text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: CytomX Therapeutics, Inc.

ticker: CTMX

secItem: Item 1C


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.

stage1Category: Risk Management Process

stage1Method: unanimous


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our information technology systems, or those of our CROs or other contractors or consultants we may utilize, may fail, suffer disruptions or suffer security breaches, which could result in a material disruption of our product development programs."

stage1Category: Strategy Integration


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from management and, where applicable, external experts, as part of our efforts to keep the Board updated on topics that impact similarly-sized biopharmaceutical public companies.

stage1Category: Board Governance


text: Our management team, including our Vice President, Information Technology, and senior information technology staff, collectively have more than 40 years of experience assessing and managing material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes information systems architecture, operations, cybersecurity, data privacy protection, quality, and regulatory compliance experience.

stage1Category: Management Role


text: Our cybersecurity risk management program includes: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • teams principally responsible for managing (1) our cybersecurity risk assessment and mitigation processes, (2) our security controls, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response and reporting plan that includes procedures for responding to cybersecurity incidents; • a team responsible for compliance with security and regulatory standards including but not limited to Service Organization Controls (SOC) reporting, International Organization for Standardization (ISO) frameworks 27001/27017/27018/27701, FedRAMP, and HIPAA; • the use of external service providers, where appropriate, to audit, assess, test or otherwise assist with aspects of our security controls, and to assist with the design and implementation of our cybersecurity policies and procedures; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: BOX INC

ticker: BOX


text: While we have technology and processes in place to detect and respond to cybersecurity threats, we are continually at risk from the evolving cybersecurity threat landscape. We do not believe our business strategy, results of operations or financial condition have been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.

stage1Method: majority


text: Cybersecurity Governance One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to our full Board regarding its activities, including those related to cybersecurity. Our Board of Directors also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our chief information security officer or external experts as part of the Board of Directors' continuing education on topics that impact public companies.


text: Our chief information security officer and chief compliance officer are responsible for assessing and managing our material risks from cybersecurity threats. They also have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes industry-specific expertise in SaaS technology, regulatory compliance knowledge, previous leadership roles in cybersecurity or related fields, as well as a track record of successfully implementing effective cyber risk mitigation strategies.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure We manage cybersecurity threats as part of our general risk mitigation, evaluation, and oversight processes. We implement our cybersecurity program internally through established policies, standards, and the use of enterprise security services that focus on emerging and ongoing cybersecurity risks. We manage these risks to our employees, customers, stockholders, and business partners through a coordinated and consistent IT risk management process overseen by the Senior Manager, IT who assumes the role of our Chief Information Security Officer ("CISO").

companyName: Sonendo, Inc.

ticker: SONX


text: Our information risk management framework is designed to manage and protect against risks in three broad categories: (i) operational risk; (ii) financial risk; and (iii) safety, environmental, and regulatory risk. We consider and evaluate reputational risk as an element of each of these risk categories.


text: We conduct regular security and awareness training for all new hires and for current employees. Employees are required to apply risk assessment processes and to professionally assess risks in the course of performing their job duties.


text: We conduct vulnerability scans of business critical systems on an annual, quarterly, and daily basis. We utilize external third parties to assist in assessing our systems, conduct scans and provide reports based on these scans and we address vulnerabilities as they are identified. We generally review current and prospective third party service providers for cybersecurity risks.


text: Management, under the supervision of our Chief Information Security Officer (CISO), is directly responsible for assessing and managing cybersecurity risks and otherwise implementing our cybersecurity program, which includes our Incident Response Policy and Incident Response Procedure. The CISO reports directly to our Chief Executive Officer. Our CISO has over ten years of IT experience and nine years of significant experience managing cybersecurity threats across our industry. The CISO may call upon business and legal stakeholders across our company to manage cybersecurity threats and incidents.


text: The audit committee of our board of directors is responsible for oversight of the company's programs, policies, procedures, and risk management activities related to information security and data protection. The audit committee meets regularly with CISO to discuss threats, risks, and ongoing efforts to enhance cyber resiliency, as well as changes to the broader cybersecurity landscape. Management promptly updates our board of directors regarding significant threats and incidents as they arise.


text: Risk management and strategy We have established and maintain various information security processes designed to identify, assess, and manage cybersecurity risks to our critical computer networks, third-party hosted services, communication systems, hardware, software, and vital data, such as intellectual property, confidential proprietary information, strategic assets, and nonclinical/clinical trial data ("Information Systems and Data"). Our Chief Operating and Financial Officer, Vice President of Information Technology, cybersecurity business partner and IT & Legal teams collaborate to address cybersecurity threats and risks, leveraging our risk register when needed. Our VP of Information Technology, members of our in-house IT team, and our third-party cybersecurity business partner all play an active role in monitoring and assessing risks from cyber threats through a variety of methods including automated tools, third-party testing, tabletop incident response exercises, threat actor analysis, industry risk profiling, and collaboration with law enforcement.

companyName: Olema Pharmaceuticals, Inc.

ticker: OLMA


text: We employ a range of measures, processes, standards, and policies tailored to specific environments designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include data encryption, network security controls, secure physical facilities, employee training, access management, change management and comprehensive asset management, tracking, and disposal procedures.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the security team, which includes our VP of Information Technology and third-party service providers, works with management to prioritize our risk management processes and take steps to mitigate cybersecurity threats that are determined to be more likely to lead to a material impact to our business. Key findings and status of the cybersecurity landscape are reviewed with the Audit Committee of our Board of Directors, or Audit Committee, which evaluates our overall enterprise risk.


text: We engage various categories of third-party service providers to augment our efforts in monitoring, identifying, assessing, and mitigating significant cybersecurity risks. These third-party service providers encompass a range of expertise, including professional services firms such as legal counsel, cybersecurity consultants with specialized knowledge, providers of cybersecurity software solutions, managed cybersecurity service providers offering ongoing monitoring, protection and support, external testing firms specializing items like penetration testing to evaluate vulnerabilities, and forensic investigators who are enlisted as necessary to conduct comprehensive investigations and assessments when specific incidents or breaches occur.


text: We enlist third-party service providers across our business functions, including application providers, hosting companies, contract manufacturers, and supply chain resources. Depending on the service type, data sensitivity, and provider identity, our vendor management process assesses cybersecurity risks and establishes corresponding contractual cybersecurity obligations, tailored to each provider's role and the nature of Information Systems and Data involved.

stage1Category: Third-Party Risk


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under "Part 1. Item 1A. Risk Factors" in this Annual Report on Form 10-K, including under the section titled "—Risks related to employee matters, managing our growth and other risks related to our business."

stage1Category: None/Other


text: Our Board of Directors retains responsibility for evaluating key business risks faced by the Company, including but not limited to information security. In part, our Board of Directors addresses its general oversight function by delegating the Company's cybersecurity risk management to the Audit Committee. The Audit Committee's responsibilities include supervising risk mitigation efforts related to cybersecurity threats, evaluating the sufficiency and effectiveness of information security policies and practices, and ensuring robust internal controls for information security.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors has ultimate responsibility for oversight of cybersecurity risks, but primary responsibility for cybersecurity risk oversight has been delegated to the audit committee.

companyName: Oric Pharmaceuticals, Inc.

ticker: ORIC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including our Vice President of Information Technology who has over 15 years of extensive experience managing cybersecurity programs, who reports into our Chief Operating and Financial Officer. The Vice President of Information Technology is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Chief Operating and Financial Officer is responsible for approving budgets, aiding in the preparation for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response procedures involve escalating specific incidents to certain members of management as needed, including the Vice President of Information Technology, Chief Operating and Financial Officer and the Chief Executive Officer. The Chief Operating and Financial Officer collaborates with our incident response team, which includes members of our in-house IT, facilities, human resources, regulatory, legal, and communications teams, to address and resolve reported cybersecurity incidents. Olema's incident response procedures mandate reporting certain types of cybersecurity incidents to the Audit Committee and other agencies as required by law.


text: The Audit Committee periodically receives reports from the Vice President of Information Technology on the Company's significant cybersecurity threats, risks, and mitigation processes. The Audit Committee also receives various summaries, presentations, and reports pertaining to cybersecurity threats, risks, and mitigation.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We periodically assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We conduct annual risk assessments and penetration tests to identify cybersecurity threats, including assessments and tests with the assistance of independent third-party cybersecurity consultants. We also conduct assessments in the event of a material change in our business practices that may affect key information systems that are vulnerable to such cybersecurity threats. These assessments and tests are designed to assist in the identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following risk assessments and penetration tests, we work to re-design, implement, update, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and monitor the effectiveness of our safeguards.


text: As part of our risk management system, we also periodically provide company-wide cybersecurity training to our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage with external cybersecurity consultants to help design and implement our cybersecurity policies and procedures, as well as to monitor and test the effectiveness of our safeguards. The head of information technology (IT), supported by external cybersecurity consultants and the IT Department, implements our cybersecurity risk management system. The head of IT regularly reports on cybersecurity matters to the Chief Financial Officer.


text: We evaluate the security practices of certain third-party service providers to identify potential cybersecurity risks, including by reviewing documentation concerning their security measures. Where appropriate, including for third-party contracts under which our data will be stored, we contractually obligate providers to implement and maintain reasonable administrative, technical, and physical safeguards and other security measures designed to maintain the confidentiality, security and integrity of our data, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or incidents or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Beachbody Company, Inc.

ticker: BODI


text: Our Chief Financial Officer and head of IT, advised by external cybersecurity consultants, are primarily responsible for assessing and managing our material risks from cybersecurity threats. Our head of IT has over 25 years of experience in information technology roles and over 8 years of experience in security roles in the biotechnology industry. Our Chief Financial Officer has approximately 7 years of experience overseeing IT-related processes (including cybersecurity processes).


text: The processes by which our Chief Financial Officer and our senior management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes regular updates from the head of IT to the Chief Financial Officer, as well as periodic reports, as needed, from the Chief Financial Officer and the head of IT to senior management.


text: Our Chief Financial Officer and head of IT provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides updates to the board of directors on such reports.


text: Cybersecurity Risk Management and Strategy As an externally managed REIT, the Company's risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Adviser, an indirect subsidiary of Apollo. Apollo determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for the Company and other affiliated entities managed by Apollo, and the Company relies on Apollo for assessing, identifying and managing material risks to the Company's business from cybersecurity threats.

companyName: Apollo Realty Income Solutions, Inc.


text: The Apollo Global Management, Inc. ("AGM") board of directors is involved in overseeing Apollo's risk management program, including with respect to cybersecurity, which is a critical component of Apollo's overall approach to enterprise risk management ("ERM"). Apollo's cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based, in part, on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas: • Governance: As discussed further under the heading "Cybersecurity Governance," the AGM board of directors has an oversight role, as a whole and at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer ("CISO") and the CISO of Athene Holding Ltd., a subsidiary of AGM, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, as well as, as appropriate, with the Company's executive officers and other representatives of the Adviser and its affiliates. • Collaborative Approach: Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with the Company's management and its board of directors, as applicable, in a timely manner. • Technical Safeguards: Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as the Company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.


text: Apollo engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. Apollo regularly engages third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to Apollo's risk management function, and Apollo adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Cybersecurity threat risks have not materially affected the Company, including its business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Organizational Structure—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, a misappropriation of funds, and/or damage to our business relationships, all of which could negatively impact our financial results."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Cybersecurity Governance The AGM board of directors' oversight of cybersecurity risk management is supported by the audit committee of the AGM board of directors (the "AGM audit committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. The AGM board of directors, the AGM audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from Apollo's risk management professionals, AGM's Chief Security Officer ("CSO"), its CISO, and other members of Apollo's management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from Apollo's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM's board of directors and/or the AGM audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM board of directors or the AGM audit committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from AHL's CISO, at least annually.


text: AGM's CSO holds an undergraduate degree in Management Information Systems and Business Administration, which he received magna cum laude. He has over 25 years of cyber-related experience, having served in various roles in technology and cybersecurity, including as Head of IT Risk Management, Executive Director of IT & Risk Compliance, and Global IT Risk Evaluation Lead at large financial institutions and consulting firms. He was also previously AGM's CISO for nearly eight years. AGM's CISO holds a master's degree in Business Information Systems and has served in various roles in information technology and information security for over 25 years across a number of large financial institutions, including as Director, Cybersecurity and Risk.


text: The AGM CISO, in coordination with the Apollo Technology and ERM teams, works collaboratively across Apollo to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of Apollo's cybersecurity risk management program, multidisciplinary teams throughout Apollo are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the AGM audit committee or AGM board of directors, as appropriate.


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of the Company's board of directors and the Company's board of directors, both the audit committee and board of directors regularly interact with, and receive reports from, management of the Company, the Adviser, Apollo, and other service providers. The audit committee of the Company's board of directors and the Company's board of directors receive presentations and reports on cybersecurity risks from AGM's CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Apollo's peers and third parties. Additionally, Apollo and other service providers periodically report to management as it relates to the Company's cybersecurity practices.


text: Apollo's cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to the Company's management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to the Company, the Adviser, and evaluation of the adequacy of the Company's cybersecurity program (as coordinated through the Adviser and Apollo), including risk mitigation, compliance and controls.


text: The Company has processes in place designed to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Investment Adviser and other third-party service providers. The Investment Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Commonwealth Credit Partners BDC I, Inc.


text: Cybersecurity Program Overview The Investment Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Investment Adviser, together with external consultants, actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company. The Company relies on the Investment Adviser's compliance and risk management program and processes, which include periodic review of the Investment Adviser's Cybersecurity Program. The Company depends on and engages various third parties, including service providers, to operate its business. The Company relies on its Chief Compliance Officer ("CCO") and the expertise of risk management, legal, information technology, and compliance personnel of the Investment Adviser when identifying and overseeing risks from cybersecurity threats associated with its reliance upon such third parties.


text: The potential impact of risks from cybersecurity threats posed to the Company are assessed on an ongoing basis, including how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition. Key third-party information security service providers, subject to the Adviser Committee's and Company CCO's oversight, continuously monitor and support the Adviser and Company information security control environment and breach notification processes. The Adviser's Committee, subject to the Company CCO's oversight, monitor best-practices and developments in data privacy and security, including increased scrutiny of third-party service providers having access to sensitive Company data.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the Investment Adviser regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Investment Adviser's operations, including those related to the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, and a Technology Risk and Information Security Committee (the "Committee") established by the Investment Adviser manage the Company's cybersecurity program. The CCO of the Company oversees the Company's oversight function generally and relies on the Investment Adviser's Committee to assist with assessing and managing material risks from cybersecurity threats. The Committee is chaired by an outside cybersecurity and information technology expert, and its other members are the Investment Advisors CFO/CCO, its General Counsel, and its Director of Information Technology. The CCO has been responsible for oversight of the Company's overall SEC compliance program, since the Company's inception and has worked in the financial services industry for more than 25 years, during which time the CCO has gained expertise in assessing and overseeing controls regarding risks applicable to the Company.


text: The Company's Senior Management team is regularly informed regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, and/or other comparable SEC regulated investment funds and their managers, including through the receipt of notifications from service providers and reliance on communications with operations, risk management, legal, information technology, and/or compliance personnel of the Investment Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security methods and controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: There can be no assurances that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or are effective in protecting our systems and information.


text: Our management team, including our CSO, Chief Financial Officer (CFO), Chief Operating Officer (COO) and Chief Legal Officer (CLO), are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program. Our management team works closely with our CSO who has over 20 years experience in information technology and operational technology security, and specialized training, including graduating from the Federal Bureau of Investigation Chief Information Security Officer Academy.


text: Our management team supervises efforts to help prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the technical environment.


text: Cybersecurity is a critical element of our information security program. Security controls are implemented in a manner that protects the confidentiality, integrity and availability of our information assets without hindering business operations. Management is responsible for the day-to-day administration of our cybersecurity policies, processes, and practices. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology (the "NIST") and management's knowledge of best practices in the cybersecurity industry. In general, we seek to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity and availability of our information systems or the information that we collect and store, by proactively monitoring for cybersecurity threats and assessing, identifying and managing cybersecurity issues as they occur.

companyName: Scilex Holding Co

ticker: SCLX


text: We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. Key elements of our cybersecurity risk management strategy include: • We require an annual Service Organization Control 2 Type 1 report from all third-party providers attesting to the presence of security processes. Additionally, we require that SaaS/PaaS providers perform risk assessments and manage the security risks associated with their services. • We have established and maintain a comprehensive incident response plan designed to address our response to a cybersecurity incident. We conduct regular training scenarios to test these plans and ensure personnel are familiar with their roles in a response scenario. • We provide regular, mandatory training for employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. • We use a third party to conduct a periodic assessment of our cybersecurity risk posture and maturity against the NIST Cybersecurity Framework. The results are evaluated by management and the Audit Committee and are used to adjust our cybersecurity policies, standards, processes and practices as necessary. • The company studies and evaluates threats in cyber landscape and aims to regularly improve our risk posture by learning from those lessons.


text: Our audit committee receives quarterly presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by other public companies.


text: The Director of IT acts as the Incident Manager and meets regularly with our Incident Response Team, including members of Financial Risk Management, IT Security and Human Resources senior management to discuss the necessary measures to take prior to and during an incident. In the event of an incident, the Incident Manager meets regularly with the executive leadership team and keeps them apprised of the status of any incident during the incident response. Our Board and the audit committee also receive prompt and timely information from the Director of IT and executive leadership regarding any cybersecurity risks that meet certain reporting thresholds, as well as ongoing updates regarding any such risk. Finally, the Incident Response Manager briefs corporate leadership on lessons learned from the incident during or after the recovery phase.


text: The Director of IT, in collaboration with a team of IT professionals, our legal counsel and Human Resources, are tasked with implementing a program designed to protect our information systems from cybersecurity threats and manage material risks. The Director of IT has served in various roles in information technology and information security for over 20 years. The Director of IT and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the audit committee when appropriate.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition as of December 31, 2023. For more information, please see the risk factor disclosures included in Item 1A of this Annual Report on Form 10-K.


text: Risk Management and Strategy We support a risk-based cybersecurity program with control alignment to the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The core functions of the program are designed to manage cyber-related risks and strengthen the overall cybersecurity posture of our organization.

companyName: Quest Resource Holding Corp

ticker: QRHC


text: As an externally managed company, our business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. We, in conjunction with our Manager, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. These processes include responses to and assessments of internal and external threats to the security, confidentiality, integrity and availability of our and our Manager's data and systems along with other material risks to operations. As part of its collective risk management process, our Manager engages a third party information technology consultant ("IT Consultant") to evaluate risks associated with the Manager's information and technology system(s), network and physical devices. Our Manager also uses the National Institute of Standards of Technology (NIST) Cybersecurity Framework to assess its cybersecurity controls.

companyName: Chicago Atlantic Real Estate Finance, Inc.

ticker: REFI


text: Our board of directors has responsibility for the direction and oversight of our risk management. Our board of directors administers this oversight function directly, with support from its committees. In particular, the audit committee of our board of directors (the "audit committee") has the responsibility to consider and discuss our major financial risk exposures and the steps our Manager takes, or is required to take, to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken. Our audit committee also monitors compliance with legal and regulatory requirements.


text: With respect to cybersecurity, the audit committee engages in discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. In addition, employees of our Manager and/or the IT Consultant will brief the audit committee on the Manager's information security program and cybersecurity risks at least annually, and will brief the audit committee as needed in connection with any potentially material cybersecurity incidents affecting the Company. Annual briefings of the audit committee by employees of the Manager and/or the IT Consultant may include topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Cyber Risk Management and Strategy We have adopted cybersecurity risk management activities and processes that are informed by and incorporate elements of recognized industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework, and that are designed to identify, assess, and mitigate critical risks from cybersecurity threats. We have, for example, implemented a process to monitor for potential critical risks from cybersecurity threats using automated tools. To support our cybersecurity risk management efforts, we leverage a managed service provider that provides ongoing support for the protection of our information technology infrastructure.

companyName: ImageneBio, Inc.

ticker: IMA


text: We have an employee security awareness training program, required upon onboarding and on an annual basis thereafter, that is designed to raise awareness of cybersecurity threats across functions, as well as to encourage consideration of cybersecurity risks across our company. As part of this employee training program, we periodically conduct phishing simulations designed to raise employee awareness of such risks.


text: We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers that may be critical to the operations of our business and who have access to our information systems or store our confidential clinical trial data, including, as appropriate, through review of System and Organization Controls reports and security questionnaires and the inclusion of cybersecurity requirements in relevant contracts.


text: As part of our cybersecurity risk management, we have adopted an incident response plan that has been designed to identify and manage significant events that may impact our information technology infrastructure, including those arising from or related to cybersecurity threats.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems and infrastructure. For more information, please see "Risk Factors."


text: Cybersecurity Governance Our Head of Information Technology ("Head of IT") is responsible for the establishment and maintenance of our cybersecurity risk management processes, including the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who is currently in this role has more than eight (8) years of experience in information security and over eighteen (18) years of IT experience in the biotechnology and pharmacology industr. Our Head of IT directly reports to, and meets periodically with, our Senior Vice President of Finance and Administration to discuss and review our cybersecurity risk management processes.


text: Our board of directors has delegated oversight of our company's cybersecurity risk management to our audit committee. The audit committee, pursuant to the audit committee charter, is responsible for reviewing our company's information security and technology risks (including cybersecurity), including high-level review of the threat landscape facing our company and our company's strategy to mitigate cybersecurity risks and potential breaches. We have recently implemented a process for our Senior Vice President of Finance and Administration and/or our Chief Financial Officer, as appropriate, to provide periodic updates to the audit committee on the status of our cybersecurity program and on an as needed basis.


text: We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect information from unauthorized access or attack, as well as secure our network and systems. Such processes include physical, procedural, and technical safeguards, response plans, regular tests on our systems, incident simulations, and routine review of our policies and procedures to identify risks and improve our practices. We engage certain external parties, including consultants, computer security firms and risk management, peer companies, industry groups, and governance experts, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them to help protect us from any related vulnerabilities. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber attacks, and other related breaches.

companyName: Inozyme Pharma, Inc.


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides periodic updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our Executive Director of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The Executive Director of Information Technology has over 25 years of experience working with life science companies and venture capital firms in the information technology field, a certificate from HarvardX (Cybersecurity: Managing Risk), and an active membership in Health-ISAC.


text: We have also established a cross-functional Cybersecurity Steering Committee, led by our Chief Executive Officer serving as the chair and consisting of other executive-level leaders, that is responsible for providing leadership in the protection of information assets and technology. The committee members advise on and prioritize the development of information security initiatives, projects, and policies as advocates for our stakeholders. This committee is also charged with helping to resolve security and compliance risk issues affecting us.


text: In order to help deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with a monthly data protection, cybersecurity, and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security, and educates employees on the importance of reporting all incidents immediately. We engage third-party vendors for 24/7 monitoring and comprehensive incident response measures. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.


text: Privacy Officer, in collaboration with the CISO, is required to review the IRP on at least an annual basis, which may include the incorporation of any lessons learned from prior incidents.

companyName: JONES FINANCIAL COMPANIES LLLP


text: The Partnership has an enterprise-wide business resiliency program, policy and framework to assist in planning for, and mitigating disruption to the Partnership's business operations from, incidents including cybersecurity events, through risk assessment, business impact analysis, response plan development, training, testing, and ongoing maintenance. The Business Resilience Department is responsible for creating and maintaining the Partnership's business resilience policy and framework and overseeing the program's implementation in collaboration with sponsors and leaders from the Firm's business areas. A Business Resilience Oversight Group comprised of general partners meets at least semi-annually and provides oversight of business resilience strategy, risk management, resources, performance, and integration into business processes. Elements of business continuity plans vary based on the nature of the processes involved and the impacts of the incident but can include planning related to human capital, real estate, third-party relationships and technology infrastructure. As part of its business resiliency planning, the Partnership has data centers in two geographically distinct locations and its third-party vendors have data centers in several regions of the United States. A prolonged interruption at any site or of critical systems or software may result in an extended delay of service to the Partnership's clients and substantial costs and expenses.


text: The Partnership, in the normal course of business, at times experiences cybersecurity threats and incidents affecting its data or systems or systems of third parties relied on by the Partnership, and the Partnership's programs and measures discussed above may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us in the future. The Partnership has not identified any previous cybersecurity incidents that have materially affected or are reasonably likely to have a material effect on its business strategy, reputation, financial condition or results of operations. For information on material risks of potential cybersecurity threats, refer to Part I, Item 1A – Risk Factors – Risks Related to Business Operations – Information Security Incidents and Fraud.


text: Risk Management and Strategy Peapack-Gladstone Bank's risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Peapack-Gladstone Bank's Information Security Officer is primarily responsible for cybersecurity and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to the Information Technology Steering Committee and Peapack-Gladstone Bank's board of directors.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: Our objective for managing cybersecurity risk is to avoid or minimize the impact of external threat events or other efforts to penetrate, disrupt or misuse Peapack-Gladstone Bank systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Peapack-Gladstone Bank's Information Security Officer and Chief Information Officer, who reports directly to the Chief Operating Officer, along with other key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of Peapack-Gladstone Bank's efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of Peapack-Gladstone Bank infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and Peapack-Gladstone Bank's supply chain. We also actively monitor our email gateways for malicious phishing e-mail campaigns and monitor remote connections as a significant portion of Peapack-Gladstone Bank's workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to Peapack-Gladstone Bank's information security program, to assess their design and operating effectiveness and make recommendations to strengthen the Bank's risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the Bank's Information Technology Steering Committee as well as the board of directors. The Incident Response Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of Peapack-Gladstone Bank's organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Peapack-Gladstone Bank's internal systems,processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected the Company, including its business strategy, results of operations, or financial condition.


text: Peapack-Gladstone Bank's Chief Information Officer, Chief Technology Officer, and Information Security Officer are accountable for managing and ensuring compliance with the Bank's information security program. Included in the responsibilities of this management team is the oversight and the administration of the cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience.


text: Annual external cybersecurity and compliance assessments are conducted for the identification, prioritization, and remediation of cyber-related risks to the company's information systems and data. Ongoing internal risk assessments are conducted to ensure protective and detective security controls perform as expected.


text: Peapack-Gladstone Bank's board of directors has approved management committees including the Information Technology Steering Committee, which focuses on technology and cyber related business impact. This committee provides oversight and governance of the technology program and the information security program. The committee is chaired by managers within the enterprise information technology department and include the Chief Information Officer, Chief Technology Officer, and Information Security Officer. The committee meets quarterly to provide oversight of the risk management strategy,standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings may occur to facilitate timely informing and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Bank's board of directors.


text: The Bank's board of directors are responsible for overseeing Peapack-Gladstone Bank's information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Peapack-Gladstone Bank's Information Security Officer, Chief Information Officer, and Chief Technology Officer provide reports to the Bank's board of directors regarding the information security program, technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The board of directors reviews and approves Peapack-Gladstone Bank's information security program, technology budgets, and strategies annually.


text: Cybersecurity Risk Management We operate in a highly regulated industry that requires the continued operation of advanced information technology systems and network infrastructure and we recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We manage these risks from cybersecurity threats through our enterprise risk management process which is overseen by our board of directors through an enterprise risk management policy. This policy requires a risk management committee, which is chaired by our President and CEO and also includes our other executive officers, and which is responsible for managing our risks including cybersecurity. The risk management committee meets on a monthly basis, and can be convened as needed to address any time-sensitive matters arising between scheduled meeting dates.

companyName: OLD DOMINION ELECTRIC COOPERATIVE


text: To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, investigate, resolve, remediate, and recover from identified vulnerabilities and security incidents in a timely manner. To address potential material cybersecurity risk in association with the use of third-party providers, we require they meet minimum security requirements. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities.


text: We identify and address cybersecurity threats through a multi-faceted approach including internal IT assessments and procedures, third-party assessments, internal audits, governance, and risk and compliance reviews. Identifying and assessing cybersecurity risk is integrated into our overall risk management processes.


text: We conduct proactive cybersecurity reviews of our systems and applications, audit applicable processes and applications, perform testing on our security controls, conduct exercises to simulate cybersecurity incidents, conduct employee training, and monitor emerging laws and regulations related to data protection and information security. We evaluate the results and responses to these efforts and implement appropriate changes to improve our security measures.


text: In accordance with our board policy for incident management and business continuity planning, we have implemented security incident response plans and security incident response teams. These teams include members from multiple functional areas of our organization that identify, investigate, respond, and resolve cybersecurity incidents. Cybersecurity incidents are evaluated and ranked by severity and prioritized for response. We also evaluate the need to include the use of third parties to assist us in the response to a cybersecurity incident. Our Senior Vice President and COO leads the security response teams, and the activities of the security response teams are overseen by our senior management team. Based on the severity of incident, members of the senior management team determine whether the incident requires immediate escalation to our board of directors.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents have been immaterial. This includes penalties and settlements, of which there were none. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business operations and financial condition. See "Risk Factors" in Item 1A.


text: Cybersecurity Governance Our board of directors oversees our biennial enterprise risk assessment process that we utilize to assess key risks within the company, including security and technology risks and cybersecurity threats. The audit committee of our board of directors oversees our internal control over financial reporting, including with respect to financial reporting-related information systems. The audit committee receives internal audit reports conducted by an independent audit firm on various cybersecurity matters. In addition, our risk management committee reviews and evaluates reports monthly, and as needed, related to cybersecurity activity and incidents.


text: To mitigate identified cyber-related risks to our organization, we employ a multi-layered approach that has been integrated into our overall risk management systems and processes that includes: • Security Controls: We have implemented industry-standard security controls aligned with the NIST CSF framework such as identity and access control, multi-factor authentication, encryption, and data protection measures. • Security Awareness: We conduct regular cybersecurity awareness training to educate employees about potential threats and best practices for safeguarding company assets and data. In addition, we conduct periodic phishing tests to enhance our security awareness program. • Third-Party Oversight: We evaluate third-party partners' cybersecurity practices through due diligence assessments and contractual obligations. Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers. • Continuous Monitoring: We have partnered with a third-party Managed Security Services Provider to provide event logging, monitoring for detection of cybersecurity events, and assistance with investigations into possible cyber-related events, as well as assessment and consultation on security enhancements. • Business Resiliency: We have developed emergency response, business continuity, and disaster recovery plans to respond to a widespread disruption to business operations. • Continuous Improvement: Any previous cybersecurity incidents, whether material or not, have resulted in improvements in the company's cybersecurity program, policies, or technical controls, where applicable.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to affect our company, including our business strategy, results of operations or financial condition. We and our third-party partners have frequently been the target of cybersecurity threats and expect them to continue. For an additional description of these cybersecurity risks and potential related impacts on us, see "Risk Factors - Cyberattacks and security vulnerabilities could lead to increased costs, liability claims, unauthorized access to customer data, or harm to our reputation" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management team. We have established a cybersecurity governance framework that encompasses policies, procedures, and controls designed to support cybersecurity risk management practices. Our Senior Information Systems Manager is responsible for assessing and managing material risks from cybersecurity threats. This position reports directly to our Senior Vice President of Strategy and Information Technology. In addition, we have retained Virtual Chief Information Security Officer services to support our cybersecurity risk management and governance practices. Such individuals have substantial prior work experience in various roles involving cybersecurity risk management and information technology, including security, compliance, systems and programming, and bring a wealth of expertise in their roles. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy process described above, and report to our Managed Security Services Provider and our Board of Directors on any appropriate items. Our Board of Directors oversees the cybersecurity program and receives program metrics as well as information related to identified cyber-related risks when meeting with the company's management.


text: While we continuously invest in cybersecurity controls, we acknowledge the possibility of cybersecurity incidents despite our efforts. These incidents may include unauthorized access, data breaches, ransomware attacks, and service disruptions. We have contracted with a cyber insurance provider, Incident Response provider, and a Managed Security Services Provider to minimize the impact of such events and support prompt detection, containment, and recovery measures.


text: Risk Management and Strategy The Company maintains robust processes for assessing, identifying and managing materials risks from cybersecurity threats. The Company's cybersecurity program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, as well as the GLBA and the risk of cybersecurity threats is integrated into the Company's Enterprise Risk Management ("ERM") program, governed by the Board level Risk Committee. The ERM program includes an annual risk prioritization process to identify key enterprise risks. Each key risk is assigned risk owners to establish action plans and implement risk mitigation strategies. The cybersecurity threat risk action plan is managed at the enterprise level and led by the Director of Information Security. Periodically, the risk owners review and update the cybersecurity threat risk action plan to provide the status on specific risk mitigation actions and to identify new threats. To oversee and identify cybersecurity threat risks on a day-to-day basis, including from third-party service providers, the Company maintains a security operations center with round-the-clock monitoring, and the Director of Information Security along with the Chief Information Officer ("CIO") receives regular reports on industry activity. Management also assesses the cybersecurity proficiency of potential third-party vendors and cloud suppliers before utilizing their services. The assessment identifies cybersecurity-related risks an includes recommendations to enhance the security of new cloud computing services. The Company reassesses cloud suppliers quarterly.

companyName: CAMBRIDGE BANCORP


text: The Company works to continually assess, identify and manage cybersecurity risks. In addition, the Company engages with third-party cybersecurity specialists to provide an independent assessment of the Company's cybersecurity programs to maintain compliance and operational excellence. Management periodically reviews operational plans and modifies them in response to changes in the threat landscape and otherwise as needed. Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" above for more information.


text: We design and assess our program based on the Center for Internet Security Framework (CISF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CISF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: HilleVax, Inc.


text: The Board of Directors is responsible for overseeing the assessment and management of enterprise-level risks that may impact the Company. The Risk Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. Management, including the CIO and Director of Information Security, reports on cybersecurity matters at least quarterly to the Board, primarily through the Risk Committee, including an annual report regarding specific risks and mitigation efforts within the Company. Management provides benchmarking information and updates on key operational and compliance metrics to the Board. In addition, cybersecurity training is provided to the full Board, including training by third-party experts, to educate directors on the current cyber threat environment and measures companies can take to mitigate risks and impact of cyber attacks.


text: The Company maintains a Cybersecurity Incident Response Plan (the "CSIRP"), which establishes an organizational framework and guidelines intended to facilitate an effective response and handling of cybersecurity incidents that could jeopardize the availability, integrity, or confidentiality of the Cambridge Trust Company's assets. The CSIRP outlines roles and responsibilities, criteria for measuring the severity of a cybersecurity incident, and an escalation framework, including processes for informing legal counsel and the Board of Directors of material cybersecurity incidents. As described above, management is actively involved in assessing and managing the Company's material cybersecurity risks. The CIO, the Director of Information Technology as well as the Director of Information Security primarily lead these efforts. The CIO, who reports directly to CEO, is responsible for the oversight of the Company's entire information technology operations. The Director of Information Security reports directly to the Risk Committee and has responsibility for leadership of the Company's cybersecurity program.


text: In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a dedicated information technology team, which is led by our Chief Financial Officer and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, and other contractors and suppliers. We also conduct periodic employee training on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: HERON THERAPEUTICS, INC. /DE/

ticker: HRTX


text: Our Chief Financial Officer, who reports directly to the Chief Executive Officer and has over 15 years of experience managing information technology and cybersecurity matters, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected us. However, we face certain ongoing cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Chief Financial Officer. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal data of employees and others ("Information Systems and Data").

companyName: Longboard Pharmaceuticals, Inc.


text: Our information technology department helps identify, assess and manage our cybersecurity threats and risks. Our information technology department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: manual and automated cybersecurity tools such as malware scans; vulnerability testing, such as phishing simulations; and analysis of reported threats.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of material cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with legal, information technology, and/or compliance personnel of the Adviser.

companyName: BCP Investment Corp

ticker: BCIC


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: employee training; access controls; data encryption; systems monitoring; regular patching of operating systems and software; a Password Policy; a written IT Security Incident Response Plan; and cybersecurity insurance coverage.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the information technology department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and reports to the Audit Committee of the Board of Directors, which evaluates cybersecurity and information technology risk as well as other aspects of our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software and training providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as electronic communications service providers, cloud-based file storage service providers, and contract research organizations ("CROs").


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I, Item 1A, Risk Factors in this Annual Report on Form 10-K, including the risk factors titled "Significant disruptions of our information technology systems or data security incidents could result in significant financial, legal, regulatory, business and reputational harm to us" and "Artificial Intelligence presents new risks and challenges to our business."


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. The Board of Directors' Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our management, including our Senior Director of Information Technology, who has over 25 years of work experience in various roles in information technology and cybersecurity, including in public companies in our industry, and our Chief Financial Officer, who has experience overseeing the information technology function and implementing and overseeing internal controls frameworks in our industry.


text: Our Senior Director of Information Technology is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our IT Security Incident Response Plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Financial Officer. Our Chief Financial Officer leads the Company's Incident Response Team to help us mitigate and remediate cybersecurity incidents of which we are notified. In addition, our IT Security Incident Response Plan includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.


text: The Audit Committee receives regular reports from management concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Aligos Therapeutics, Inc.

ticker: ALGS


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: After receiving notice of a cybersecurity incident, the IRTC is responsible for investigating the threat to determine whether an actual incident has occurred and, if so, whether a more thorough assessment by the entire IRT is appropriate. During these assessments, steps may be taken to isolate affected systems. Outside advisors may be employed regarding the cybersecurity threat, including to conduct of legal and forensic investigations and work with other third-parties who might be engaged to assist in any response and associated publicity.

companyName: CapStar Financial Holdings, Inc.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Risks related to product development and regulatory process—Our business and operations may suffer in the event that our information technology systems, or those used by our CROs or other contractors or consultants, fail or suffer security breaches."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. The Committee receives reports from management on our cybersecurity risks, at a minimum annually and as needed. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team, lead by our Executive Director, Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants. Our management team's experience includes a combined 25 years of experience in managing IT environments including assessing the overall risk management program and material risks, as well as building our cybersecurity framework over the past six years.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity risk management is part of the Company's overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and facilitate coordination across different departments of our company. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our Board of material cybersecurity threats and incidents. We engage with third party service providers to perform penetration tests and to inform us of possible vulnerabilities. In addition, cybersecurity training is provided to all employees on a regular basis but at least annually.

companyName: PHX MINERALS INC.


text: Our Board has overall oversight responsibility for our risk management, including the cybersecurity risk management program. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Principal Accounting Officer, who receives reports from our cybersecurity consultants and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Any significant cybersecurity incidents are reported to the audit committee, which is 100% independent, and ultimately to our Board. There were no such cybersecurity incidents in fiscal 2023, 2022, or 2021. Management presents an assessment of our cybersecurity processes, procedures, and results of testing to the Audit Committee at least annually.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – We may be subject to information technology system failures, network disruptions, cyber-attacks or other breaches in data security." in this Form 10-K.


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: BC Partners Lending Corp


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program, overseen by the Adviser's Global Head of Infrastructure & Cybersecurity ("GHIC"), which is designed to assess, identify, and manage material cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and other specialists as appropriate to evaluate cybersecurity measures and risk management processes, including those applicable to the Company.


text: The Company relies on the Adviser's risk management program and processes, which include cyber risk assessments. The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company takes steps to identify and oversee risks from cybersecurity threats associated with our use of such entities and the Chief Compliance Officer ("CCO") of the Company reviews cybersecurity-related reports provided by key service providers.


text: Board Oversight of Cybersecurity Risks The Board would be made aware of any material risks associated with cybersecurity threats. The Board currently receives periodic updates from the Company's CCO regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.