, threat intelligence, and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by the information security tools we utilize. Our Cyber Defense Operations Center (the "CDOC") is a security operations center that operates 24 hours a day, seven days a week and is our first line of defense against cybersecurity threats. The CDOC continually monitors our information technology security infrastructure for anomalous behavior and other indications of potential threats to protect our data and systems.


text: We regularly conduct internal and external audits, reviews, assessments, and evaluations to evaluate our compliance posture and the effectiveness of our physical, technical, and organizational measures for protecting us and our systems. Elements of our cybersecurity program are also periodically audited as part of external certification audits. Third-party managed security providers and cybersecurity experts provide us with 24x7 monitoring, threat hunting, risk assessments, penetration testing, and attack surface management to support our Cyber Security Framework. Key findings from cybersecurity audits and third-party risk assessments are summarized and communicated to our senior leadership and the Audit Committee, and remediation actions are implemented to enhance our overall cybersecurity program. We contractually require our vendors to comply with cybersecurity and data privacy requirements, and we perform risk assessments of vendors, including their ability to protect data from unauthorized access.


text: To facilitate the success of our risk management framework, multidisciplinary teams throughout the Company, including members of the legal department, operations, and senior management, are deployed to support risk mitigation and our response to threats and potential cybersecurity incidents. We also regularly conduct training and education to upgrade our game-changers' knowledge of security risks and vulnerabilities. In fiscal year 2024, our game-changers completed mandatory security awareness training, resulting in a company-wide pass percentage of 95%. In August 2024, we held a Cyber and Fraud Awareness Month, which promoted best practices and vigilance in protecting information and data to prevent cyber-attacks, and educated game-changers on how to report phishing or suspicious messages through a dedicated reporting channel.


text: We are currently not aware of any cybersecurity incidents or threats that have materially impacted us or our business, financial condition, and results of operations. However, we and our clients routinely face risks of cybersecurity incidents, and there can be no assurance that our security efforts and measures, and those of our third-party providers, will prevent or mitigate a cybersecurity threat or incident that could adversely affect our business. For a discussion of these risks and others that we face, see "Risk Factors" in this Annual Report on Form 10-K.


text: Our board of directors, directly and indirectly through its committees, has oversight responsibility for our risk management process, including risks related to cybersecurity. Our board of directors has delegated to the Audit Committee oversight responsibility for the Company's risk assessment and management activities, including with respect to information technology, cybersecurity, and privacy.


text: As part of our integrated enterprise risk management program, management reports periodically to the Audit Committee on its assessment of our risks and risk management practices, including with respect to ongoing or new cyber and information security risks. Management also reports quarterly to the Audit Committee and annually to the full board of directors on the status of our cybersecurity program, which includes key cybersecurity controls, audits, and compliance, and on any significant projects or areas of focus for the cybersecurity team.


text: Our cybersecurity risk management framework is implemented by our global security team, which is led by our EVP, Information Technology and Global Security, our SVP, Information Systems and Global Security, and our GVP, Governance, Risk, and Compliance. As the leaders of our global security efforts, these roles and their teams support the establishment and maintenance of our corporate-wide information security program to protect our information assets and to oversee our cybersecurity and insider risk and compliance teams. Our SVP, Information Systems and Global Security, and our GVP, Governance, Risk, and Compliance report to our EVP, Information Technology and Global Security, and our EVP, Information Technology and Global Security reports to our Chief Executive Officer.