text: Cybersecurity risk is an important and continuously evolving focus for us, EQT, and EQT's affiliates. EQT maintains a cybersecurity program as part of its Risk Management Framework, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by EQRT, from anticipated threats or hazards. EQT utilizes a variety of protective measures as a part of its and our cybersecurity program. These measures include: • IT General Controls: including physical and digital access controls, patch management, identity verification and mobile device management. • Risk Identification: EQT utilizes a combination of internal processes and third-party services to identify potential information security vulnerabilities and threats. This includes threat intelligence, vulnerability management and various security assessments. • Risk Assessment: Identified risks are assessed and ranked on at least an annual basis using a likelihood and impact assessment as part of EQT's enterprise risk framework. In addition, the security team has in place an information security risk management process through which risks are assessed, managed and reported upon continuously. • Risk Management: Risks are managed based on their severity in relation to the established risk appetite. EQT has in place several risk-mitigating controls, blending preventative, detective, and reactive measures with an emphasis on identity verification, least privilege, micro-segmentation, and a strong security culture. To this foundation, EQT adds critical components like data protection endpoint security, secure configurations, advanced monitoring and threat detection, robust incident and business continuity plans for effective response. EQT continuously modifies its controls in line with our current risk landscape. • Incident Management: EQT has implemented a security incident response plan for prompt and effective handling of cyber incidents. This plan is executed by a tiered response team: a 24/7 Security Operations Center serves as the first line of defense, followed by EQT's internal security team as the second tier, and an expert incident response and forensics firm as the third. Additional support from external legal counsel is available when necessary. The strategy ensures collaboration with key functions like Risk, Regulatory & Compliance, Corporate Legal and Communications. Detailed playbooks within the plan outline specific actions for various security incident types. At the corporate level, an incident reporting and management process involves EQT's Chief Information Security Officer ("CISO"). Should an incident pertain to cybersecurity, it activates the security incident response plan. • Ongoing Testing: EQT's comprehensive program encompasses a range of measures and enterprise-level drills. This includes conducting phishing test campaigns, mandatory annual training, annual penetration tests, and disaster recovery tests to ensure EQT's systems resilience. At the enterprise level, EQT also holds an annual tabletop exercise for EQT's core and extended crisis management teams, simulating various hypothetical scenarios to assess our preparedness and response strategies.


text: EQT's technology systems and those of its, the Adviser's and our third-party service providers are vital for sustaining our operations and strategic initiatives. To manage the risks inherent in these vendor relationships effectively, EQT has established a series of processes. EQT and the Adviser engage only with third parties that align with our stringent cybersecurity standards, demanding that these providers demonstrate strong capabilities in key areas such as data protection, incident preparedness, continuity, and vendor risk management. Adopting a risk-based strategy allows EQT to prioritize its efforts, focusing on the most critical vendors to ensure its attention is directed where it is most needed. In regards to EQT's most critical vendors, EQT requires substantial and credible third-party assurances, such as Service Organization Control Type 2 certifications ("SOC 2") and International Organization for Standardization ("ISO") certifications, ensuring they meet its high cybersecurity standards.

companyName: EQT Exeter Real Estate Income Trust, Inc.

secItem: Item 1C


text: Further, the contracts for EQRT, the Adviser and EQT include stringent data protection and liability clauses in the event of a breach.


text: Governance and Oversight EQT's cybersecurity governance structure is led by the CISO, responsible for EQT's cybersecurity program. The CISO has 15 years of experience working with cybersecurity, business continuity, risk management and technology across several industries and holds a Master and a Bachelor of Computer Science and Engineering. The CISO heads the Security and Platform Engineering Team ('SPET') of dedicated information security professionals and site reliability engineers, concentrating on the security and stability of the technical platform. SPET collaborates closely with other technology teams, such as the EQT information technology operations team. The CISO reports to the Information Security Steering Committee (the 'Steering Committee'), comprised of select Executive Committee members of EQT. The Steering Committee receives quarterly updates from the CISO. Furthermore, the CISO also reports annually to EQT's Audit Committee and twice a year to a member of EQT's board appointed to oversee cybersecurity risk. In addition, the Group Risk Function reports to the Risk Committee at least three times per year.

stage1Category: Management Role

stage1Method: majority


text: At the EQRT level, oversight of cybersecurity is the responsibility of our Board of Directors, receiving at least annual updates on EQT's cybersecurity program and receiving prompt notice regarding any material cybersecurity incidents that are relevant to EQRT, as well as ongoing updates regarding such incidents. EQT's cybersecurity program and processes also provide incident escalation to our Chief Financial Officer for any security incidents that meet pre-established reporting thresholds. EQRT's Chief Financial Officer determines if any cybersecurity events have taken place at the EQRT level and assesses whether those events are material to EQRT based on quantitative and qualitative criteria determined by EQRT's management, supported by external advisors. When determining the materiality of a cybersecurity event, EQRT considers the actual and potential impact on the EQRT operations, strategy, performance, cash flows and financial condition. EQRT adheres to EQT's Incident Handling Playbook and employee awareness training requirements.


text: Both EQT and its Adviser remain committed to adopting the highest cybersecurity standards and practices, continuously enhancing their cybersecurity capabilities, and prioritizing the safeguarding of company and customer data from potential threats. In the last fiscal year, EQT and EQRT have not experienced any cybersecurity incidents, that have materially affected us or are reasonably likely to have materially affected our operations, strategy, performance, cash flows or financial health. See Part I, Item 1A, "Risk Factors—Risks Related to Our Organization Structure—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, financial condition and operating results."

stage1Category: Strategy Integration


text: The Company is subject to various laws and rules issued by multiple government agencies concerning the safeguarding and maintaining the confidentiality of its security, customer, and business information. We are committed to protecting the confidentiality, integrity, and availability of our information systems and data.

companyName: Mag Magna Corp

ticker: MGNC

stage1Category: None/Other

stage1Method: unanimous


text: The Board of Directors maintains oversight of our cybersecurity risks. The Company receives regular updates from management regarding cybersecurity program, including risk assessments, incident response capabilities, and the effectiveness of controls. Management is responsible for assessing and managing our material cybersecurity risks, as well as for the development and implementation of our cybersecurity policies, procedures, and controls, and are responsible for reporting on the program's status and any material cybersecurity incidents to the Board of Directors.

stage1Category: Board Governance


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: As an externally managed company, our day-to-day operations are managed by our Advisor and our executive officers (all of whom are executive officers of our Advisor) under the oversight of our Board. We rely on our Advisor for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details our Advisor has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Net Lease Office Properties

ticker: NLOP

stage1Category: Risk Management Process


text: Management and Board Oversight Our Advisor's cybersecurity approach incorporates a layered portfolio of comprehensive employee training programs, multiple resources to manage and monitor the evolving threat landscape and knowledgeable teams responsible for preventing and detecting cybersecurity risks.


text: Net Lease Office Properties 2023 10-K – 19 As part of our Board's oversight of risk management, our Board of Trustees will review our cyber-risks and the actions being taken to mitigate such risks with our Advisor. These actions include implementing industry-recognized practices for protecting systems, third-party monitoring of certain systems and cybersecurity training for the Advisor's employees. Board oversight of risk is also performed as needed between meetings through our Audit Committee and communications between our Advisor and our Board of Trustees. Our Board of Trustees will receive periodic education around cybersecurity risks and best practices.


text: Additionally, our Audit Committee, which consists solely of independent trustees, is responsible for overseeing cybersecurity risks and related initiatives. Our Audit Committee reviews our enterprise risk and cybersecurity risks. It also reviews the steps our Advisor has taken to protect against threats to our information systems and security and receives updates on cybersecurity on a quarterly basis.


text: Our Advisor's information technology team is led by its Chief Information Officer who has extensive experience working with information security systems. Our Advisor's information technology team consists of individuals with expertise in assessing, preventing and addressing cybersecurity risk and is responsible for executing our cybersecurity program as well as communicating regularly with our Advisor's senior management, our Advisor's cybersecurity governance committee, the Audit Committee and the Board. Our Advisor's cybersecurity governance committee, comprised of the Advisor's Chief Financial Officer, Chief Legal Officer, Chief Information Officer, Head of Internal Audit and senior members of its information technology team, are responsible for developing and maintaining our cybersecurity policies and standards, monitoring ongoing compliance and program updates, and ensuring our information security is aligned with our business objectives and strategies under the oversight of our Board.


text: Our Advisor's information technology and internal audit teams utilize frameworks based on industry standards to identify and mitigate information security risks and oversee an active cybersecurity training program. For example, in January 2023, our Advisor's information technology team held a tabletop exercise with senior management of the Advisor to consider different cybersecurity scenarios. Our Advisor's information technology team also recently worked with various third-party consultants to update our incident response plan.


text: In addition, our Advisor's information technology team conducts routine security assessments as well as ongoing cybersecurity training campaigns for the Advisor's employees to enhance awareness and increase vigilance for the various types of cybersecurity attacks to which they may be exposed. Our Advisor's internal audit team evaluates and monitors our internal controls over systems access in an effort to mitigate information security risks that may result from unauthorized access to systems and data.


text: Third-party vendors are vetted through our Advisor's service delivery program to ensure they have an established cybersecurity program. Our Advisor has also engaged a managed security provider to manage a supply chain defense subscription that will help obtain clear visibility into cybersecurity risks across third party vendors by proactively identifying, prioritizing, and driving remediation for cyber risks posed by critical business partners. Our Advisor's managed security provider's risk operations center will escalate certain alerts regarding third-party vendors directly to the appropriate business partners thus providing direct collaboration with third parties, saving time and improving risk reduction while safeguarding our relationships with such third parties.

stage1Category: Third-Party Risk


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, including but not limited to automated event-detection notifications or similar technologies which are monitored by our Advisor's managed cybersecurity provider, notifications from our Advisor's employees, vendors or service providers, and notifications from third party information technology system providers. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to our Advisor's incident response plan follows the procedures set forth in the plan to investigate the potential incident, such as determining the nature of the event (e.g., ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the incident response team is initially focused on containing the cybersecurity incident as quickly and efficiently as possible, consistent with the procedures in the incident response plan. Containment procedures may include shutting down systems; disconnecting systems from a network, disabling specific ports, protocols, services, functions, etc., disabling access to compromised systems; examining code in a controlled environment and making forensic backups of affected systems for possible legal action for third party forensic analysis.


text: Once a cybersecurity incident is contained, the focus shifts to remediation. Eradication and recovery activities depend on the nature of the cybersecurity incident. They may include returning affected systems to an operationally ready state, confirming that the affected systems are functioning normally and implementing, as necessary, additional monitoring to look for future related activity.


text: Our Advisor has relationships with a number of third party service providers to assist with cybersecurity containment and remediation efforts, including outside legal counsel, vendors and external insurance brokers.


text: In the event of a cybersecurity incident, we intend to follow the steps outlined in our Advisor's incident response plan, including notifying our Audit Committee and Board, as appropriate.


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. However, we routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachments to emails, phishing attempts, extortion or other scams. For a discussion of these risks, see Item 1A. Risk Factors – The occurrence of cyber incidents, or a deficiency in our Advisor's cybersecurity, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results.


text: As part of our Board's oversight of risk management, our Board will review our cyber-risks and the actions being taken to mitigate such risks with our Advisor. These actions include implementing industry-recognized practices for protecting systems, third-party monitoring of certain systems and cybersecurity training for the Advisor's employees. Board oversight of risk is also performed as needed between meetings through our Audit Committee and communications between our Advisor and our Board. Our Board will receive periodic education around cybersecurity risks and best practices.


text: Our Advisor's information technology team is led by its Chief Information Officer who reports to its Chief Financial Officer and has extensive experience working with information security systems. Our Advisor's information technology team consists of individuals with expertise in assessing, preventing and addressing cybersecurity risk and is responsible for executing our cybersecurity program as well as communicating regularly with our Advisor's senior management, our Advisor's cybersecurity governance committee, the Audit Committee and the Board. Our Advisor's cybersecurity governance committee, comprised of the Advisor's Chief Financial Officer, Chief Legal Officer, Chief Information Officer, Head of Internal Audit and senior members of its information technology team, are responsible for developing and maintaining our cybersecurity policies and standards, monitoring ongoing compliance and program updates, and ensuring our information security is aligned with our business objectives and strategies under the oversight of our Board.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our Advisor's cybersecurity program focuses on (1) preventing and preparing for cybersecurity incidents, (2) detecting and analyzing cybersecurity incidents and (3) containing, eradicating, recovering from and reporting cybersecurity events.


text: Prevention and Preparation Our Advisor employs a variety of measures to prevent threats related to privacy, information technology security and cybersecurity, which include password protection, frequent mandatory password change events, multi-factor authentication, internal phishing testing, vulnerability scanning and penetration testing.


text: Our Advisor's information technology and internal audit teams utilize frameworks consistent with well-recognized industry cybersecurity frameworks to identify and mitigate information security risks and oversee an active cybersecurity training program.


text: In addition, our Advisor's information technology team conducts routine security assessments as well as ongoing cybersecurity training campaigns for the Advisor's employees and board of directors to enhance awareness and increase vigilance for the various types of cybersecurity attacks to which they may be exposed. Our Advisor's internal audit team evaluates and monitors our internal controls over systems access in an effort to mitigate information security risks that may result from unauthorized access to systems and data.


text: Third-party vendors are vetted through our Advisor's service delivery program to ensure they have an established cybersecurity program. Our Advisor has also engaged a managed security provider to manage a supply chain defense subscription that will help obtain visibility into cybersecurity risks across third party vendors by proactively identifying, prioritizing, and driving remediation for cyber risks posed by critical business partners. Our Advisor's managed security provider's risk operations center will escalate certain alerts regarding third-party vendors directly to the IT Department thus providing direct collaboration with third parties, saving time and improving risk reduction while safeguarding our relationships with such third parties.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, including but not limited to automated event-detection notifications or similar technologies which are monitored by our Advisor's managed cybersecurity provider, notifications from our Advisor's employees, vendors or service providers, and notifications from third party information technology system providers. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to our Advisor's incident response plan follows the procedures set forth in the plan to investigate the potential incident, such as determining the nature of the event and assessing the severity of the event.


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the incident response team is responsible for containing the cybersecurity incident, consistent with the procedures in the incident response plan.


text: Once a cybersecurity incident is contained, the focus shifts to remediation. Eradication and recovery activities depend on the nature of the cybersecurity incident. They may include returning affected systems to an operationally ready state and confirming that the affected systems are functioning normally.


text: Cybersecurity Risks As of December 31, 2024, we are not aware of any instances of material cybersecurity incidents that impacted the Company in the last three years. However, there can be no assurance that our cybersecurity efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. See Item 1A. Risk Factors – The occurrence of cyber incidents, or a deficiency in our Advisor's cybersecurity, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results.


text: Cybersecurity Risk Management and Strategy As an externally managed company, our day-to-day operations are managed by our Manager and our executive officers (all of whom are executive officers of our Manager) under the oversight of our board of trustees. We rely on our Manager for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details our Manager has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Star Holdings

ticker: STHO


text: Our Manager has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our Manager's cybersecurity risk management program includes a cybersecurity incident response plan.


text: Our Manager has designed and assesses its program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0). This does not imply that our Manager meets any particular technical standards, specifications, or requirements, only that our Manager uses the NIST CSF 2.0 as a guide to help it identify, assess, and manage cybersecurity risks relevant to our business.


text: Our Manager's cybersecurity risk management program is integrated into its overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our Manager's cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; the use of external service providers to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for service providers, suppliers, and vendors.


text: Our Manager has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee is responsible for reviewing our Manager's implementation of our cybersecurity risk management program and evaluating its adequacy.


text: The Committee receives periodic reports from our Manager on our cybersecurity risks. In addition, our Manager updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from our Manager on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Manager's Head of IT, internal technology staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Manager's team, including its Head of IT, Head of Risk Management and Chief Legal Officer, are responsible for assessing and managing our material risks from cybersecurity threats. Our Manager has primary responsibility for our overall cybersecurity risk management program and supervises both its internal cybersecurity personnel and its retained external cybersecurity consultants.


text: Our Manager supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy Overall Risk Management. The Company has implemented a cyber risk management program to help ensure that the Company's electronic information and information systems are protected from various threats and are built on and follow the Cybersecurity Maturity Model Certification for information security requirements and the protection of sensitive information. The cyber risk management program is maintained as part of the Company's overall governance, enterprise risk management program and compliance program. The Company's information systems experience ongoing and often sophisticated cyberattacks by a variety of sources with the apparent aim to breach the Company's cyber-defenses. The Company may face increased cyber risk due to the increased use of employee-owned devices and work from home arrangements. The Company also has cyber event related insurance. The Company is continuously reevaluating the need to upgrade and/or replace systems and network infrastructure.

companyName: Knife River Corp

ticker: KNF


text: These upgrades and/or replacements could adversely impact operations by imposing substantial capital expenditures, creating delays or outages, or experiencing difficulties transitioning to new systems. System disruptions, if not anticipated and appropriately mitigated, could adversely affect the Company. The Company continually assesses risks from cybersecurity threats and adapts and enhances its controls accordingly.


text: Risks from Cybersecurity Threats. Although risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, such incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication.


text: Employee Cybersecurity Training. The Company provides ongoing cybersecurity training and compliance programs to facilitate education for employees who may have access to the Company's data and critical systems. Employee phishing tests are conducted on a monthly basis.


text: Engage Third-parties on Risk Management. Periodic external reviews, including penetration tests and security framework assessments, are conducted by auditors, external assessors, and/or consultants to assess and ensure compliance with the Company's information security programs and practices. Internal and external auditors assess the Company's information technology general controls on an annual basis.


text: Oversee Third-party Risk. The Company has a third-party management risk program to help monitor and reduce risks associated with the Company's vendors, which includes processes such as completing due diligence on third party service providers before engaging with them for their services; assessing the third party's cybersecurity posture by reviewing audit reports of the third party, completing cyber questionnaires, and reviewing applicable certification; including cybersecurity contractual language in contracts to limit risk; and monitoring and reassessing third party's to ensure ongoing compliance with their cybersecurity obligations.


text: Other Risk Factors. See the risk factor "Technology disruptions or cyberattacks could adversely impact operations" in the section entitled "Item 1A. Risk Factors - Operations, Growth and Competitive Risks."


text: Board of Directors Oversight. The board, as a whole and through its committees, has responsibility for oversight of risk management. In its risk oversight role, the board of directors has the responsibility to satisfy itself that the risk management processes designed and implement by management are adequate for identifying, assessing, and managing risk. The audit committee of the board of directors of the Company is responsible for oversight of risks from cybersecurity threats.


text: Management's Role Managing Risk. The vice president of support services plays a large role in informing the audit committee on cybersecurity risks. The audit committee receives presentations and reports from the vice president of support services on cybersecurity related issues which include information security, technology risks and risk mitigation programs regularly at the quarterly board meetings. In addition to scheduled meetings, the vice president of support services and audit committee maintain an ongoing dialogue regarding emerging or potential cybersecurity risks.


text: Cybersecurity Incident Response. The Company has an incident response plan to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents that is also tested on an annual basis. The incident response plan is updated based on results of the test or as new cyber related developments occur. The incident response plan indicates the vice president of support services, executive leadership which includes the chief executive officer, chief financial officer, chief accounting officer, chief legal officer, corporate controller and the board of directors are to be notified of any material cybersecurity incidents through a defined escalation process. The defined escalation process is a risk-based process that specifies who is to be contacted and when at each risk level.


text: Board of Directors Oversight. The board, as a whole and through its committees, has responsibility for oversight of risk management. In its risk oversight role, the board of directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are adequate for identifying, assessing, and managing risk. The audit committee of the board of directors of our company is responsible for oversight of risks from cybersecurity threats.


text: Monitor, Manage, and Safeguard Against Cybersecurity Incidents and Risks. The Company's vice president of support services, along with the supervisor of cybersecurity, a designated security team of professionals and third-party cybersecurity experts are responsible for assessing and managing risks as well as developing and implementing policies, procedures, and practices based on the range of threats faced by the Company. There are processes around access management, data security, encryption, asset management, secure system development, security operations, network and device security to provide safeguards from a cybersecurity incident along with continual monitoring of various threat intelligence feeds.


text: Cyber Risk Management Personnel. Through training and compliance programs, the concept that all employees are responsible for the data and critical systems they access is reinforced. The information technology department for the Company has the responsibility to implement cybersecurity controls under the overall guidance of the cybersecurity team. This cybersecurity team includes internal cybersecurity experts that have a combined 55 years of general information technology experience and 37 years of cyber specific related experience. The internal cyber team have obtained various degrees and certificates in network administration, security administration and information system management. The Company also partners with a third-party cybersecurity firm that assists the Company and many other clients in setting direction, implementing cybersecurity technology and supporting the Company's security operations center. The information technology department is led by two directors, one with over 20 years experience in information technology leadership roles at Knife River and the other with 14 years of combined experience in information technology roles at MDU Resources and Knife River. The information technology department, including the cybersecurity team, reports to the vice president of support services, who has 17 years of information technology leadership and operational leadership experience with Knife River and over 30 years of total information technology experience. The vice president of support services reports to the chief executive officer.


text: Cyber Risk Oversight Committee. Additionally, the Company established CyROC to provide executive management and the audit committee with analyses, appraisals, recommendations, and pertinent information concerning cyber defense of the Company's electronic information, information technology and operation technology systems. The CyROC is responsible for guiding the Company's comprehensive cybersecurity policies. The CyROC is chaired by the Company's supervisor of cybersecurity and is comprised of members from financial and operations management, as well as technology leaders.


text: Risk Management and Strategy Overall Risk Management. We have implemented a cyber risk management program to help ensure that our electronic information and information systems are protected from various threats and are built on and follow the Cybersecurity Maturity Model Certification for information security requirements and the protection of sensitive information. The cyber risk management program is maintained as part of our overall governance, enterprise risk management program and compliance program. Our information systems experience ongoing and often sophisticated cyberattacks by a variety of sources with the apparent aim to breach our cyber-defenses. We also have cyber event related insurance. We are continuously reevaluating the need to upgrade and/or replace systems and network infrastructure. These upgrades and/or replacements could adversely impact operations by imposing increased expenses, creating delays or outages, or experiencing difficulties transitioning to new systems. System disruptions, if not anticipated and appropriately mitigated, could adversely affect our company. We continually assess risks from cybersecurity threats and adapt and enhance our controls accordingly.


text: Risks from Cybersecurity Threats. Although risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, such incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication.


text: Employee Cybersecurity Training. We provide ongoing cybersecurity training and compliance programs to facilitate education for employees who may have access to our data and critical systems. Employee phishing tests are conducted on a monthly basis.


text: Engage Third-parties on Risk Management. Periodic external reviews, including penetration tests and security framework assessments, are conducted by auditors, external assessors, and/or consultants to assess and ensure compliance with our information security programs and practices. Internal and external auditors assess our information technology general controls on an annual basis.


text: Oversee Third-party Risk. We monitor risks associated with our vendors, which include processes such as completing due diligence on third party service providers before engaging with them for their services; assessing the third party's cybersecurity posture by reviewing audit reports of the third party, completing cyber questionnaires, and reviewing applicable certification; including cybersecurity contractual language in contracts to limit risk; and monitoring and reassessing third party's to ensure ongoing compliance with their cybersecurity obligations.


text: Cybersecurity Incident Response. We have an incident response plan to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents that is also tested on an annual basis. The incident response plan is updated based on results of the test or as new cyber related developments occur. The incident response plan indicates the vice president of support services, executive leadership which includes the chief executive officer, chief financial officer, chief accounting officer, chief legal officer, corporate controller and the board of directors are to be notified of any material cybersecurity incidents through a defined escalation process. The defined escalation process is a risk-based process that specifies who is to be contacted and when at each risk level.


text: Monitor, Manage, and Safeguard Against Cybersecurity Incidents and Risks. Our vice president of support services, along with the supervisor of cybersecurity, a designated security team of professionals and third-party cybersecurity experts are responsible for monitoring, assessing and managing risks as well as developing and implementing policies, procedures, and practices based on the range of threats we face. There are processes around access management, data security, encryption, asset management, secure system development, security operations, network and device security to provide safeguards from a cybersecurity incident along with continual monitoring of various threat intelligence feeds.


text: Cyber Risk Management Personnel. Through training and compliance programs, the concept that all employees are responsible for the data and critical systems they access is reinforced. The information technology department has the responsibility to implement cybersecurity controls under the overall guidance of the cybersecurity team. This cybersecurity team includes internal cybersecurity experts that have a combined 28 years of general information technology experience and 18 years of cyber specific related experience. The internal cyber team members have obtained various degrees and certificates in network administration, security administration and information system management. We also partner with a third-party cybersecurity firm that assists us and many other clients in setting direction, implementing cybersecurity technology and supporting our security operations center. Our internal information technology department is led by two directors, one with 25 years of experience in information technology leadership roles at Knife River and the other with 15 years of experience in information technology roles at MDU Resources and Knife River combined. The information technology department, including the cybersecurity team, reports to the vice president of support services, who has 18 years of information technology leadership and operational leadership experience with Knife River and over 30 years of total information technology experience. The vice president of support services reports to the chief executive officer.


text: Cyber Risk Oversight Committee. Additionally, we established CyROC to provide executive management and the audit committee with analyses, appraisals, recommendations, and pertinent information concerning cyber defense of our electronic information, information technology and operation technology systems. The CyROC is responsible for guiding our comprehensive cybersecurity policies. The CyROC is chaired by our supervisor of cybersecurity and is comprised of members from financial and operations management, as well as technology leaders.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, data related to our clinical trials and other confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: ACELYRIN, Inc.


text: Our information security function, which is led by our IT department, helps to identify, assess and manage the Company's cybersecurity threats and risks. Our IT team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example, manual and automated tools, analyzing reports of threats and threat actors, conducting internal and external scans of our environment, periodic penetration tests conducted by third parties, utilization of a 24x7 security operations center (SOC) that provides monitoring and alert services, evaluating threats reported to us, and coordinating cross-functionally, with Company management and externally (e.g., with law enforcement) concerning threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a Cybersecurity Incident Response Policy; various other policies, plans, and frameworks in regards to (without limitations) access, acceptable use, password security and software system development; physical and administrative access and network security controls; data segregation; encryption of certain data; leveraging of certain SOC II-certified vendors; management, tracking and disposal of certain assets; systems monitoring; participating in information sharing and analysis centers (ISACs) to share and receive threat intelligence specifically related to biopharma and healthcare companies; and maintaining cyber insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. The Company has an IT Steering Committee made up of cross-disciplinary senior management, including (among others) the Chief Legal and Administrative Officer, Chief Financial Officer and Chief Operating Officer, along with IT leadership and representatives from several additional departments. For example, the IT department works with the IT Steering Committee and other senior management personnel to prioritize certain risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, outside consultants, third party penetration testing providers, and threat intelligence and forensic providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as email and hosting providers, contract research organizations (CROs) and contract manufacturing organizations (CMOs). We have certain vendor management processes that we may use as appropriate to manage cybersecurity risks associated with our use of these providers. These processes may include the imposition of information security contractual obligations on vendors, as well as quality control elements for certain vendors. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management processes may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our internal information technology systems, or those used by our CROs, CMOs, clinical sites or other contractors or consultants upon which we rely, or our data are or were compromised, become unavailable or suffer security breaches, loss or leakage of data or other disruptions, we could suffer material adverse consequences resulting from such compromise, including but not limited to, operational or service interruption, harm to our reputation, litigation, fines, penalties and liability, compromise of sensitive information related our business, and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, led by our Executive Director of IT & Cybersecurity, who has over 20 years' of work experience in IT and cybersecurity.


text: The Executive Director of IT & Cybersecurity is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Executive Director of IT & Cybersecurity, together with certain other senior management personnel, is responsible for approving functional budgets, implementing approved, phase-appropriate policies, plans and guidelines, helping prepare for potential cybersecurity incidents, reviewing security assessments and other security-related reports and overseeing cybersecurity processes.


text: Our Cybersecurity Incident Response Policy is designed to escalate certain cybersecurity incidents to members of senior management depending on the circumstances, including our Disclosure Committee, as appropriate. Senior management works with the Company's cybersecurity incident management team to help the Company mitigate and remediate notified cybersecurity incidents, comply with applicable laws, regulations and contractual provisions and engage advisors as appropriate. In addition, such policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from the Executive Director of IT & Cybersecurity concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to advisors, and various other reports, and presentation materials related to cybersecurity threats, risk and mitigation.


text: Our CISO has more than 25 years of experience building and leading cybersecurity programs for global healthcare and retail companies. The cybersecurity leadership team reporting to the CISO is comprised of leaders with skills in cybersecurity risk management, cybersecurity architecture, identity and access management, and cybersecurity operations and engineering. Their experience and certifications are commensurate with their roles.

companyName: Fortrea Holdings Inc.

ticker: FTRE


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. We have an IT Steering Committee ("ITSC") made up of cross-disciplinary senior management, including (among others) the Head of IT, Chief Legal Officer, Chief Technical Operations Officer and Chief Commercial Officer, along with IT leadership and representatives from several additional departments. The ITSC meets at least quarterly to oversee our IT risk management framework, including information security, data privacy, and regulatory compliance. It monitors the effectiveness of controls, reviews incident reports and provides guidance on mitigating emerging IT risks and vulnerabilities that are more likely to lead to a material impact to our business. The ITSC investigates incidents and reports its findings to our senior management, which, depending on the severity of the incident, may be reported to our audit committee or board.


text: Our information security function, which is led by our Head of IT with the support of our IT department, helps to identify, assess and manage our cybersecurity threats and risks. Our IT team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual and automated tools, analyzing reports of threats and threat actors, conducting internal and external scans of our environment, periodic penetration tests conducted by third parties, utilization of a 24x7 security operations center ("SOC") that provides monitoring and alert services, evaluating threats reported to us, and coordinating cross-functionally, with management and externally (e.g., with law enforcement) concerning threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a Cybersecurity Incident Response Policy; various other policies, plans, and frameworks in regards to (without limitations) access, acceptable use, password security and software system development; physical and administrative access and network security controls; data segregation; encryption of certain data; leveraging of certain SOC II-certified vendors; management, tracking and disposal of certain assets; systems monitoring; participating in information sharing and analysis centers to share and receive threat intelligence specifically related to biopharma and healthcare companies; and maintaining cyber insurance.


text: Our Head of IT has served in various roles in information technology for over 22 years, including serving in cybersecurity focused roles for the past 9 years. Our Head of IT holds an undergraduate degree in Computer Information Systems. Our Chief Legal Officer, Chief Technical Operations Officer and Chief Commercial Officer each hold undergraduate and graduate degrees in their respective fields, and each have substantial experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: The Head of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. The Head of IT, together with certain other senior management personnel, is responsible for approving functional budgets, implementing approved, phase-appropriate policies, plans and guidelines, helping prepare for potential cybersecurity incidents, reviewing security assessments and other security-related reports and overseeing cybersecurity processes.


text: We also use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, outside consultants, third party penetration testing providers, and threat intelligence and forensic providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as email and hosting providers, CROs and CMOs. We have certain vendor management processes that we may use as appropriate to manage cybersecurity risks associated with our use of these providers. These processes may include the imposition of information security contractual obligations on vendors, as well as quality control elements for certain vendors. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management processes may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity and information technology risk management, risk assessment and major risk exposures. The audit committee receives periodic reports from the ITSC and our Head of IT concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to advisors, and various other reports, and presentation materials related to cybersecurity threats, risk and mitigation.


text: Our Cybersecurity Incident Response Policy is designed to escalate certain cybersecurity incidents to members of senior management depending on the circumstances, including our disclosure committee, as appropriate. Senior management works with the Company's cybersecurity incident management team to help the Company mitigate and remediate notified cybersecurity incidents, comply with applicable laws, regulations and contractual provisions and engage advisors as appropriate. In addition, such policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our internal information technology systems, or those used by our CROs, CMOs, clinical sites or other contractors, consultants and service providers upon which we rely, or our data are or were compromised, become unavailable or suffer security breaches, loss or leakage of data or other disruptions, we could suffer material adverse consequences resulting from such compromise, including but not limited to, operational or service interruption, harm to our reputation, litigation, fines, penalties and liability, compromise of sensitive information related our business, and other adverse consequences."


text: Cybersecurity Risk Management Program and Strategy Our cybersecurity risk management program (the "Cybersecurity Risk Management Program") was designed to identify, manage, mitigate, and respond to ongoing cybersecurity threats and associated risks and is responsible for their escalation to the Board of Directors when determined to be material. Currently, the Cybersecurity Risk Management Program includes cybersecurity services provided by our Former Parent through 2024 as part a transition service agreement entered in connection with the Spin. The underlying controls utilized by these programs are based on industry recognized best practices and standards for cybersecurity and information technology which include the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the International Organization for Standardization (ISO) 27001:2022 Information Security Management Systems Requirements The Cybersecurity Risk Management Program is administered through two primary channels: (i) Fortrea led cybersecurity services and capabilities, and (ii) trusted third-party partners delivering cybersecurity services overseen by our Cybersecurity leadership team. Both channels combined deliver the entire Cybersecurity Program, which includes key items such as:


text: Cybersecurity risk management program, including, but not limited to, the following: • Risk assessment activities/analyses • Risk Committee oversight, documentation, escalation • Reporting of risk issues deemed material to our Audit Committee of the Board of Directors Cybersecurity services, including, but not limited to, the following: •24x7 Security services and Operations across (3) countries, including an Incident Response Plan and process.


text: • Identity Access Management support and governance • Security Architecture oversight and guidance • Governance, Risk and Compliance ("GRC") functions such as third-party risk management, cybersecurity policies, training, and awareness • Annual and independent penetration testing and vulnerability scanning activities conducted by trusted third parties • Transition services provided by our Former Parent, as part of the Spin, effective June 2023 and through the exit of the transition service agreement Third party risk management, including, but not limited to, the following: • Periodic third party reviews and assessments measuring cybersecurity services capability and maturity.


text: Cybersecurity risks are identified and documented by our cybersecurity team leadership, presented, and reviewed with the Fortrea Cybersecurity Risk Management Committee (the "Risk Committee") as noted in the Governance of Cybersecurity section below. The Risk Committee, in conjunction with business stakeholders as required, evaluates risks which are presented to them to determine materiality. Cybersecurity risks deemed material are then formally agreed upon as items to be reported by the Chief Information Security Officer ("CISO") to the Audit Committee.


text: Recognizing the cybersecurity and risk management programs are newly formed, we have established plans to conduct regular reviews and tabletop exercises to test processes for preparedness in case of a critical event as well as integrate cybersecurity risk with the Enterprise Risk Management Framework. As part of our risk management strategy, we have secured comprehensive cyber insurance coverage. We regularly review and update our cyber insurance coverage to align with the evolving nature of cyber threats and industry standards.


text: Because we are a newly formed company, there are no historical internal or external assessment processes. Going forward, however, the Fortrea Internal Audit team will conduct internal assurance reviews as part of their 2024 annual audit plan. Additionally, as we continue to execute our risk management processes, we plan to engage external cybersecurity partners for the evaluation and assessment of our cybersecurity program and its capabilities.


text: Although unknown cybersecurity risks could materialize as a result of risk factors identified during the Spin, we are not aware of any disclosures at this time which would be considered material risks and associated with cybersecurity threats or incidents. Refer to "Item 1A. Risk Factors" of this Annual Report on Form 10-K for further discussion of cybersecurity risks.


text: Governance of Cybersecurity The Fortrea Audit Committee has been authorized by the Board of Directors to oversee risks from cybersecurity threats. We have established a Risk Committee chaired by the CISO and chartered to determine and execute the processes for the identification, and management of material cybersecurity risks. The Risk Committee is comprised of cross-functional executive leaders who can assess materiality impact and are accountable for materiality disclosure. The CISO is responsible for reporting on the state of cybersecurity to the Audit Committee on a quarterly basis, including those risks deemed material by the Risk Committee.


text: Cybersecurity Risk Management Program and Strategy Our cybersecurity risk management program (the "Cybersecurity Risk Management Program") was designed to identify, manage, mitigate, and respond to ongoing cybersecurity threats and associated risks and is responsible for their escalation to the Board of Directors when determined to be material. The underlying controls utilized by these programs are based on industry recognized best practices and standards for cybersecurity and information technology which include the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the International Organization for Standardization (ISO) 27001:2022 Information Security Management Systems Requirements.


text: The Cybersecurity Risk Management Program is administered through two primary channels: (i) Fortrea led cybersecurity services and capabilities, and (ii) trusted third-party partners delivering cybersecurity services overseen by our Cybersecurity leadership team. Both channels combined deliver the entire Cybersecurity Program, which includes key items such as:


text: Cybersecurity risk management program, including, but not limited to, the following: • Risk assessment activities/analyses • Risk Committee oversight, documentation, escalation • Reporting of risk issues deemed material to our Audit Committee of the Board of Directors Global Cybersecurity services, including, but not limited to, the following:


text: •24x7 Security Operations and Incident Response • Identity Access Management support and governance • Security Architecture oversight and guidance • Governance, Risk and Compliance ("GRC") functions such as third-party risk management, cybersecurity policies, training, and awareness • Annual and independent penetration testing and vulnerability scanning activities conducted by trusted third parties Third party risk management, including, but not limited to, the following: • Periodic third-party reviews and assessments measuring cybersecurity services capability and maturity.


text: We have established plans to conduct periodic reviews and tabletop exercises to test various processes for preparedness in the event of a critical cybersecurity incident as well as include cybersecurity risk within our Enterprise Risk Management Framework. As part of our overall risk management strategy, we have secured comprehensive cyber insurance coverage. We regularly review and update our cybersecurity insurance coverage to align with the evolving nature of cyber threats and industry standards.


text: Fortrea will continue to leverage our internal audit department to provide independent reviews and recommendations to enhance Fortrea's ability to manage risks effectively, as well as pursue external certifications. Although unknown cybersecurity risks could materialize, including in connection with the implementation of independent systems following the Spin, we are not aware of any disclosures at this time which would be considered material risks and associated with cybersecurity threats or incidents. Refer to Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K for further discussion of cybersecurity risks.


text: Governance of Cybersecurity The Fortrea Audit Committee has been authorized by the Board of Directors to oversee risks from cybersecurity threats. We have established a Risk Committee chaired by the CISO and chartered to determine and execute the processes for the identification and management of material cybersecurity risks. The Risk Committee is comprised of cross-functional executive leaders who can assess materiality impact and are accountable for materiality disclosure. The CISO is responsible for reporting on the state of cybersecurity to the Audit Committee on a quarterly basis, including those risks deemed material by the Risk Committee.


text: Our CISO has more than 25 years of experience building and leading cybersecurity programs for global healthcare and retail companies. The cybersecurity leadership team reporting to the CISO is comprised of leaders with skills in cybersecurity risk management, cybersecurity architecture, identity and access management, and cybersecurity operations and engineering. Their experience and certifications are commensurate with their roles.


text: Our operations are highly dependent on the information systems and technology of Fortress, the indirect affiliate of our Adviser, which has implemented a cybersecurity management program. Below are details Fortress has provided to us regarding its cybersecurity program that are relevant to us. The Company uses Fortress's cybersecurity program to assess, identify and mange material cybersecurity risks affecting the Company and its operations.

companyName: Fortress Net Lease REIT


text: Cybersecurity Processes and Risk Assessment Fortress's cybersecurity program is focused on (i) protecting the confidentiality of business, client, investors in its funds and its employee information; (ii) maintaining the security and availability of systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.


text: Fortress has implemented an information security governance policy governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes, and the maintenance of critical services and systems. Fortress's cybersecurity program is managed by Fortress's Chief Information Security Officer and Fortress's Chief Technology Officer (together, "Fortress IT Management"), who report to Fortress's Chief Financial Officer. Fortress IT Management and their team are responsible for implementing Fortress's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards.


text: These processes and systems are designed to protect against unauthorized access of information, including by cyber- attacks, and Fortress's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Fortress's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Fortress's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework.


text: Fortress's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Fortress's deployment of cybersecurity best practices and industry frameworks and help to identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed by Fortress IT Management for remediation. When Fortress engages vendors and other third-party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.


text: Fortress also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Fortress conducts regular phishing tests and provides additional training as appropriate.


text: Governance and Oversight of Cybersecurity Risks Fortress has developed an incident response framework to identify, assess and manage cybersecurity events. The framework is managed and implemented by Fortress's Enterprise Security Steering Committee (the "ESSC"), a cross- functional management committee that includes its General Counsel, Chief Financial Officer, Chief Operating Officer, Chief Compliance Officer, Chief Human Resources Officer and Fortress IT Management. The ESSC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Fortress's cybersecurity program, which is overseen by the ESSC, is managed by an internal team that is responsible for enterprise-wide cybersecurity strategy, policies, engineering and processes. The team is led by Fortress's Chief Technology Officer, who has over 30 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Fortress's Chief Information Security Officer, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The ESSC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Fortress's cybersecurity program.


text: The Company's board of trustees has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to an audit committee of the board of trustees (the "Audit Committee"). The Company's CFO periodically reports to the Audit Committee as well as the full board of trustees as appropriate, on cybersecurity matters. Such reporting includes updates on Fortress's cybersecurity program, the external threat environment and Fortress's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Fortress's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: Impact of Cybersecurity Risks We are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Part I. Item 1A. Risk Factors—Risks Related to Our Business and Operations—Our business and operations could suffer in the event of system failures or cybersecurity breaches."


text: Risk Management and Strategy The Company maintains comprehensive policies, procedures, and controls to protect the Company's information systems and related data from cybersecurity threats and incidents. The Company's cybersecurity risk management program is aligned with the International Standards Organization (ISO 27001:2022) and mapped to National Institute of Standards Special Publication 800-53 Revision 5 (NIST 800-53). The Company's cybersecurity program is integrated into the Company's overarching enterprise risk management program.

companyName: Vestis Corp

ticker: VSTS


text: The Company's Chief Information Security Officer (CISO) is responsible for managing the Company's cybersecurity program and reporting on cybersecurity matters to management, the Cyber Governance Committee, and the Company's board of directors. The CISO has over twenty years of cybersecurity and technology experience, originating with cryptography and security experience as a military officer and progressing through senior management roles at prominent global audit and technology consulting corporations. The CISO leads the Company's cybersecurity and information technology compliance department which is staffed with technical and compliance personnel with the appropriate experience and certifications required to accomplish the department's mandates. The CISO is supervised by the Company's Chief Technology Officer.


text: The Company's maintains a Cyber Governance Committee, which meets quarterly, and interfaces with other functional areas within the Company, including, but not limited to, legal, internal audit, accounting, risk management, human resources, as well as external third-party partners. The CISO serves as the chair of the committee, which has been tasked with providing governance and oversight of the Information Security and Management System and to provide governance during major cybersecurity incidents.


text: The Company engages third parties to assist with the monitoring components of the security infrastructure that we have deployed. As required, the Company engages consultants and third parties to assist with penetration testing, tabletop incident response exercises, or other activities necessary to comply with various standards and certifications that we require to operate as a business. The Company provides regular awareness training to our employees and consultants using our collaboration platforms, including periodic phishing tests, to help identify, avoid, and mitigate cybersecurity threats, as well as targeted security training for key departments dealing with sensitive data types. Where needed, the Company seeks appropriate certifications from vendors and contractually requires adherence to data privacy and security requirements from its vendors. Where service providers are materially utilized, the company obtains SOC1 or SOC2 reports and complies with complementary user entity controls to keep those attestations valid.


text: The Company operates technologies that are exposed to the internet, and although robust cybersecurity programs, technologies, and safeguards are deployed to help protect the Company's operations and assets, the Company by nature is exposed to material cybersecurity attacks that are either generally targeted at companies that operate on the internet, or the Company by nature remains exposed to attacks that are specifically directed at the Company's technology systems exposed to the internet.


text: The Company's Board of Directors provide ultimate oversight of the Company's cybersecurity risk management program. As reflected in the Audit Committee's charter, the Board of Directors has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee. The CISO presents quarterly updates to the Audit Committee on the Company's cyber risks and threats, status of projects to strengthen the Company's information security systems, and emerging threats.


text: During the normal course of business, the Company has experienced and expects to continue to experience cyber-based attacks and other attempts to compromise our information systems, although none, to our knowledge, has had a material adverse effect on our business, financial condition or results of operations. The Company does not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected the Company. However, the sophistication of cyber threats continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors."


text: Risk Management and Strategy The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents.

companyName: Veralto Corp

ticker: VLTO


text: The Company's cybersecurity program and policies articulate the expectations and requirements with respect to acceptable use, risk management, data privacy, education and awareness, security incident management and reporting, identity and access management, vendor due diligence, security (with respect to physical assets, products, networks, and systems), security monitoring and vulnerability identification. The cybersecurity program and policies are operated by a dedicated cybersecurity operations team. The program and policies are aligned with the Company's enterprise risk management program.


text: The Company's cyber risk management program identifies, tracks, escalates, remediates, and reports risks at the corporate level and across each operating company. These risk areas include internal, product, vendor, supply chain, and external services leveraged across the Company. These risks are assessed, prioritized, and both tactically and strategically addressed via process, technology, and personnel improvements to ensure ongoing mitigation and tracking.


text: Sinclair maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and disclosure committee. The program addresses the corporate information technology environment, third-party service providers, and customer-facing products and applications.

companyName: Sinclair, Inc.

ticker: SBGI


text: The Company's cybersecurity strategy is guided by prioritized risk, identified areas for improvement based on the National Institute for Standards and Technology (NIST) Cybersecurity Framework, and emerging business needs. This strategy is shared with the executive leadership at least annually. The Company maintains a global incident response plan, coupled with a global continuous monitoring program. This plan and program include incident alerting, comprehensive incident criticality assessments, and escalation processes to support teams, senior leadership, and the Board. This escalation process also includes cross-functional materiality determinations and applicable reporting requirements.


text: The Company's cybersecurity operations team manages all facets of the security monitoring and global incident program, coordinating with a sourced managed services security provider and internal analysts across our operating companies. Applicable company employees are provided cybersecurity awareness training, which includes topics on the Company's policies and procedures for reporting potential incidents. The Company's cybersecurity team is continuously evaluating emerging risks, regulations, and compliance matters and updating the policies and procedures accordingly.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. The Company does not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which it is aware are reasonably likely to materially affect the Company. Refer to the risk factor captioned "Significant disruptions in, or breaches in security of, our information technology systems or data or violation of data privacy laws can adversely affect our business and financial statements" in Part I, "Item 1A. Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: The Board oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. Pursuant to the Audit Committee Charter, the Audit Committee of the Board provides compliance oversight to the Company's risk assessment and risk management policies, which includes cybersecurity, and the steps management has taken to monitor and mitigate such exposures and risks.


text: The Company's Chief Information Security Officer (CISO), in coordination with Chief Information Officer, is responsible for leading the assessment and management of cybersecurity risks. The current CISO has over 25 years of experience in information security and is a Certified Information Systems Security Professional (CISSP). The CISO reports to the Board, the Audit Committee and management on cybersecurity risk assessment, policies, incident prevention, detection, mitigation, and remediation of cybersecurity incidents on a quarterly or as needed basis.


text: The Company's cyber risk management program identifies, tracks, escalates, remediates, and reports risks at the corporate level and across each operating company. These risk areas include internal, product, vendor, supply chain, and external services leveraged across the Company. These risks are assessed, prioritized, and both tactically and strategically addressed via process, technology, and personnel improvements to help ensure ongoing mitigation and tracking.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also regularly receives briefings from management on our cyber risk management program, as well as presentations on cybersecurity topics from our Vice President of Technology Support, internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: PACS Group, Inc.

ticker: PACS


text: The Company's Chief Information Security Officer (CISO), in coordination with Chief Information Officer, is responsible for leading the assessment and management of cybersecurity risks and receives reports regarding the prevention, detection, mitigation and remediation of cybersecurity incidents from the Company's cybersecurity operations team. The current CISO has over 25 years of experience in information security and is a Certified Information Systems Security Professional (CISSP). The CISO reports to the Board, the Audit Committee and management on cybersecurity risk assessment, policies, incident prevention, detection, mitigation, and remediation of cybersecurity incidents on a quarterly or as needed basis.


text: Risk Management and Strategy As part of our overall risk management system and processes, we assess, identify and manage material risks from cybersecurity threats through our Enterprise Risk Management (ERM) process. For a description of cybersecurity risks relevant to our business, see Item 1A, "Risk Factors."

companyName: PHINIA INC.

ticker: PHIN


text: The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with the goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information we collect and store for use in operating our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, suppliers, other business partners and employees; and (v) providing appropriate disclosure of cybersecurity risks and incidents when required. Our cybersecurity and data protection policies, processes and strategies are informed by regulatory and business requirements, our prior experience addressing cybersecurity attacks and incidents (including with our former affiliates) and industry practices, and are periodically adjusted based on the results of assessments conducted through our ERM practices, third-party audits and independent reviews, and other processes.


text: Consistent with the Company's ERM practices, our cybersecurity policies, processes and layers of defense focus on the following areas: • Vigilance. The Company maintains 24/7 cybersecurity threat surveillance in conjunction with a managed security service that monitors system logs and network traffic for indicators of compromise and other suspicious activity, and conducts monthly external vulnerability assessments and annual penetration testing. • System Safeguards. The Company deploys system safeguards that are designed to protect the Company's information systems from cybersecurity threats, including early detection and response antivirus tools, data leak prevention tools and systems, vulnerability scans of data centers, firewalls, and anti-malware functionality and access controls. • Third-Party Collaboration. The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups, and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management. The Company has processes in place for identifying and overseeing cybersecurity risks presented by third-party users of the Company's systems, as well as third-party systems that could adversely impact our business in the event of a cybersecurity incident affecting those systems. • Training. The Company requires personnel to complete training regarding cybersecurity threats and incident reporting procedures, which reinforces the Company's information security policies and processes. We also require new hires to complete training regarding cybersecurity threats and acceptable use of our information systems. • Incident Response Planning. The Company has established and maintains a cybersecurity incident response plan that outlines an organized and timely approach for responding to and handling security incidents affecting the Company's systems or data, as well as taking appropriate action when the source of the intrusion or incident involved data from a third party.


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's policies and processes through audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity controls and oversight. Third-party audits and independent reviews of our cybersecurity measures, information security control environment and operating effectiveness are conducted on at least an annual basis to assist us with enhancing, implementing and monitoring our cybersecurity risk management programs.


text: As a global company, we have experienced cybersecurity attacks and incidents in the past, and we could in the future experience similar attacks. To date, we have not experienced a cybersecurity incident or attack, or any risk from cybersecurity threats, that has materially affected or is reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition.


text: The Board, in coordination with the Audit Committee, oversees the Company's policies with respect to the assessment and management of risks from cybersecurity threats. The Board and Audit Committee receive regular updates regarding cybersecurity risks from the Company's Chief Information Security Officer (CISO) and Chief Information Officer (CIO), including with respect to the assessment and management of such risks and recent developments, trends and the general threat environment.


text: The Company's cybersecurity team, which is led by our CISO, is responsible for overseeing the Company's cybersecurity and data security operations, programs, policies and processes and their general effectiveness. The cybersecurity team, in coordination with other Incident Response Team members, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incident. The Company's Incident Response Team consists of our CISO and other senior leaders from the Company's cybersecurity (composed of information security and technology operations), compliance, legal, financial reporting and other key business and corporate functions. The CISO and other Incident Response Team members monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with the incident response plan. The team also informs and coordinates with the Company's Disclosure Committee in timely reporting such incidents, as appropriate and depending on the severity of the incident, to the Strategy Board (consisting of our CEO, Chief Financial Officer (CFO), General Counsel, CIO and other members of management), Audit Committee and Board, and providing updates regarding such incidents until addressed.


text: We have experienced leaders responsible for assessing and managing risks arising from cybersecurity threats. Our CISO reports to the CIO and has served in various roles in information technology and information security for over 28 years, including most recently leading the Information Security Office of BorgWarner Inc. He holds a Bachelor of Science in Physics. The Company's CIO reports to our CEO and has served in various roles in information technology and information security for over 25 years, including most recently as CIO of Gentherm Incorporated. Our CIO holds a Bachelor of Science in Business, with a concentration in Computer Information Systems, and an MBA in Finance and Strategic Management. He is also a Digital Directors Network (DDN) Boardroom Certified Qualified Technology Expert (QTE). In addition, the Company's CEO, CFO and General Counsel each have experience overseeing the management of cybersecurity and other risks similar to those impacting the Company's business.


text: Risk Management and Strategy As part of our overall risk management system and processes, we assess, identify and manage material risks from cybersecurity threats through our Enterprise Risk Management (ERM) program. For a description of cybersecurity risks relevant to our business, see Item 1A, "Risk Factors."


text: Consistent with the Company's ERM practices, our cybersecurity policies, processes and layers of defense focus on the following areas: • Surveillance and Monitoring. The Company maintains 24/7 cybersecurity threat surveillance in conjunction with a managed security service that monitors system logs and network traffic for indicators of compromise and other suspicious activity, and conducts monthly external vulnerability assessments and annual penetration testing. • System Safeguards. The Company deploys system safeguards that are designed to protect the Company's information systems from cybersecurity threats, including early detection and response antivirus tools, data leak prevention tools and systems, vulnerability scans of data centers, firewalls, anti-malware functionality and access controls, and programs to support remediation, replacement or isolation of systems that have reached, or are expected to reach, end of security life. • Third-Party Collaboration. The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups, and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management. The Company has processes in place for identifying and overseeing cybersecurity risks presented by third-party users of the Company's systems, as well as third-party systems used by the Company. • Training. The Company requires personnel, including new hires, to complete training regarding cybersecurity threats, incident reporting procedures and acceptable use of our information systems. • Incident Response Planning. The Company has established and maintains a cybersecurity incident response plan that outlines an organized and timely approach for responding to and handling security incidents affecting the Company's systems or data, including the intrusions or incidents involving data from a third party.


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's policies and processes through audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity controls and oversight. Third-party audits and independent reviews of our cybersecurity measures, information security control environment and operating effectiveness are conducted on at least an annual basis.


text: The Board, in coordination with the Audit Committee, oversees the Company's policies with respect to the assessment and management of risks from cybersecurity threats. The Board receives updates regarding cybersecurity risks primarily in connection with its oversight of the Company's risk management practices. The Audit Committee receives updates regarding cybersecurity risks from the Company's Chief Information Security Officer (CISO) and Chief Information Officer (CIO), including with respect to the assessment and management of such risks and recent developments, trends and the general threat environment, on at least a quarterly basis.


text: The Company's cybersecurity team, which is led by our CISO, oversees the Company's cybersecurity and data security operations, programs, policies and processes and their general effectiveness. The cybersecurity team, in coordination with other Incident Response Team members, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents. The Company's Incident Response Team consists of our CISO and other senior leaders from the Company's cybersecurity (composed of information security and technology operations), compliance, legal, financial reporting and other key business and corporate functions. The CISO and other Incident Response Team members monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with the incident response plan. The team is also responsible for informing and coordinating with the Company's Disclosure Committee in timely reporting such incidents, as appropriate and depending on the severity of the incident, and facilitating updates to the Strategy Board (consisting of our CEO, Chief Financial Officer (CFO), General Counsel, CIO and other members of management), Audit Committee and Board regarding such incidents until addressed.


text: We have experienced leaders responsible for assessing and managing risks arising from cybersecurity threats. Our CISO reports to the CIO and has served in various roles in information technology and information security for over 29 years, including most recently leading the Information Security Office of BorgWarner Inc. He holds a Bachelor of Science in Physics. The Company's CIO reports to our CEO and has served in various roles in information technology and information security for over 26 years, including CIO of Gentherm Incorporated immediately prior to joining the Company. Our CIO holds a Bachelor of Science in Business, with a concentration in Computer Information Systems, and an MBA in Finance and Strategic Management. He is also a Digital Directors Network (DDN) Boardroom Certified Qualified Technology Expert (QTE). In addition, the Company's CEO, CFO and General Counsel each have experience overseeing the management of cybersecurity and other risks similar to those impacting the Company's business.


text: Sinclair maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and disclosure committee. The program addresses the corporate information technology environment, third-party service providers and customer-facing products and applications.


text: The Company's Chief Information Security Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board, the audit committee and disclosure committee. Our Chief Information Security Officer has over a decade of experience leading cybersecurity oversight, and others on our IT security team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification.