text: Board of Directors' Roles and Responsibilities Our cybersecurity risks and associated mitigations, as part of our enterprise risk management, are evaluated by senior leadership. These risks and mitigations are also subject to oversight by the Audit Committee and the ROC of our Board of Directors The ROC is the primary committee that oversees enterprise cybersecurity risks and reviews cybersecurity matters. The ROC oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with data protection and security regulations, and related risks. The ROC receives information regarding such risks from management, including our CISO, and reports to the Board on a quarterly basis. The ROC also oversees the Board's response to any significant cybersecurity incidents.


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process, appropriate disclosure personnel collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: Marcus & Millichap, Inc.

ticker: MMI

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: Our CSO and cybersecurity team actively monitor our systems, regularly review our policies, compliance, regulations and best practices, perform penetration testing, conduct incident response exercises and internal ethical phishing campaigns and provide periodic training and communication across our organization to strengthen security focused behavior and foster a culture of digital safety. Our cybersecurity team also routinely participates in industry-wide programs to further information sharing, intelligence gathering and unity of effort in responding to potential or actual attacks. We also periodically review our business continuity plan to develop an effective recovery strategy that seeks to decrease incident response times, limit financial impacts and maintain customer confidence during any business interruption. Our cybersecurity team also administers a third-party risk governance program that identifies potential risks introduced through third-party relationships, such as vendors, software and hardware manufacturers or professional service providers. We seek to obtain certain contractual security guarantees and assurances with these third-party relationships to help ensure the security and safety of our information. The cybersecurity team works closely with a broad range of departments, including legal, regulatory, corporate communications, audit services, information technology and operational technology functions critical to our operations, as well as engaging external vendors to help ensure our cybersecurity program operates effectively.

companyName: Liberty Global Ltd.

ticker: LBTYA


text: Our current CSO has significant experience leading cybersecurity efforts at large enterprises, having held top information security positions at a number of international large- and mega-cap companies during her career. She also holds a master of science in security risk management and is qualified as a certified information security manager with the Information Systems Audit and Control Association. Our CSO has been with the company or its subsidiaries for over five years.

stage1Category: Management Role

stage1Method: majority


text: Cybersecurity incidents detected by our cybersecurity team are evaluated internally based on their severity, with more serious incidents being escalated, as appropriate, to the highest levels of management, including our CTO, General Counsel and, ultimately, our CEO. These members of our executive leadership team are provided with details of the type and severity of the attack, the company's planned response to the incident and are briefed on what information was accessed and the impact such incident has had or is expected to have on our operations, as well as any financial or regulatory implications resulting from the incident.


text: Our Audit Committee is responsible for oversight of our cybersecurity measures, incident response management and risks related to cybersecurity and technology as well as the steps taken by management to mitigate such risks. Our CSO provides periodic updates to the Audit Committee on the state of our cybersecurity posture, new threats or threat actors that we are monitoring or developing defenses against and any potential areas of improvement. Our CEO, CTO, CSO and General Counsel will also provide ad hoc updates to the Audit Committee and full board of directors, as appropriate, in the case of a material cybersecurity incident, providing them a full briefing of the type and scope of the incident as well as our current and planned mitigation efforts. The Audit Committee has several members with significant direct and indirect cybersecurity experience, including Anthony Werner, the former CTO of Comcast Cable and the company, Paul Gould and Miranda Curtis CMG. Cybersecurity and the effectiveness of our cybersecurity strategy are regular topics of discussion at meetings of our Audit Committee and board of directors.

stage1Category: Board Governance


text: In 2024, there were no cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected or are reasonably likely to materially affect the company, including its business strategy, results of operations or financial condition.

stage1Category: Strategy Integration


text: Risk Management and Strategy The Company is subject to various cybersecurity risks and continuously monitors and assesses its cybersecurity measures to protect against potential threats. These risks include operational disruption, reputational harm, theft of intellectual property, fraud, extortion, harm to customers or employees, and violation of data privacy or security laws.

companyName: Science Applications International Corp

ticker: SAIC


text: The Company has a comprehensive cybersecurity management and oversight program designed to identify, manage, and mitigate potential risks. This program is integrated into our overall risk management systems and processes and includes continuous monitoring of cybersecurity threats, regular assessments of information systems, vulnerability management, penetration testing, employee training on cybersecurity best practices, and ongoing assessments of risk.


text: In the event of a cybersecurity incident, the Company has established an incident response plan to promptly and effectively address the situation. Cybersecurity events and data incidents are evaluated, ranked by severity and prioritized for escalation to senior management and the Risk Oversight Committee ("ROC") of our Board of Directors, response and remediation. The plan includes procedures for investigating and containing incidents, notifying affected parties, and implementing corrective actions to prevent future occurrences.


text: The Company relies on various third party providers, such as vendors, suppliers and other business partners for certain aspects of its operations. These third parties may also be susceptible to cybersecurity risks. The Company conducts due diligence on the cybersecurity practices and controls on these providers, as well as inclusion of contractual provisions requiring the providers to maintain appropriate cybersecurity measures. In addition, in the case of a third-party cybersecurity incident, the Company identifies and mitigates risks to minimize impacts to us from third party incidents.

stage1Category: Third-Party Risk


text: Cybersecurity Threats To date, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business operations or financial condition. While the Company has taken significant steps to manage cybersecurity risks, there can be no assurance that these measures will prevent all potential incidents. A material cybersecurity incident could have material adverse effect on the Company's financial condition, results of operations, or cash flows. The Company is committed to addressing cybersecurity risks in an ever-evolving technological landscape. Management will continue to evaluate and enhance its cybersecurity measures to adapt to emerging threats and comply with evolving regulatory requirements.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our organizational strategy, results of operations, or financial condition as part of our risk factor disclosures in Part I, Item 1A of this report.

stage1Category: None/Other


text: Risk Management and Strategy We are subject to various cybersecurity risks and continuously monitor and assess our cybersecurity measures to protect against a multitude of cyber threats from adversaries, including nation state actors, that target critical infrastructure sectors such as the defense industrial base. A cybersecurity incident impacting us or our subcontractors or suppliers could materially adversely affect our operations, performance, and results.


text: We expend considerable resources on our cybersecurity management and oversight program designed to identify, manage, and mitigate cybersecurity risks. This program is integrated into our overall risk management systems and processes and includes continuous monitoring of cybersecurity threats, regular assessments of information systems, vulnerability management, penetration testing, employee training on cybersecurity best practices, and ongoing assessments of risk.


text: We have established an incident response plan to promptly and effectively address cybersecurity incidents. The incident response plan provides steps to identify, mitigate, and recover from incidents, and procedures to escalate issues to senior management, legal, and, when appropriate, our Board of Directors. The plan includes procedures for investigating and containing incidents, notifying affected parties, as appropriate, and implementing corrective actions.


text: As a defense contractor, we must comply with DoD cybersecurity requirements for handling Controlled Unclassified Information ("CUI") and requirements in the Defense Federal Acquisition Regulation Supplement ("DFARS") regarding reporting cybersecurity incidents to the DoD, including the DoD's Cybersecurity Maturity Model Certification ("CMMC") program. We are prepared to participate in this program and obtain associated CMMC certification. We also adhere to the standards set forth by the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization ("ISO") to ensure the highest level of security and operational excellence. Our commitment to compliance with these rigorous frameworks is integral to maintaining the confidentiality, integrity, and availability of our services and products.


text: We rely on various third-party providers, such as vendors, suppliers and other business partners for certain aspects of our operations. These third parties are also susceptible to cybersecurity risks. We conduct due diligence on the cybersecurity practices and controls on these providers and include provisions in our contracts requiring appropriate cybersecurity measures. In addition, in the case of a third-party cybersecurity incident, we identify and mitigate risks to minimize impacts to us from third-party incidents.


text: We share and receive threat intelligence with our peers in the defense industrial base, government agencies, information sharing and analysis centers, and cybersecurity associations. We have relationships with third-party service providers who also assess our security controls through penetration testing, independent audits, and consulting on best practices to address emerging challenges. These assessments evaluate the effectiveness of our security controls.


text: Management's Responsibilities Our information security program is led by our corporate Chief Information Security Officer ("CISO"), who works closely in a cross-functional capacity with key corporate and operational business stakeholders, including our Chief Information Officer. They and the other individuals supporting our information security program demonstrate their cybersecurity expertise through qualifications such as prior work experience, possession of a cybersecurity certification, degree, or other cybersecurity experience. The CISO collaborates with these functions for the purpose of establishing processes and procedures to monitor potential cybersecurity risks, identifying cybersecurity incidents, implementing appropriate mitigation measures, reporting cybersecurity breaches, assessing materiality, maintaining our cybersecurity program, and other information security incidents. The CISO provides regular updates on our cybersecurity posture and preparedness to senior management.


text: Corporate Governance Our Board of Directors provides oversight of risks from cybersecurity threats, in coordination with our Audit Committee and management team. The following is a summary of our governance processes related to cybersecurity risk management:

companyName: TheRealReal, Inc.

ticker: REAL


text: Board of Directors' Roles and Responsibilities Our cybersecurity risks and associated mitigations, as part of our enterprise risk management, are continually monitored by senior leadership. These risks and mitigations are also subject to oversight by the Audit Committee and the Risk Oversight Committee ("ROC") of our Board of Directors. The ROC is the primary committee that oversees enterprise cybersecurity risks and reviews cybersecurity matters, including our policies and procedures for protecting our cybersecurity infrastructure and for compliance with data protection and security regulations, and related risks. The ROC receives information regarding such risks from management, including our CISO, and reports to the Board on a quarterly basis. The ROC also oversees the Board's response to any significant cybersecurity incidents.


text: Cybersecurity Threats While we have taken significant steps to manage cybersecurity risks, there can be no assurance that these measures will prevent all potential incidents. A material cybersecurity incident could have material adverse effect on our financial condition, results of operations, or cash flows. We are committed to addressing cybersecurity risks in an ever-evolving technological landscape. Management will continue to evaluate and enhance its cybersecurity measures to adapt to emerging threats and comply with evolving regulatory requirements.


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our organizational strategy, results of operations, or financial condition as part of our risk factor disclosures in Part I, Item 1A of this report.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Rexford Industrial Realty, Inc.

ticker: REXR


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common: methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify significant cybersecurity risks to our critical systems, and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for certain critical service providers, suppliers and vendors based on our assessment of their criticality to our business and risk profile.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We face risks associated with security breaches through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our IT networks and related systems." Cybersecurity Governance.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding significant cybersecurity incidents.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our director of cybersecurity and technology operations, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: As discussed above, these members of management report to the audit committee about cybersecurity threat risks, among other cybersecurity related matters.


text: Our management team, including, among others, our Chief Financial Officer, General Counsel and Vice President of Risk Management, has overall responsibility for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The management team works closely with our director of cybersecurity and technology operations who has over eight years of experience in IT security, industry certifications, specialized training, and over fifteen years of experience in commercial real estate technology.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have developed and implemented a cybersecurity and information security risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: Our cybersecurity and information security risk management program: (a) is developed by, and in conjunction with, a third-party managed security service provider (MSSP), who helps audit, assess, administer and monitor implementation; (b) once developed, is then integrated into our overall enterprise risk management program, and shares common: methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas; and (c) consists of leveraging a third-party vendor to routinely and periodically stress test our program for system vulnerabilities (including cyber penetration, vulnerability assessment, NIST framework score and compliance) across our cybersecurity and information security risk management program environment.


text: Key elements of our cybersecurity risk management program include: • Risk assessments designed to help identify significant cybersecurity risks to our critical systems and information; • A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees and senior management, including specific training on emerging AI-driven threats; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • A third-party information security risk management process for certain critical service providers, suppliers and vendors based on our assessment of their criticality to our business and risk profile; and • Quarterly third-party internal and external vulnerability assessments from our cybersecurity firm leveraging the Common Vulnerability Scoring System (CVSS). Bi-annual third-party social engineering and cyber penetration testing with third-party information security company that specializes in conducting such tests.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. As AI technology advances, attackers are leveraging AI to automate and enhance cyberattacks, creating more sophisticated and evasive threats. Our cybersecurity program is designed to adapt to these evolving risks by integrating AI-powered security analytics and threat intelligence.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We face risks associated with security breaches through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our IT networks and related systems." Cybersecurity Governance.


text: The Board regularly receives information security and cybersecurity updates, and the Committee receives quarterly reports from management, including the Vice President & Head of Technology and the Director of Cybersecurity and Technology Operations, on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding significant cybersecurity incidents.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Director of Cybersecurity and Technology Operations (who reports directly to the Vice President & Head of Technology), internal security staff or third-party experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including, among others, our Chief Financial Officer, General Counsel and Vice President of Risk Management, has overall responsibility for assessing and managing our material risks from cybersecurity threats and plays an integral role participating in direct oversight of information and cybersecurity risks. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained third-party cybersecurity consultants. The management team works closely with our Vice President & Head of Technology, as well as the Director of Cybersecurity and Technology Operations who has over eight years of experience in IT security, industry certifications, specialized training, and over fifteen years of experience in commercial real estate technology.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: • Briefings from internal security personnel; • Threat intelligence and other information obtained from governmental, public or private sources, including third-party consultants engaged by us; and • Alerts and reports produced by security tools deployed in the IT environment.


text: We face numerous cybersecurity threats that range from cyber-attacks common to most industries to attacks from more advanced and persistent threat actors that target large information technology companies with products and services operating in strategic sectors. We could be adversely affected by cybersecurity incidents affecting our systems or the systems of our suppliers and other third-party service providers. To address these threats, we expend considerable resources on cybersecurity risk management, strategy, and governance.

companyName: Dell Technologies Inc.

ticker: DELL


text: We assess, identify, and manage material cybersecurity risks in a number of ways. Our global security and resiliency organization, under the leadership of our Chief Security Officer ("CSO"), has established an internal governance structure to identify, assess, rate, and manage cybersecurity risks across the Company in an integrated manner. The security and resiliency organization advises each business unit and functional area on addressing cybersecurity risks and monitors initiatives to mitigate and manage such risks over time. Each business unit or functional area is responsible for managing risks and ensuring that security and resiliency policies and standards are implemented within the respective business unit or function. Compliance with our internal security and resiliency policies and standards is assessed by our internal audit team, which has a dedicated cybersecurity audit function.


text: Our security and resiliency organization includes a dedicated cybersecurity function led by our Chief Information Security Officer ("CISO"). As part of our cybersecurity function, the cybersecurity and intelligence response team ("CSIRT") administers a program to monitor, detect, investigate, respond to, and escalate management of internal and external cybersecurity threats and incidents. The CSIRT provides threat intelligence information to our CSO, broader security and resiliency organization, and relevant business units and functional areas.


text: We also engage third parties in connection with our cybersecurity risk management processes, including cybersecurity consultants and auditors, to conduct evaluations of our security controls and provide certifications for industry-standard security frameworks, such as ISO 27001 and PCI-DSS. In addition to monitoring risks from threats to our own assets, we administer a third-party risk management program that endeavors to help identify and manage risks from cybersecurity threats arising from our suppliers and other service provider organizations. This program seeks to combine a methodology for risk ratings with targeted cybersecurity assessments, security-focused contractual requirements, and monitoring activities based on the risk profile of covered suppliers and service providers.


text: Our CSO reports to our General Counsel and has principal executive responsibility and oversight for the Company's strategy, planning, and operations on the management of both physical and cybersecurity risk. Our CSO has extensive cybersecurity and program management experience and previously served in relevant leadership positions at another large multinational corporation and the U.S. Department of Defense. He is supported by our Chief Information Security Officer, who has extensive cybersecurity experience in both the private and public sectors, and a team of cybersecurity professionals with relevant and expansive educational and industry experience.


text: Cybersecurity risk management has been integrated into the Company's overall enterprise risk management program ("ERM") through the Company's enterprise risk governing bodies, which are the Global Risk and Compliance Council ("GRCC") and the Enterprise Risk Steering Committee ("ERSC"). Our CSO reports on cybersecurity risk to the GRCC and ERSC and also serves as a member of the ERSC. The CSO regularly meets with members of our executive leadership team to discuss cybersecurity risks, as well as related mitigation and remediation activities. In addition, information on cybersecurity risks is further integrated into our overall ERM through our central internal audit function, which incorporates such information in regular audits of our cybersecurity and data protection controls and processes.


text: Our Board of Directors oversees significant cybersecurity risks to the Company directly and through its Audit Committee. The Board of Directors meets with our CSO or his delegate annually to review significant cybersecurity risks as well as cybersecurity priorities and focus areas for the upcoming fiscal year. The Audit Committee meets with our CSO or his delegate quarterly to review significant cybersecurity incidents and risks, as well as progress made towards key cybersecurity initiatives and matters. The CSO may provide more frequent updates to the Board of Directors and Audit Committee if necessitated by a security incident or other developments. The Audit Committee reports regularly to our Board of Directors regarding the committee's oversight of cybersecurity risk matters.


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incident, have materially affected our business strategy, results of operations, or financial condition. Notwithstanding our investment in cybersecurity, we may not be successful in identifying a cybersecurity risk or preventing or mitigating a cybersecurity incident or product security vulnerability that could have a material adverse effect on our business, results of operations, or financial condition. For a discussion of cybersecurity risks affecting our business, see "Item 1A—Risk Factors—Risks Relating to Our Business and Our Industry." Although we maintain cybersecurity insurance, the costs related to cybersecurity incidents may not be fully insured.


text: We also engage third parties in connection with our cybersecurity risk management processes, including cybersecurity consultants and auditors, to conduct evaluations of our security controls and provide certifications for industry-standard security frameworks, such as ISO 27001 and SOC, Type 2. In addition to monitoring risks from threats to our own assets, we administer a third-party risk management program that helps identify and manage risks from cybersecurity threats arising from attacks against our suppliers and other service provider organizations. This program seeks to combine a methodology for risk ratings with targeted cybersecurity assessments, security-focused contractual requirements, and monitoring activities based on the risk profile of covered suppliers and service providers.


text: Our CSO reports to our General Counsel and has principal executive responsibility and oversight for the Company's strategy, planning, and operations on the management of both physical security and cybersecurity risk. Our CSO has extensive cybersecurity and program management experience and previously served in relevant leadership positions at another large multinational corporation and the U.S. Department of Defense. He is supported by our CISO, who has extensive cybersecurity experience in both the private and public sectors, and a team of cybersecurity professionals with relevant and expansive educational and industry experience.


text: For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy and results of operations, see "Risk Factors – Risks Related to Data Security, Privacy and Fraud," which are incorporated by reference into this Item 1C.


text: Our Board of Directors oversees significant cybersecurity risks to the Company directly and through its Audit Committee. The Board of Directors meets with our CSO or his delegate annually to review significant cybersecurity risks as well as cybersecurity priorities and focus areas for the upcoming fiscal year. The Audit Committee meets with our CSO or his delegate quarterly to review significant cybersecurity incidents and risks, programmatic security modifications and enhancements, and progress made towards key cybersecurity initiatives and matters. The CSO may provide more frequent updates to the Board of Directors and Audit Committee if necessitated by a security incident or other developments. The Audit Committee reports regularly to our Board of Directors regarding the committee's oversight of cybersecurity risk matters.


text: Risk Management and Strategy We have developed processes for assessing, identifying and managing material risks from cybersecurity threats. We review our security plans and strategies as threats and conditions evolve. The following is a summary of our cybersecurity risk management and strategy processes:


text: Enterprise Risk Management: Our enterprise risk management program includes management of material risks from cybersecurity threats alongside other Company risks as part of our overall risk assessment process. In 2023, our Internal Audit team completed an Enterprise Risk Assessment to identify and prioritize the most critical risks that could impact our ability to achieve our business priorities and make risk-informed strategic decisions. With management's input, our Board and Internal Audit team have identified cybersecurity as one of the risks that merits the highest level of prioritization. Informed by this designation, our Internal Audit team tracks cybersecurity key indicators and engages in discussions on the status, priorities and impact of cybersecurity risk response plans; reports key information to management throughout the year to inform decision making; and reports to the Audit Committee on a quarterly basis and to the full Board on the results and progress of the risk mitigation process.


text: In addition, we employ a range of tools and services to inform our assessment, identification and management of material risks from cybersecurity threats, which include from time to time: • monitoring emerging data protection laws, including the California Consumer Privacy Act and the General Data Protection Regulation, and implementing responsive changes to our processes; • undertaking periodic reviews of our policies and statements related to cybersecurity; • conducting cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • conducting phishing email simulations for employees and contractors with access to corporate email systems; • requiring employees, as well as third-parties who provide services on our behalf, to treat information and data with care; and • conducting tabletop exercises to simulate a response to a cybersecurity incident and using the findings to improve our processes and technologies.


text: Incident Response Team and Outside Resources: We have formed an Incident Response Team that monitors and mitigates material risks from cybersecurity threats. This team is composed of members from the information security, engineering and legal teams. The Incident Response Team and our internal legal team work in tandem to estimate the severity and materiality of a cybersecurity incident, create a response plan and inform other stakeholders as appropriate, including the Audit Committee or the full Board. In addition, we engage several third party service providers to monitor cybersecurity threats in the market more broadly, including in relation to phishing, data leaks on the dark web, firewalls, code security and endpoint protection. To identify risks from cybersecurity threats associated with these third-party service providers, we conduct pre-contract screening and due diligence and post-contract monitoring.


text: Cybersecurity Task Force: We have formed a cross-functional Cybersecurity Task Force that focuses on long-term cybersecurity strategy. The Cybersecurity Task Force is composed of members from the information security, engineering and legal teams and reports to our Chief Technology and Product Officer. The Cybersecurity Task Force meets periodically to discuss developments and best practices in cybersecurity incident response. In addition, the Cybersecurity Task Force reviews the business impact and severity of potential cybersecurity incidents, as reported by our automated systems, utilization of the bug bounty program, and public reports on the threat landscape.


text: In the three most recently completed fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Board: Our full Board receives biannual updates on cybersecurity from our Chief Technology and Product Officer (the "CTPO") or head of cybersecurity (the "CISO") to, among other items, review cybersecurity incidents, review key metrics on our cybersecurity program and related risk management programs, and discuss our cybersecurity programs and goals. Our Board also regularly reviews cyber-related risks as part of our enterprise risk management program on a quarterly basis and receives updates from our Internal Audit team on the results of the risk monitoring and mitigation process, as described in more detail above.


text: Audit Committee: Our Audit Committee provides additional oversight of material risks from cybersecurity threats and engages with our CTPO or CISO regarding risk management of cybersecurity issues and to discuss potential updates to the Company's cybersecurity risk management program, including as a result of any Cybersecurity Task Force findings. The Audit Committee receives a quarterly report from the Company's cybersecurity team, which includes the CTPO, CISO, and members of the information security team, that summarizes progress on cyber-related key performance indicators, including product security, cloud security, risk and compliance, identity issues, and cyber defense. The Audit Committee updates the full Board on matters relating to material cybersecurity risks at least quarterly.


text: Management: Our CTPO is responsible for assessing and managing the Company's material risks from cybersecurity threats, and our CISO reports directly to our CTPO regarding such threats. Our CTPO is informed about and monitors the prevention, detection, mitigation and remediation or cybersecurity incidents through the management of and participation in the Company's Internal Audit team, Incident Response Team and Cybersecurity Task Force, as described above. As discussed above, our CTPO or CISO reports biannually to the full Board and quarterly to the Audit Committee about risks from cybersecurity threats among other cybersecurity related matters. To the extent a material cybersecurity incident occurs, our CTPO and broader management team would inform the chair of our Audit Committee of the nature, scope and impact of the incident, and involve the other members of the Audit Committee or the full Board as necessary to evaluate the risks and determine next steps. Our CTPO has served in this role since 2023 and has more than 20 years of experience in various senior leadership roles involving managing cybersecurity and compliance teams, including as Head of Tech and Digital at Lovevery and as Chief Technology and Product Officer at Zulilly.


text: Enterprise Risk Management: Our enterprise risk management program includes management of material risks from cybersecurity threats alongside other Company risks as part of our overall risk assessment process. In 2024, as part of our Enterprise Risk Management Program, our Internal Audit team identified and prioritized the most critical risks that could impact our ability to achieve our business priorities and make risk-informed strategic decisions. With management's input, our Board and Internal Audit team have identified cybersecurity as one of the risks that merits the highest level of prioritization. Informed by this designation, our Internal Audit team tracks cybersecurity key indicators and engages in discussions on the status, priorities and impact of cybersecurity risk response plans; reports key information to management throughout the year to inform decision making; and reports to the Audit Committee on a quarterly basis and to the full Board on the results and progress of the risk mitigation process.


text: Board: Our full Board receives biannual updates on cybersecurity from our Chief Technology and Product Officer (the "CTPO") or head of cybersecurity (the " CISO ") to, among other items, review cybersecurity incidents, review key metrics on our cybersecurity program and related risk management programs, and discuss our cybersecurity programs and goals. Our Board also regularly reviews cyber-related risks as part of our enterprise risk management program on a quarterly basis and receives updates from our Internal Audit team on the results of the risk monitoring and mitigation process, as described in more detail above.


text: Management: Our CTPO is responsible for assessing and managing the Company's material risks from cybersecurity threats, and our CISO reports directly to our CTPO regarding such threats. Our CTPO is informed about and monitors the prevention, detection, mitigation and remediation or cybersecurity incidents through the management of and participation in the Company's Internal Audit team, Incident Response Team and Cybersecurity Task Force, as described above. As discussed above, our CTPO or CISO reports biannually to the full Board and quarterly to the Audit Committee about risks from cybersecurity threats among other cybersecurity related matters. To the extent a material cybersecurity incident occurs, our CTPO and broader management team would inform the chair of our Audit Committee of the nature, scope and impact of the incident, and involve the other members of the Audit Committee or the full Board as necessary to evaluate the risks and determine next steps. Our CTPO and CISO have served in these roles since 2023. Our CTPO has more than 20 years of experience in various senior leadership roles involving managing cybersecurity and compliance teams, including as Head of Tech and Digital at Lovevery and as Chief Technology and Product Officer at Zulilly. O ur CISO has more than 20 years of experience in leadership roles focused on cybersecurity, cloud engineering, infrastructure, and technical operations, including as CISO and Head of Cloud and Infrastructure Engineering at AutoZone and as Principal Executive Advisory Consultant at Amazon Web Services.


text: The Board of Directors (the Board) exercises cybersecurity oversight and control both directly and indirectly. The Board has designated the Audit Committee as the governing committee for the oversight of Murphy USA's major information technology risk exposures, including those related to cybersecurity, data privacy and data security, and to oversee the steps management has taken to monitor and mitigate such risk exposures. The Audit Committee reviews cybersecurity risks through regular updates from management as needed with no fewer than two reports from management per year, and it monitors the status of ongoing projects to enhance existing information security controls and practices and mitigate the potential risk from evolving cybersecurity threats.

companyName: Murphy USA Inc.

ticker: MUSA


text: While the Audit Committee is responsible for evaluating cyber-risks and overseeing the management of these risks, the entire Board is briefed periodically and considers cyber-risk within the context of enterprise risk facing the organization. Our cyber risk management program is based on recognized best practices for cybersecurity and information technology including the National Institute of Standards and Technology ("NIST") Cyber Security Framework ("CSF") and Payment Card Industry Data Security Standard ("PCI DSS").


text: We have implemented an information security program, which is overseen by our CIO and our Sr. Director, Security & Infrastructure, that consists of controls designed to prevent, detect, and manage reasonably foreseeable cybersecurity risks and threats. Both our CIO and our Sr. Director, Security & Infrastructure each have extensive experience assessing and managing cybersecurity programs and cybersecurity risk across a mix of public and large, private enterprises in the retail space. Our Sr. Director, Security & Infrastructure has over 25-years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Leaders and team members who support our information security program have relevant education and industry experience, including various cybersecurity industry certifications.


text: Together with a third-party, we operate a 24/7 Security Operations Center ("SOC") to monitor the cybersecurity environment and coordinate escalation and remediation of alerts. Any identified incidents are documented and reviewed in accordance with the Company's Incident Response Plan. This Plan lays out the criteria for classification of risk associated with identified issues based on the potential impact and likelihood of a material, adverse impact on the business, financial condition, results from operation, cash flows or reputation. IT leadership initially reviews these incidents, and this information is shared with our Cyber Disclosure Committee, as required. The Cyber Disclosure Committee is comprised of the Company's VP & General Counsel, the Senior Director, Security & Infrastructure, and the VP & Controller. The process requires that any incidents deemed to be potentially material under the Incident Response Plan are immediately escalated in accordance with the Plan to the CEO, other senior leaders of the organization, the Audit Committee Chair, and the full Board as appropriate to formalize the materiality assessment and apprise them of the situation.


text: We utilize a variety of methods performed both internally and by third-parties to assess the Company's cyber risk management program including penetration tests, risk assessments and evaluation against the NIST CSF. The effectiveness of controls and safeguards are evaluated on an on-going basis to address current and emerging cyber-risks. We engage an external auditor to conduct an annual payment card industry data security standard review of our security controls protecting payment information. Our Internal Audit function also regularly reviews various elements of our program utilizing third-party subject matter experts in IT and cyber issues to ensure we are complying with our internal controls and staying abreast of best practices in the industry. We incorporate many resources and tools on both an ad hoc and planned cadence to maintain readiness to withstand and respond to a cyber incident including incident response tabletop exercises, system recovery exercises, simulated phishing email exercises and security awareness training throughout the organization.


text: Murphy USA relies on numerous third-parties to deliver the goods and services offered to our customers. We maintain a third-party risk management program to evaluate, prioritize, mitigate and remediate risks associated with third-parties; however, we rely on those third-parties to implement security programs commensurate with their risk and we cannot ensure in all circumstances that their efforts will be successful. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks. For the 2023 period presented within this Annual Report, Murphy USA is not aware of any threats or cybersecurity incidents that have or are reasonably likely to materially affect our strategy, results of operations or financial condition.


text: While the Audit Committee is responsible for evaluating cyber-risks and overseeing the management of these risks, the entire Board is briefed periodically and considers cyber-risk within the context of enterprise risk facing the organization. Our cyber risk management program is based on recognized best practices for cybersecurity and information technology including the National Institute of Standards and Technology ("NIST") Cyber Security Framework ("CSF") and Payment Card Industry Data Security Standard.


text: We have implemented an information security program, which is overseen by our CIO and our CISO, that consists of controls designed to prevent, detect, and manage reasonably foreseeable cybersecurity risks and threats. Both our CIO and our CISO each have extensive experience assessing and managing cybersecurity programs and cybersecurity risk across a mix of public and large, private enterprises in the retail space. Our CISO has over 25-years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Leaders and team members who support our information security program have relevant education and industry experience, including various cybersecurity industry certifications.


text: Together with a third-party, we operate a 24/7 Security Operations Center ("SOC") to monitor the cybersecurity environment and coordinate escalation and remediation of alerts. Any identified incidents are documented and reviewed in accordance with the Company's Incident Response Plan. This Plan lays out the criteria for classification of risk associated with identified issues based on the potential impact and likelihood of a material, adverse impact on the business, financial condition, results from operation, cash flows or reputation. IT leadership initially reviews these incidents, and this information is shared with our Cyber Disclosure Committee, as required. The Cyber Disclosure Committee is comprised of the Company's VP & General Counsel, the CISO, and the VP, CAO & Treasurer. The process requires that any incidents deemed to be potentially material under the Incident Response Plan are immediately escalated in accordance with the Plan to the CEO, other senior leaders of the organization, the Audit Committee Chair, and the full Board as appropriate to formalize the materiality assessment and apprise them of the situation.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.

companyName: TriplePoint Venture Growth BDC Corp.

ticker: TPVG


text: Murphy USA relies on numerous third-parties to deliver the goods and services offered to our customers. We maintain a third-party risk management program to evaluate, prioritize, mitigate and remediate cybersecurity risks associated with third-parties; however, we rely on those third-parties to implement cybersecurity programs commensurate with their risk and we cannot ensure in all circumstances that their efforts will be successful. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks. For the 2024 period presented within this Annual Report, Murphy USA is not aware of any threats or cybersecurity incidents that have or are reasonably likely to materially affect our strategy, results of operations or financial condition.


text: Risk Management and Strategy. The Company's information security program consists of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, sensitive data management, electronic communication, risk/security reporting, incident response planning and business continuation planning. The information technology department ("IT Department"), which includes the cybersecurity department ("IT Security Department"), is responsible for implementing such processes and coordinating with the Human Resources Department to align training and onboarding efforts with such processes.

companyName: Braemar Hotels & Resorts Inc.

ticker: BHR


text: The IT Security Department carries out risk management primarily by outsourcing risks to those companies and agencies that specialize in handling such risks and that have the appropriate resources to do so. Additionally, the IT Department assesses and improves the Company's cybersecurity risk management processes on an annual basis by: (i) engaging its cyber insurance broker, AON, plc, to a complete a benchmarking evaluation to compare the Company's cybersecurity posture against peers and (ii) engaging cyber risk readiness and response company, Netdiligence, to conduct vulnerability and penetration testing, which produces a report that specifies any possible risk area and devices. Such report is presented to the IT Department for analysis and for the purpose of developing subsequent action plans to remediate any vulnerabilities. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial conditions, except as otherwise noted.


text: Governance. Management is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer, Vice President of IT, and the Information Security Manager. The Information Security Manager provides a weekly report to the Vice President of IT, which contains an overview of the activity in the department, any United States Computer Emergency Readiness Team alerts processed and all findings from the preventative maintenance tools. The Vice President of IT provides such report to the Chief Financial Officer on a quarterly basis. The Audit Committee of the Board is then briefed each quarter on the occurrence of any cybersecurity incidents. The Board will also be provided an overview of the information security program on an annual basis, including updates on the IT team, IT training, implementation of IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.


text: Risk Management and Strategy. The Company relies on Ashford Inc and the Company's managers to protect the electronic assets of the Company. Their programs consist of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, electronic communication, risk/security reporting, incident response planning and business continuity planning. The information technology department of Remington Hospitality ("IT Department"), which includes a cybersecurity department ("IT Security Department"), is responsible for implementing processes and coordinating with the Human Resources Department to align training and onboarding efforts of Ashford Inc. and Remington Hospitality employees handling the Company's electronic assets.


text: Remington Hospitality's IT Security Department carries out risk management primarily by outsourcing risks to those companies and agencies that specialize in handling such risks and that have the appropriate resources to do so. Additionally, Remington Hospitality's IT Department assesses and improves the Company's cybersecurity risk management processes on an annual basis by: (i) engaging consultants to complete a benchmarking evaluation to compare its cybersecurity posture against peers; and (ii) engaging a cybersecurity risk readiness and response company to conduct vulnerability and penetration testing, which produces a report that specifies any possible risk area and devices. Such report is presented to the IT Department for analysis and for the purpose of developing subsequent action plans to remediate any vulnerabilities. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial conditions, except as otherwise noted.


text: Cybersecurity is of critical importance to our success. We are susceptible to significant and persistent cybersecurity threats, including data breaches, ransomware, and phishing attacks. These threats, which are constantly evolving, include attempts by malicious actors to breach our security and compromise our information technology systems, as well as those of our vendors and suppliers. A cybersecurity incident impacting us or any third party could disrupt operations, damage our reputation, and result in costly litigation and/or government enforcement action. We are committed to maintaining robust cybersecurity and data protection practices and continuously evaluate cybersecurity threats, considering their immediate and long-term effects on our business strategy, operations, and financial condition.

companyName: Sprouts Farmers Market, Inc.

ticker: SFM


text: Governance. Management provided by Ashford Inc. is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer of Ashford Inc. and the Chief Technology Officer for Remington Hospitality. A Cyber Incident Response Team comprised of Ashford Inc. and Remington Hospitality employees meets bi-weekly to review incidents that have occurred and/or impacted the Company's electronic assets. The Chief Technology Officer of Remington Hospitality reviews weekly reports that contain an overview of the activity in the department, any United States Computer Emergency Readiness Team alerts processed and all findings from the preventative maintenance tools. The Chief Technology Officer provides such report to the Chief Financial Officer on a quarterly basis. The Audit Committee of the board of directors is then briefed each quarter on the occurrence of any cybersecurity incidents. The board of directors will also be provided an overview of the information security program on an annual basis, including updates on Remington Hospitality's IT team, IT training, implementation, IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.


text: Risk Management and Strategy We understand the importance of identifying and managing cybersecurity risks that could materially disrupt our business operations. We rely on information technology systems to conduct important operational activities and to maintain business and employee records and financial data. Disruption of these systems could adversely impact our ability to conduct business activities.

companyName: Five Point Holdings, LLC

ticker: FPH


text: We have implemented a cybersecurity risk management program intended to protect the security and availability of our critical systems and information. Our program incorporates certain guiding principles from the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our program includes a cybersecurity incident response plan that consists of incident identification, classification, investigation and diagnosis, response, and recovery.


text: Our process for managing cybersecurity risk is a collaborative effort that includes key members of our information technology, legal, and finance departments, as well as internal audit and third-party cybersecurity firms. Our cybersecurity program takes into consideration the identification of critical data assets, information technology systems, third party service providers, and business processes that may be susceptible to cybersecurity threats. Potential technology vendor relationships are vetted based on the nature of services or technology being provided, and we continue to evaluate these relationships to determine the ongoing necessity of the services and the vendor's risk management posture.


text: As part of our cybersecurity program, we have implemented various strategies and processes to manage cybersecurity risks, which include: • providing training and guidance to our employees on cybersecurity threats and emerging trends, including phishing simulations to increase awareness of potential critical security threats; • obtaining independent and objective assessments by our internal audit department; • annual review of Service Organization Controls ("SOC") reports from our critical third-party vendors based upon a determination of their relative importance and risk level; • implementing preventative and detective security tools; and • using both internal resources and third-party security firms to provide ongoing monitoring of both internal systems as well as activity within third-party environments.


text: We also maintain insurance coverage for cybersecurity incidents. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We describe the risks from cybersecurity threats that could affect our operations and financial results under the heading "Cyber-attacks or acts of cyber-terrorism could disrupt our business operations and information technology systems or result in the loss or exposure of confidential or sensitive employee or company information." included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Our board of directors has designated the audit committee to oversee our exposure to risk, including risks related to cybersecurity threats, and the steps management has taken to monitor and control such risks. The audit committee receives periodic updates from our Vice President – Information Systems on our cybersecurity program and potential material cybersecurity threats. The audit committee is regularly informed about (1) the results of independent and objective assessments of key components of our cybersecurity program as reported by our internal audit department and (2) material risks that could impact our operations or financial condition and the measures implemented to adequately mitigate relevant risks. The audit committee regularly reports to our board of directors regarding its activities, including those related to cybersecurity risk oversight, and members of our board of directors periodically discuss cybersecurity matters with members of management.


text: With regards to third-party risk assessments, our process involves assessing how third parties interact and connect with our information systems and our data, assessing the security of the third-party (including through questionnaires), and obtaining independent proofs of security (including via security certification and/or penetration tests) depending on the associated level of risk, as evaluated by our team. Our procurement teams also run checks to ensure vendors are not sanctioned or otherwise identified as potentially corrupt.

companyName: Criteo S.A.

ticker: CRTO


text: We have established a security committee, which contains management representation from our information technology, legal, and finance groups. The security committee includes our Vice President – Information Systems, who has more than 15 years of experience in the following information technology areas: compliance, security, auditing, vendor management, and systems and network operations. The security committee oversees our cybersecurity incident response plan and is responsible for assessing and managing cybersecurity threats and evaluating the potential impact of such threats on our business strategy, results of operations, and overall financial condition. The security committee supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology systems environment. Our Vice President - Information Systems is responsible for proposing strategies and tactics to mitigate cybersecurity threats, which are subject to review and approval by the security committee.


text: We have implemented a cybersecurity risk management program intended to protect the security and availability of our critical systems and information. Our risk assessment process is modeled after the National Institute of Standards and Technology ("NIST") Guide for Conducting Risk Assessments and is performed annually. We may also elect to perform assessments more often based on material changes in business activities or other factors. The results of our cybersecurity risk assessment aid in identifying potential cybersecurity risks and guiding the adoption of appropriate risk mitigation measures. Our cybersecurity threat defense approach incorporates certain guiding principles from the NIST Cybersecurity Framework (the "NIST Framework"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our program includes a cybersecurity incident response plan that consists of incident identification, classification, investigation and diagnosis, response, and recovery.


text: As part of our cybersecurity program, we have implemented various strategies and processes to manage cybersecurity risks, which include: • providing training and guidance to our employees on cybersecurity threats and emerging trends, including phishing simulations to increase awareness of potential critical security threats; • obtaining independent and objective assessments by our internal audit department; • annual review of Service Organization Controls reports from our critical third-party vendors based upon a determination of their relative importance and risk level; • implementing preventative and detective security tools; and • using both internal resources and third-party security firms to provide ongoing monitoring of both internal systems as well as activity within third-party environments.


text: Our board of directors has designated the audit committee to oversee our exposure to risk, including risks related to cybersecurity threats, and the steps management has taken to monitor and control such risks. The audit committee receives periodic updates from our Vice President – Information Systems on our cybersecurity program, potential material cybersecurity threats, and results of the most recent cybersecurity risk assessment. Additionally, t he audit committee is regularly informed about (1) the results of independent and objective assessments of key components of our cybersecurity program as reported by our internal audit department and (2) material risks that could impact our operations or financial condition and the measures implemented to adequately mitigate relevant risks. The audit committee regularly reports to our board of directors regarding its activities, including those related to cybersecurity risk oversight, and members of our board of directors periodically discuss cybersecurity matters with members of management.


text: Given our company's small size, limited staff, and minimal resources, we have not yet developed or implemented specific cybersecurity risk management programs to safeguard the confidentiality, integrity, and availability of our essential systems and data.

companyName: C2 Blockchain, Inc.

ticker: CBLO


text: Risk Management and Strategy We assess, identify and manage material risks from cybersecurity threats through the cyber risk management program supervised by our Chief Informational Security Officer ("CISO"). The cybersecurity program utilizes our cloud security backbone along with complementary tools to identify, prevent, detect, respond to, and recover from cybersecurity incidents, including: • regular cybersecurity awareness training for employees and contractors on our policies and emerging risks from cybersecurity threats, as well as regular phishing awareness training; • internal and third party cybersecurity testing, including penetration testing of our information systems and devices; • protective and detective cybersecurity controls built into our systems and applications; • cybersecurity incident monitoring and response efforts, including our security breach incident response plan (the "Incident Response Plan"), to identify, assess, escalate, investigate, contain, and remediate incidents; and • disaster recovery and business continuity planning efforts.

companyName: DOC DR Holdco, LLC


text: Our cybersecurity team utilizes a cyber risk management and quantification system ("CRQ"). The CRQ provides intelligence and insights on potential areas of cyber risk and analyzes risk across the major stages of typical cyberattacks and covers a number of entities in our environment, including third party providers. The CISO monitors the CRQ to help ensure that cyber risk assessment and reduction is integrated into the Company's overall risk management system.


text: As part of the above processes, we regularly collaborate with third-party entities to enhance and fortify our cybersecurity risk management program, including through internal and external penetration testing and cybersecurity awareness training. As needed, we require third party service providers to adhere to certain cybersecurity standards and processes and agree to be subject to cybersecurity audits.


text: A discussion of how our business, financial condition, and results of operations could be materially adversely affected by risks from cybersecurity threats is contained under "Cybersecurity incidents could disrupt our business and result in the compromise of confidential information" in Item 1A. Risk Factors.


text: Our Board has risk oversight responsibility for the Company, which it administers directly and with assistance from its committees. In connection with its assessment of the Company's risk environment, the Board receives comprehensive updates on cybersecurity risks every quarter from the CISO.


text: The audit committee assists the Board in fulfilling its oversight responsibility with respect to, among other things, enterprise risk management, including information technology and cybersecurity risks. In performing these functions, the audit committee meets regularly with our management to review any significant risks or exposures. Pursuant to the Incident Response Plan, our Incident Response Team is responsible for our incident handling capability, which includes preparation, detection, analysis, containment, eradication, recovery, and follow-up capabilities in response to cybersecurity incidents. The Incident Response Team is led by the CISO and includes management from the Administration, Legal, Information Security and Technology, Physical Security and Facilities Management, Communications and Public Relations and Human Resources fields. When required, or if otherwise appropriate, management informs the Board and/or Board committee of any cybersecurity incidents. The CISO conducts semi-annual meetings of the Incident Response Team to review and document compliance with the Incident Response Plan. In collaboration with the Incident Response Team, the CISO reviews and updates the Incident Response Plan as necessary annually. In addition, the Chair of the Audit Committee conducts an annual review of the Incident Response Plan.


text: The CISO has more than thirteen years of previous professional experience across diverse roles, including managing information security, establishing robust information and cybersecurity programs, crafting business continuity and disaster recovery strategies, and managing complex IT environments as an IT Director, IT Manager, and Senior IT Systems Administrator. He attended the University of Wisconsin Milwaukee for his undergraduate in Management & Information Systems. He has worked in industries such as banking and investments, health care, real estate, private equity, and property management. He is an active member of the Midwest Cybersecurity Alliance and regularly participates in industry cybersecurity meetings and conferences to stay abreast of trends and collaborate with cybersecurity professionals.


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: Under the oversight of our Board of Directors, and the Board's risk committee, our management has established comprehensive processes identifying, assessing, and managing material risks from cybersecurity threats. These processes are integrated into our enterprise risk management program and include proactive measures such as advanced threat monitoring, penetration testing, multi-factor authentication, and team member training. We also align our practices with recognized standards such as the NIST Cybersecurity Framework. Our detailed incident response plan outlines steps for detection, assessment, notification, and recovery, including escalation to management, the Risk Committee, and the Board when appropriate.


text: The risk committee of our Board, chaired by a director with extensive cybersecurity expertise, receives quarterly updates from management on cybersecurity risks and incidents, including those with moderate or higher impacts. Management updates the full board regularly to ensure alignment on mitigation strategies. Our Chief Technology Officer, with more than 35 years of IT experience, leads our cybersecurity efforts, supported by a dedicated team of certified specialists and external consultants.


text: Our third-party vendors and service providers are integral to our operations but pose unique cybersecurity challenges due to their access to data and our reliance on them for critical operations, including supply chain management. To address these risks, we maintain a third-party vendor risk management program that includes pre-onboarding due diligence, regular audits, and ongoing compliance evaluations. Additionally, we assess critical vendors' supply chain security practices to reduce risks from subcontractors.


text: As of the date of this report, no cybersecurity incidents have had a material adverse effect on our business, financial condition, or results of operations. However, we recognize that no system is immune to breaches. While we maintain cyber insurance coverage for specific risks, such as ransomware attacks and business interruption, the costs of certain incidents could exceed policy limits. We continue to invest in advanced technologies, such as AI-driven threat detection, to strengthen our defenses against evolving threats.


text: See Item 1A. "Risk Factors – Disruptions to, security breaches or non-compliance involving our information technology systems could harm our ability to run our business and expose us to potential liability and loss of revenues" for additional discussion of cybersecurity risks that may materially impact us.


text: The Company maintains a cyber risk program as a part of its enterprise risk management program that is designed to identify, assess, mitigate and manage cyber risks. The Company's Vice President of Information Technology is responsible for managing the Company's cyber risk program, informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising third parties assisting in these efforts. The Company's Vice President of Information Technology has two decades of experience in the Information Technology industry, with a strong emphasis on cybersecurity whose professional experience is distinguished by a Bachelor's degree in Network Operation and

companyName: Gaming & Leisure Properties, Inc.

ticker: GLPI


text: Security and enriched by practical, hands on experience in the field. The Vice President's long standing career in Information Technology reflects a deep seated expertise in safeguarding digital infrastructures in today's dynamic cyber environment.


text: The Company has policies and procedures concerning cybersecurity matters, which include policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. All Company employees are required to complete annual cybersecurity training programs.


text: The Company engages third party vendors to periodically test, monitor and maintain the performance and effectiveness of the Company's cyber risk program. In addition, in 2023 the Company participated in a comprehensive third-party cyber risk review as part of its annual insurance renewal process and consideration of cyber risk coverage.


text: The Audit and Compliance Committee of the Board of Directors oversees the Company's cybersecurity risk program and the process employed to monitor and mitigate cybersecurity risks. Members of the management team provide periodic updates to the Audit and Compliance Committee on the status of the Company's cyber risk management program. In addition, cybersecurity risks are reviewed by the Board of Directors as part of the Company's ongoing enterprise risk management program.


text: Our Chief Information Security Officer reports to the full Board of Directors and the Nominating and Corporate Governance Committee on two occasions per year on information security and cybersecurity matters, or more frequently as needed. These reports generally cover various topics, which may include summaries of recent industry events or notable topics that may influence our cybersecurity risk perspective and security priorities; any actions taken in response to such events or topics; and a review of our top cybersecurity concerns and priorities. Our Nominating and Corporate Governance Committee has oversight responsibility for our data security practices and we believe the committee has the requisite skills and visibility into the design and operation of our data security practices to fulfill this responsibility effectively.

companyName: Guardant Health, Inc.

ticker: GH


text: As a triple net REIT with no significant consumer facing infrastructure or exposure, the Company faces a limited number of cybersecurity risks in connection with the operation of the business. Risks from cybersecurity threats have not materially affected the Company to date and are not reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition. Other than widespread threats generally affecting businesses, the Company has not experienced threats to or breaches of its data or systems, including malware and computer virus attacks. For more information about the cybersecurity risks faced by the Company, see the risk factor entitled "We face risks associated with security breaches through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our information technology (IT) networks and related systems" in Item 1A- Risk Factors.


text: The Company maintains a cyber risk program as a part of its enterprise risk management program that is designed to identify, assess, mitigate and manage cyber risks. The Company's Vice President of Information Technology is responsible for managing the Company's cyber risk program, informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising third parties assisting in these efforts. The Company's Vice President of Information Technology has two decades of experience in the Information Technology industry, with a strong emphasis on cybersecurity whose professional experience is distinguished by a Bachelor's degree in Network Operation and Security and enriched by practical, hands on experience in the field. The Vice President's long standing career in Information Technology reflects a deep seated expertise in safeguarding digital infrastructures in today's dynamic cyber environment.


text: Risk Management and Strategy The security of our sensitive business-related information and the personal information we collect, as well as our information systems, is important for our business. In the normal course of business, we may collect and store personal information and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, information regarding study participants in connection with clinical studies, sensitive third-party information and employee information. To protect this information, we have implemented a cybersecurity program, and have established oversight mechanisms designed to provide effective cybersecurity governance, risk management, and timely incident response. Our cybersecurity risk management is based on recognized cybersecurity industry frameworks and standards including NIST-CSF, ISO 27001/27002 as well as HIPAA.


text: Our cybersecurity policies require that we implement and maintain monitoring and detection programs, network security precautions, encryption of critical data, and management of third-party risk. We maintain various protections designed to safeguard against cyberattacks, including but not limited to attack surface management, anti-phishing secure email gateways, centralized log monitoring and analysis, cloud security posture management, endpoint detection and response, and network intrusion detection and prevention systems. We also have processes in place to prevent unauthorized access to data processing systems and facilities, including two-factor authentication, tiered approval processes and password complexity, and our employees undergo mandatory privacy and security trainings annually. We have established and periodically test our disaster recovery plan and we protect against business interruption by backing up our major systems. In addition, we periodically scan our environment for any vulnerabilities, perform penetration testing and engage third parties to assess effectiveness of our data security practices and compliance with applicable practices and standards. In addition, we maintain a third-party risk register to identify, prioritize and track risks, including those associated with our use of third-party service providers. We also maintain cybersecurity insurance coverage.


text: Our cybersecurity program is led by a team of cybersecurity professionals. The program incorporates industry-standard frameworks, policies and practices designed to protect the privacy and security of our sensitive information. Senior members of our management, including our Head of Information Security and Chief Information Officer, each of whom has over 10 years of experience in various roles involving information technology, including security, auditing, compliance, systems and programming, are responsible for assessing cybersecurity risk. Risk management is performed by the senior leadership of the cybersecurity team as well as members of our legal and privacy teams where relevant. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation of our incident response plan. Additionally, our threat intelligence software issues a quarterly report briefing to inform the security team about relevant cybersecurity events, significant vulnerabilities and vendor-related incidents.


text: Our Head of Information Security reports to the full Board of Directors and the Nominating and Corporate Governance Committee on two occasions per year on information security and cybersecurity matters, or more frequently as needed. These reports generally cover various topics, which may include summaries of recent industry events or notable topics that may influence our cybersecurity risk perspective and security priorities; any actions taken in response to such events or topics; and a review of our top cybersecurity concerns and priorities. Our Nominating and Corporate Governance Committee has oversight responsibility for our data security practices and we believe the committee has the requisite skills and visibility into the design and operation of our data security practices to fulfill this responsibility effectively.


text: Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. As of the date of this Annual Report on Form 10-K, we are not aware of any material cybersecurity incidents or threats that have impacted our business. However, we and our customers routinely face risks of cybersecurity incidents, wholly or partially beyond our control, as we rely heavily on our information technology systems. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Risk Management and Strategy The security of our sensitive business-related information and the personal information we collect, as well as our information systems, is important for our business. In the normal course of business, we may collect and store personal information and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, information regarding study participants in connection with clinical studies, sensitive third-party information and employee information. We manage and maintain our applications and data utilizing a combination of on-site systems and cloud-based data centers. We utilize external security and infrastructure vendors to manage parts of our data centers. To protect this information, we have implemented a cybersecurity program, and have established oversight mechanisms designed to provide effective cybersecurity governance, risk management, and timely incident response. Our cybersecurity program takes into account recognized cybersecurity industry frameworks and standards including NIST-CSF, ISO 27001/27002 as well as HIPAA.


text: Our cybersecurity policies require that we implement and maintain monitoring and detection programs, network security precautions, encryption of critical data, and management of third-party risk. We maintain various protections designed to safeguard against cyberattacks, including but not limited to attack surface management, anti-phishing secure email gateways, log monitoring and analysis, cloud security posture management, endpoint detection and response, and network intrusion detection and prevention systems. We also have processes in place to prevent unauthorized access to data processing systems and facilities, including two-factor authentication, tiered approval processes and password complexity, and our employees and applicable contractors undergo mandatory privacy and security trainings annually. We have established and periodically test our disaster recovery plan and we protect against business interruption by backing up our major systems. In addition, we periodically scan our environment for any vulnerabilities, perform penetration testing and engage third parties to assess the effectiveness of our data security practices and compliance with applicable practices and standards. In addition, we maintain a third-party risk register to identify, prioritize and track risks, including those associated with our use of third-party service providers. We also maintain cybersecurity insurance coverage though it may not be sufficient to cover all costs of a cybersecurity incident.


text: Our cybersecurity program is led by a team of cybersecurity professionals. The program incorporates aspects of industry-standard frameworks, policies and practices designed to protect the privacy and security of our sensitive information. Senior members of our management, including our Chief Information Security Officer and Chief Information Officer, each of whom has over 10 years of experience in various roles involving information technology, including security, auditing, compliance, systems and programming, are responsible for assessing cybersecurity risk. Cybersecurity risk management is performed by the senior leadership of the cybersecurity team as well as members of our legal and privacy teams where relevant. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation and testing of our incident response plan. Additionally, our threat intelligence program issues a semi-annual report briefing to inform the security team about relevant cybersecurity events, significant vulnerabilities and vendor-related incidents.


text: Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. As of the date of this Annual Report on Form 10-K, we are not aware of any material cybersecurity incidents or threats that have impacted our business. However, we and our customers have experienced cybersecurity incidents and routinely face risks of cybersecurity incidents, wholly or partially beyond our control, as we rely heavily on our information technology systems. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K for additional information about the risks to our business associated with a cybersecurity incident affecting our information technology systems.


text: Criteo recognizes the critical importance of maintaining the safety and security of our systems and data and has a holistic process for overseeing and managing cybersecurity and related risks. Our security program is led by our Chief Information Security Officer ("CISO"), who reports directly to our Chief Technology Officer ("CTO"), who is responsible for managing cybersecurity risks as well as protecting our networks and systems. Our CISO has extensive information technology and program management experience, and has served many years in our corporate information security organization. Our CISO manages our security organization, which is composed of dedicated teams of experts in security engineering, incident response, compliance, and software development.


text: Our Board of Directors is primarily responsible for the oversight of our risk management activities and has delegated to the Audit Committee the responsibility to assist in this task.


text: The Audit Committee regularly reviews and discusses with management and, as appropriate, the Company's auditors, the Company's guidelines and policies with respect to risk assessment and risk management, including the Company's data privacy and cybersecurity risk exposures and the steps taken to monitor and manage those exposures.


text: The CISO helps maintain a comprehensive security program that serves as a governance framework for information security at Criteo, supports the business goals of the company and details, across problem spaces and security core functions, the various initiatives, their scope, the associated risks and weaknesses, the roadmap and the current progress.


text: Criteo assesses and manages its cybersecurity risks in part through executive committees. The Governance Risk and Compliance Committee (the "GRCC"), composed of the CISO and certain members of our executive and leadership teams, meets several times a year to discuss strategic information security matters including the security program, major risks and incidents and significant key performance indicators ("KPIs"). The Information Security Committee (the "ISC"), a security-focused governance body including senior managers across the Company on information security activities, meets regularly to receive updates on KPIs and to review relevant standards and policies.


text: As a member of both the GRCC and the ISC, the CISO briefs the Audit Committee on the information security program, major risks and any cybersecurity incidents, typically at least annually. Additionally, cybersecurity risks are reported to the Board of Directors, at least annually, as part of Criteo's enterprise risk mapping ("ERM") program.


text: Quality Control of Security To help ensure that our security program functions in line with industry expectations, Criteo invests in identifying and remediating gaps in our security posture. To accomplish this, we use a mix of our internal expertise and external third-party expertise, as needed, to audit ourselves against industry standards, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, International Organization Standardization 27001 Information Security Management System Requirements ("ISO 27001") and the American Institute of Certified Public Accountants' Service Organization Control Type 2 ("AICPA SOC 2"). Various parts of our business maintain independently assessed security certifications, and we also run certification programs to expand the scope of our existing security certifications.


text: Our security team has several touch points within the business in order to adequately address and mitigate risks. Our technical security teams use a combination of threat intelligence tools, defensive tools and proactive testing to detect vulnerabilities and respond. Our technical security teams also build new tools and solutions in an effort to improve our security posture on an ongoing basis.


text: Our security compliance teams perform third-party risk assessments, respond to client inquiries about security, help the business to manage our security controls, and translate our external requirements into policies, standards, and actions for the rest of our business. Various parts of our team also participate in risks assessments during project kick-offs.


text: With regards to third-party risk assessments, our process involves assessing how third parties interact and connect with our information systems and our data, assessing the security of the third-party (including through questionnaires), and obtaining independent proofs of security (including via security certification and/or penetration tests) depending on the associated level of risk, as evaluated by our team. Our procurement teams also run checks to ensure vendors are not sanctioned, or otherwise identified as potentially corrupt.


text: The process of assessing, identifying and managing cybersecurity related risks is integrated into our overall ERM via a dedicated Information Security Risk Management program that is focused on cybersecurity risk and run by our security compliance team. Risks that are identified through our security processes go through a process of analysis, prioritization, treatment and monitoring. During the lifecycle of cybersecurity specific risks, risk owners, working alongside the security compliance team, are assigned to develop risk mitigation plans, which are followed by the team until a risk is sufficiently mitigated or resolved, at which point such risk reaches a monitoring state. Cybersecurity risks are aggregated into strategic business risks and incorporated into the ERM program.