text: Cybersecurity incidents are identified and mitigated by cybersecurity incident response plans that detail any actions to be taken when a cybersecurity incident occurs. The cybersecurity incident response plans define the organization, roles and responsibilities of the teams tasked with mitigating the impact of the cybersecurity incident. They define repeatable processes for responding to cybersecurity incidents; ensure communication to the CTO and CNO, as appropriate; minimize the impact to customer and business operations; coordinate response activities with external organizations; decrease the likelihood of reoccurrence and ensure regulatory reporting occurs, among other objectives. If warranted, the incident response plan may trigger the activation of the Crisis Management Team, a subset of officers who lead corporate functions and would collectively perform impact assessment and provide decision-making guidance as a component of the Crisis Management Plan within the Evergy Companies' business continuity and disaster recovery plans. Both the incident response plan and crisis management plan are practiced on an annual basis. In addition, the Evergy Companies share network traffic with federal and state agencies to assist with the identification and mitigation of cybersecurity incidents. The Evergy Companies participate in federal and industry information sharing programs, such as the Cybersecurity and Infrastructure Security Agency to assist in the exchange of cybersecurity-related information, analysis and incident mitigation techniques. On at least an annual basis, cross-functional teams and executive management participate in a simulated cybersecurity incident exercise and the Evergy Companies regularly simulate cybersecurity incidents, including phishing attacks, to assess organizational readiness. In addition to a bi-annual internal assessment, the NRC inspects Wolf Creek's processes to validate the effectiveness of the program to protect Wolf Creek from cybersecurity threats.


text: In addition, the Evergy Companies review many third parties with whom the Evergy Companies do business to understand and evaluate potential cybersecurity risks of engaging the third party and work with the third party to appropriately mitigate identified risks, as needed. Among other measures, certain third parties are required to have processes in place to mitigate risk that data would be compromised, to become aware of cybersecurity incidents and/or to promptly notify the Evergy Companies of any cybersecurity incidents. Generally, the Evergy Companies retain the right to perform an assessment, audit, examination or review of all controls in the third parties' environment to monitor compliance with applicable cybersecurity agreements. The Evergy Companies may decide not to move forward with a third party that does not meet security requirements.

companyName: Evergy, Inc.

ticker: EVRG

secItem: Item 1C


text: While the Evergy Companies have a cybersecurity program designed to protect and preserve the integrity of their information systems, the Evergy Companies also maintain cybersecurity insurance to manage financial statement risk resulting from specific cyber-attacks. Although the Evergy Companies maintain cybersecurity insurance, there can be no guarantee that the Evergy Companies' insurance coverage limits will protect against any future claims or that such insurance proceeds will be paid in a timely manner.

stage1Category: Strategy Integration

stage1Method: unanimous


text: The Evergy Companies have been subjected to attempted cyber-attacks from time to time, and will likely continue to be subject to such attempted attacks, but these prior attacks have not had a material impact on the Evergy Companies' operations or financial results to date. However, because technology is increasingly complex and cyber-attacks are increasingly sophisticated and more frequent through the use of such tools as AI, there can be no assurance that such incidents will not have a material adverse effect on the Evergy Companies in the future. See Item 1A. Risk Factors – Operational Risks for additional information.

stage1Method: majority


text: Cybersecurity represents a critical component of our overall approach to risk management. Our cybersecurity policies, standards, and practices are integrated into our enterprise risk management approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board of Directors (the "Board"). We generally approach cybersecurity threats through a cross-functional, multilayered approach, with specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, suppliers and other third parties; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: Krystal Biotech, Inc.

ticker: KRYS

stage1Category: Risk Management Process


text: Cyber Security Risk Management and Strategy Our cybersecurity program focuses on the following areas: • Vigilance: Our cybersecurity threat operations function 24/7 with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: We deploy systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: We provide periodic mandatory training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices. • Incident Response and Recovery Planning: We have established and maintain incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated on an regular basis. • Communication, Coordination and Disclosure: We utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, financial, and other key business functions, as well as the members of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.


text: A part of our strategy for managing risks from cybersecurity threats is assessment and testing of the effectiveness of our cybersecurity measures. We engage third parties to perform assessments on our cybersecurity measures, and we adjust our cybersecurity measures as necessary based on the information provided by the assessments.


text: Material Impact from Cybersecurity Threats At the time of filing of this Annual Report on Form 10-K, to our knowledge, we have not experienced any cybersecurity threats that have materially affected our company (or are reasonably likely to materially affect our company), including our business strategy, operations or financial condition. For more information regarding cybersecurity risks faced by our company, see Item 1A. Risk Factors—Factors Relating to Cybersecurity—Factors Relating to Cybersecurity, which are incorporated by reference into this section.

companyName: Liberty Latin America Ltd.

ticker: LILA


text: The Board oversees the management of risks from cybersecurity threats. The Board receives regular presentations and reports on cybersecurity, which address a wide range of topics and also receives prompt and timely information regarding any cybersecurity incident that is or may become material, as well as ongoing updates regarding such incident until it has been addressed. At least once each year, the Board discusses the Company's approach to cybersecurity risk management with the Company's Vice President of Information Technology, who is the member of management that is principally responsible for overseeing cybersecurity at the Company, in partnership with other business leaders across the Company, including our Chief Executive Officer, Chief Accounting Officer, General Counsel, and Human Resources leader. Our Vice President of Information Technology has served in various roles in information technology and information security for over 28 years, including serving as Chief Information Security Officer of several public companies. He holds undergraduate and graduate degrees in electrical engineering and computer science and has attained numerous professional certifications in Information Security throughout his career.

stage1Category: Board Governance


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.


text: The Board oversees the management of risks from cybersecurity threats. The Board receives regular presentations and reports on cybersecurity, which address a wide range of topics and also receives prompt and timely information regarding any cybersecurity incident that is or may become material, as well as ongoing updates regarding such incident until it has been addressed. At least once each year, the Board discusses the Company's approach to cybersecurity risk management with the Company's Senior Director of Cyber Securit y, who is the member of management that is principally responsible for overseeing cybersecurity at the Company, in partnership with other business leaders across the Company, including our Chief Executive Officer, Chief Accounting Officer, General Counsel, and Human Resources leader. Our Senior Director of Cyber Security has served in various roles in information technology and information security for over 20 years, including serving as Information Security Officer for a global medical device manufacturer. He holds degrees in Global Business Management and Computer Science.


text: We have established a cybersecurity program, which we view as a foundational business practice incorporated into our broader risk management framework, as well as into all planning, development, operations and administration objectives. We have benchmarked our cybersecurity program against recognized frameworks established by the NIST, the International Organization for Standardization and other applicable industry standards.


text: We utilize third-party services and tools for identifying, protecting against, and detecting cyber incidents, and also partner with external vendors to augment our internal security capabilities. Additionally, we engage third-parties to conduct independent assessments of our cybersecurity infrastructure to evaluate the efficiency and effectiveness of our detection capabilities, along with our response mechanisms, and overall risk management.

companyName: Crucial Innovations, Corp.


text: Governance of Cybersecurity Risks From a governance perspective, our Audit Committee oversee our cybersecurity program, including the management of risks arising from cybersecurity threats. Our Audit Committee receives quarterly reports from both internal (e.g., management) and external sources (e.g., third-arty consultants), which cover topics that include, but are not limited to, recent cyber developments, evolving cyber standards, vulnerability assessments, third-party and independent reviews, the cyber threat environment, technological trends, and other cybersecurity considerations arising with respect to our company and third parties. Our GISO also keeps our executive team and our Audit Committee (if necessary) informed regarding any security incident that meets established reporting thresholds and ongoing updates regarding any such incident until it has been closed out.


text: Management of Cybersecurity Risks From a management perspective, our GISO, led by our Chief Information Security Officer, operates our cybersecurity program. Our program aligns with the NIST cybersecurity standard functions (Identify, Protect, Detect, Respond, Recover) and aims to secure our networks, information systems, information resources, data, services, and products against internal and external threats and mitigate security vulnerabilities while efficiently operating our business. We have integrated our cybersecurity program into our overall enterprise risk management program.

stage1Category: Management Role


text: Our GISO has processes in place to stay informed of and monitor the prevention, detection, mitigation and remediation of cybersecurity risks, including but not limited to, employing appropriate incident prevention and detection software, employing industry-standard encryption protocols where appropriate, applying patches and implementing identified corrective actions in a timely manner, maintaining an incident response plan and related procedures and regularly conducting internal training, cybersecurity audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.


text: Engagement of Third-Parties Our GISO partners with third-party cybersecurity service and product vendors to provide protection of our networks, information resources, products, services and data for our customers and employees. Furthermore, our GISO engages third-party cybersecurity and data protection experts to perform assessments on the efficacy of our cybersecurity program and measures, including cybersecurity maturity assessments, audits and independent reviews of our cybersecurity control environment and operating effectiveness. Our Chief Information Security Officer reports the results of such assessments, audits and reviews to our executive team and our Audit Committee.


text: We have implemented policies and practices to manage cybersecurity risks arising from our use of third-party service providers. For example, in general, we contractually require our third-party service providers to maintain cybersecurity controls to protect our confidential information, to share information with our company about their information security programs and to inform us of any security incidents on their systems that could impact our operations or confidential information. Although we rely on our third party service providers to implement security programs commensurate with their risk, we cannot ensure in all circumstances that their efforts will be successful.

stage1Category: Third-Party Risk


text: Our Senior Leadership Team's Qualifications Our current Chief Information Security Officer has served in various roles in information technology and information security for over 15 years, including as the Director of Information Security at the Colombian operations of a telecommunications company operating throughout Latin America and as the Head of Information Security in the Colombian operations of a large retail company operating in South America. Our Chief Information Security Officer holds undergraduate, graduate and master's degrees in risk management, business administration and information technology, as well as professional certification as a Certified Information Security Manager.


text: Our current Chief Technology Officer has extensive experience in running and managing cyber risks at large U.S. telecommunication companies and, prior to joining our company, had led the cybersecurity practice at a business unit at a large telecommunications company and established cyber risk identification, detection and protection practices for enterprise and government customers. Our Chief Technology Officer holds undergraduate and master's degrees in electrical engineering and has served in various roles in information technology at several telecommunications companies for over 30 years, including serving as either the Chief Technology Officer, Chief Information Officer or Chief Product Officer of three public companies.


text: Our Chief Executive Officer previously served as Chief Technology Officer at three other large media and telecommunications companies prior to becoming our Chief Executive Officer, which gave him significant security technology and operational responsibility over large networks. Our Chief Executive Officer had also led the venture arm at another leading telecommunications company which had invested in a number of IT security technology companies. The other members of our senior leadership team hold undergraduate and graduate degrees in their respective fields and have experience managing risks.


text: Governance of Cybersecurity Risks From a governance perspective, our Audit Committee oversees our cybersecurity program, including the management of risks arising from cybersecurity threats. Our Audit Committee receives quarterly reports from both internal (e.g., management) and external sources (e.g., third-party consultants), which cover topics that include, but are not limited to, recent cyber devel opments, evolving cyber standards, vulnerability assessments, third-party and independent reviews, the cyber threat environment, technological trends, and other cybersecurity considerations arising with respect to our company and third parties. Our GISO and Chief Legal Officer also keep our executive team and our Audit Committee (if necessary) informed regarding any security incident that meets established reporting thresholds and provide ongoing updates regarding any such incident until it has been closed out.


text: Engagement of Third-Parties Our GISO partners with third-party cybersecurity service and product vendors to provide protection of our networks, information resources, products, services and data of our customers and employees. Furthermore, our GISO engages third-party cybersecurity and data protection experts to perform assessments on the efficacy of our cybersecurity program and measures, including cybersecurity maturity assessments, audits and independent reviews of our cybersecurity control environment and operating effectiveness. Our Chief Information Security Officer reports the results of such assessments, audits and reviews to our executive team and our Audit Committee.


text: Our Senior Leadership Team's Qualifications Our Chief Information Security Officer has served in various roles in information technology and information security for over 15 years, including as the Director of Information Security at the Colombian operations of a telecommunications company operating throughout Latin America and as the Head of Information Security in the Colombian operations of a large retail company operating in South America. Our Chief Information Security Officer holds undergraduate, graduate and master's degrees in risk management, business administration and information technology, as well as professional certification as a Certified Information Security Manager.


text: Our Chief Information Security Officer reports to our Chief Legal Officer, who has served in that position since December 2017. Our Chief Legal Officer manages our cybersecurity function and legal matters affecting our company and risk management within the company. Our Chief Legal Officer's responsibilities also include overseeing legal support for corporate governance, financial reporting, litigation, mergers and acquisitions and commercial contracts, regulatory and general compliance matters at our company and management of our government affairs function.


text: In addition, our Chief Technology Officer has extensive experience in running and managing cyber risks at large U.S. telecommunication companies and, prior to joining our company, had led the cybersecurity practice at a business unit at a large telecommunications company and established cyber risk identification, detection and protection practices for enterprise and government customers. Our Chief Technology Officer holds undergraduate and master's degrees in electrical engineering and has served in various roles in information technology at several telecommunications companies for over 30 years, including serving as either the Chief Technology Officer, Chief Information Officer or Chief Product Officer of three public companies.


text: Our operations and other aspects of our business rely heavily on various information technology systems which are largely managed by third parties. We face significant cybersecurity threats, which are continuously increasing in sophistication, including computer viruses, internal and external security breaches, and other cyber-attacks. These threats could disrupt our operations, lead to the loss of confidential information, and hinder our ability to accurately report our financial results in a timely manner. We have adopted a Cybersecurity Policy to create effective administrative, technical, electronic, and physical protections to safeguard the personal information of Company personnel, confidential information concerning our portfolio investments and the integrity of the Company's information systems.

companyName: EQUUS TOTAL RETURN, INC.

ticker: EQS


text: We have created an Information Security Team, consisting of our Chief Financial Officer and our Chief Compliance Officer, to implement and administer our Cybersecurity Policy. Ensuring that all Equus personnel are aware of the Cybersecurity Policy and agree to adhere to its requirements; Establishing that information concerning the Fund is stored on encrypted cloud-based servers accessible only by authorized Equus personnel;


text: Providing that all of the Company's information systems are backed up daily, with offline copies available in the event that a major security issue arises; Testing and evaluating cybersecurity safeguards via the use of third-party information technology service providers;


text: Reviewing the security measures in the Company's Cybersecurity Policy annually or when there is a change in applicable laws or regulations or in business activities of Equus; and Conducting training as necessary for all Equus personnel; and Reporting cybersecurity matters to our Board of Directors who provide oversight of our Information Security Team.


text: We utilize third-party services and tools for identifying, protecting against, and detecting cyber incidents, and also partner with external vendors to augment our internal security capabilities. Additionally, we engage third-parties to conduct independent assessments of our cybersecurity infrastructure to evaluate the efficiency and effectiveness of our detection capabilities, along with our response mechanisms, and overall risk management.


text: Our approach to managing cybersecurity risks is part of a continuous improvement process, both in the context of cybersecurity and broader operational risk management. This ongoing process, which includes personnel training, is aimed at routinely reviewing and, as necessary, improving, our oversight processes and tools to ensure they remain effective and resilient in their management of cybersecurity risk.


text: Material Impact of Cybersecurity Threats While we have yet to experience a material cybersecurity event, we acknowledge the persistent and evolving nature of these threats, which have the potential to materially impact our business strategy, operations, and financial results adversely. We maintain robust policies and procedures focused on cybersecurity incident management, ensuring timely communication and escalation to all relevant stakeholders. This enables faster response and effective communication, including public disclosure if a material cybersecurity event were to occur.


text: Our Board of Directors oversees risks related to cybersecurity, including the security of our corporate, financial, and portfolio investment information and the steps management is taking to monitor and control these risks. Our Chief Compliance Officer conducts regular meetings with our independent directors to discuss various compliance matters, including any cybersecurity issues, and also delivers a comprehensive Annual Compliance Report to the Board, which report also addresses cybersecurity matters.


text: Our operations and other aspects of our business rely heavily on various information technology systems which are largely managed by third parties. We face significant cybersecurity threats, which are continuously increasing in sophistication, including computer viruses, internal and external security breaches, and other cyber-attacks. These threats could disrupt our operations, lead to the loss of confidential information, and hinder our ability to accurately report our financial results in a timely manner. We have adopted a Cybersecurity Policy to create effective administrative, technical, electronic, and physical protections to safeguard the personal information of Company personnel, confidential information concerning our operations and the integrity of the Company's information systems.


text: We have created an Information Security Team to implement and administer our Cybersecurity Policy. Among the duties and responsibility of our Information Security Team are the following: Ensuring that all CINV personnel are aware of the Cybersecurity Policy and agree to adhere to its requirements; Establishing that information concerning the Company is stored on encrypted cloud-based servers accessible only by authorized CINV personnel;


text: Reviewing the security measures in the Company's Cybersecurity Policy annually or when there is a change in applicable laws or regulations or in business activities of Equus; and Conducting training as necessary for all CINV personnel; and Reporting cybersecurity matters to our Board of Directors who provide oversight of our Information Security Team.


text: We have created an Information Security Team, consisting of our Chief Financial Officer and our Chief Compliance Officer, to implement and administer our Cybersecurity Policy. Our Chief Financial Officer and Chief Compliance Officer have each served in senior management positions for a number of years, have received cybersecurity training from time to time in connection with their professional certifications, and have overseen and supervised the activities of external information technology personnel of the Fund during this period. Among the duties and responsibilities of our Information Security Team are the following: Ensuring that all Equus personnel are aware of the Cybersecurity Policy and agree to adhere to its requirements; Establishing that information concerning the Fund is stored on encrypted cloud-based servers accessible only by authorized Equus personnel;


text: While we have yet to experience a material cybersecurity event, we acknowledge the persistent and evolving nature of these threats, which have the potential to materially impact our business strategy, operations, and financial results adversely. We maintain robust policies and procedures focused on cybersecurity incident management, ensuring timely communication and escalation to all relevant stakeholders. This enables faster response and effective communication, including public disclosure if a material cybersecurity event were to occur.


text: Our operations and other aspects of our bus iness rely heavily on various information technology systems which are largely managed by third parties. We face significant cybersecurity threats, which are continuously increasing in sophistication, including computer viruses, internal and external security breaches, and other cyber-attacks. These threats could disrupt our operations, lead to the loss of confidential information, and hinder our ability to accurately report our financial results in a timely manner. We have adopted a Cybersecurity Policy to create effective administrative, technical, electronic, and physical protections to safeguard the personal information of Company personnel, confidential information concerning our operations and the integrity of the Company's information systems.


text: Our approach to managing cybersecurity risks is part of a continuous improvement process, both in the context of cybersecurity and broader operational risk management.


text: This ongoing process, which includes personnel training, is aimed at routinely reviewing and, as necessary, improving, our oversight processes and tools to ensure they remain effective and resilient in their management of cybersecurity risk.


text: Our Board of Directors oversees risks related to cybersecurity, including the security of our corporate, financial, and operations information and the steps management is taking to monitor and control these risks. In the future, our Information Security Team will conduct regular meetings with our independent directors to discuss various compliance matters, including any cybersecurity issues.


text: Management and Strategy is committed to the integrity and security of the sensitive data that it collects, maintains, and transmits across its computer systems.

companyName: ARVANA INC

ticker: AVNI

stage1Category: None/Other


text: Over the ordinary course of our business, Arvana and its third-party service providers, such as charter booking services, collect, maintain, and transmit sensitive data including proprietary or confidential business information (such as operational data and personal information). The secure maintenance of this information is critical to our business and reputation.


text: our efforts to implement robust security measures, in reliance on administrative, technical, and physical safeguards, our risk management strategies, and practices for protecting sensitive data are subject to certain limitations. A variety of factors give rise to these limitations including the evolving nature of cyber threats, resource constraints, and the inherent risks associated with the technologies we and third-party service providers employ. Arvana relies on third parties, including cloud vendors and consultants, for various business functions.


text: Many of our third-party service providers have access to our information systems and data, and we rely on such third parties for the operation of our business. We oversee third-party service providers by conducting vendor diligence. Vendors are generally assessed for risk based on the nature of their service, access to data and systems and supply chain risk.


text: current risk management strategy may not fully account for or mitigate the risks posed by emerging technologies or the potential impact of these limitations on our business. Financial liabilities, damage to our reputation, and erosion of customer trust could negatively affect our business operations and financial condition.


text: have adopted a cybersecurity governance structure to identify, assess, and manage material risks from cybersecurity threats that include a framework to respond to and assess internal and external threats to the security, confidentiality, and integrity of Arvana's data and information systems. Under which framework management is responsible for assessing and managing material risks that arise from cybersecurity threats. We have not engaged third-party qualified contractors or claim any management expertise from which to draw in the event of cybersecurity threats.


text: identified by management, cybersecurity threats are to be immediately reported to Arvana's Audit Committee. The Audit Committee has primary responsibility for oversight of cybersecurity threats once a cybersecurity threat has been reported to it by management. Matters to be considered by the Audit Committee include management risks relating to data privacy, technology, and information security.


text: The Audit Committee must also consider Arvana's cyber security measures and the back-up of information systems, along with what steps Arvana has taken to monitor and control cybersecurity exposure. Further, the Audit Committee is tasked with the responsibility for conferring with management and Arvana's auditors as to the adequacy and effectiveness of information safeguards, cybersecurity policies, and internal controls that impact information security. The Audit Committee will be briefed on any material cybersecurity incidents that might adversely affect our business at least once each year, such brief will include topics such as risk assessment, risk management, control decisions, service provider arrangements, security incidents, responses with recommendations for changes or updates to policies and procedures.


text: are prohibited from keeping open files containing personal information on their computer screen when they are not at their desks. Employees are responsible for locking computer screen when away from workspace. must not share login information with co-workers.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: Risk Management and Strategy As an externally advised company, our day-to-day operations are managed by our Adviser and our executive officers under the oversight of our board of directors. We rely on our Adviser's cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats to us. This cybersecurity program is designed to protect the integrity and availability of our information and technology. This program addresses security governance, security awareness, employee training, relevant access and end-point security, vulnerability management, penetration testing, security monitoring and incident response. Our Adviser's practices align with the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

companyName: BROOKFIELD REAL ESTATE INCOME TRUST INC.


text: Our Adviser's cybersecurity program includes a comprehensive policy framework, reviewed and updated annually; security awareness training for all employees, completed annually; technology risk assessments for critical information systems and applications, performed annually and following all changes to these systems; monthly vulnerability scans; quarterly technology risk assessments and the use of software to protect the confidentiality, integrity and availability of our systems, including the use of anti-malware applications and the use of programs that log, monitor and audit system activities. The effectiveness of our Adviser's cybersecurity programs is evaluated regularly through both internal and third-party audits. We may also engage third parties to conduct risk assessments.


text: Our Adviser's Chief Information Security Officer ("CISO") utilizes a variety of processes and systems to manage cybersecurity risks including third-party risk. This includes operational compliance monitoring processes within our information technology service management program, a security operations center managed by a security services provider; and periodic assessments and tests conducted by external parties or internal audit and compliance functions. We also regularly monitor cybersecurity and data privacy risks of investments in our portfolio. Additionally, our vendor governance framework includes monitoring of vendors' compliance with contractual terms and their cybersecurity risk profile. A risk assessment is conducted for each violation identified, which includes an assessment of the impact from a financial, operational, reputational, regulatory compliance, and client service perspective, to determine its materiality. Regular reporting includes information on material security incidents and policy breaches.


text: No risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, our business strategy, results of operations or financial condition. However, we can provide no assurance that we will not experience any material cybersecurity threats or incidents in the future. See "Item 1.A. Risk Factors — Cybersecurity failures and data security incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential, personal or other sensitive information and/or damage to our business relationships or reputation, any of which could negatively impact our business, financial condition and operating results."


text: The audit committee of our board of directors (the "Audit Committee") is responsible for overseeing risk management strategies that are specific to us, including reviewing management's assessment of the current and emerging risks and related mitigation strategies across financial and non-financial risks, including cybersecurity risks. Regular reports and updates on material security incidents and cybersecurity risks are made to senior management and the Audit Committee by the Adviser.


text: The Adviser has a dedicated cybersecurity team, led by the CISO, which manages and monitors our data protection, privacy and cybersecurity program. In addition, our Adviser has established a Security Governance Committee, led by the CISO, that is responsible for, among other things, communicating information security status and needs to all stakeholders; overseeing that appropriate communication channels about cybersecurity risk occur at all levels and to executive management, including our management and the Audit Committee; and overseeing that appropriate action is being taken and monitored where information risks are identified.


text: The CISO and other members of the Security Governance Committee are selected from the Adviser's business groups. The CISO has over 20 years of cybersecurity and technology management experience.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Head of IT and Cybersecurity, to manage the risk assessment and mitigation process.

companyName: Denali Therapeutics Inc.

ticker: DNLI


text: Our Adviser's cybersecurity program includes a comprehensive policy framework, reviewed and updated annually; security awareness and data protection training for all employees, completed annually; technology risk assessments for critical information systems and applications, performed annually and following all changes to these systems; monthly vulnerability scans; quarterly technology risk assessments and the use of software to protect the confidentiality, integrity and availability of our systems, including the use of anti-malware applications and the use of programs that log, monitor and audit system activities. The effectiveness of our Adviser's cybersecurity programs is evaluated regularly through both internal and third-party audits. We may also engage third parties to conduct risk assessments.


text: Audits, cybersecurity simulations and employee testing results indicate that the Adviser's program is effective in protecting our information. The policies, standards, and guidance are structured to help us respond effectively to the dynamically changing environment of cybersecurity threats, cybersecurity risks, technologies, laws, and regulations. The Adviser modifies its policies, standards, and guidance as needed to adjust to this changing environment.


text: As a leading cybersecurity provider, we understand the importance of robust cybersecurity practices, and safeguarding and certifying our solutions to internationally recognized commercial and government standards. Trust is the foundation of everything we do, and we earn that trust through a comprehensive approach to identifying, managing and mitigating cybersecurity risk to our business and operations.

companyName: Zscaler, Inc.

ticker: ZS


text: Risk Management and Strategy Our platform was built leveraging guidance from leading industry frameworks to effectively manage and mitigate cybersecurity risks. Our rigorous risk management processes, which include data privacy, product security and information security, are overseen by the audit committee of our board of directors and our internal security committee, and are designed to ensure confidentiality, integrity and availability of our platform. These processes have been integrated into our overall enterprise risk management framework, which is overseen by our board of directors.


text: As part of our overall risk management system, we conduct annual security awareness training for personnel at all levels and functions, issue periodic simulated social engineering tests, and have established protocols to escalate cybersecurity incidents from identification through remediation. These activities are undertaken in collaboration with human resources, IT, and management.


text: Our internal security committee identifies and prioritizes protective measures across our enterprise and products, continuously driving improvements to our security approach as threats evolve. The committee members are key functional leaders from across the Company who share critical information and use data-driven strategies to manage cyber risks. The committee is led by our chief security officer and includes representatives from our security team, information technology, information security, incident response, engineering, enterprise risk, product management, cloud operations, legal and compliance teams. Our internal security committee has the primary responsibility for assessing, monitoring and managing our cybersecurity risks, including the prevention, detection, mitigation and remediation of cybersecurity incidents. The personnel comprising our internal security committee are certified and experienced cybersecurity professionals and information security managers with many years of experience across a variety of technology sub-specialties.


text: As a provider of cybersecurity products and services, it is critical for us to identify and implement protective measures across our enterprise and products, continuously driving improvements to our security approach. Our in-house global threat research team, Zscaler ThreatLabZ, a team of more than 150 security experts, collectively works to identify and prevent emerging threats, using malware reverse engineering, behavior analytics, data science and AI. We use the threat intelligence generated by ThreatLabz and other sources to implement security checks and reviews throughout our product development lifecycle. Our internal security teams and external cybersecurity auditors continuously evaluate our products, including by performing regular penetration tests and risk assessments to identify potential vulnerabilities.


text: We regularly review our cybersecurity policies, standards and procedures to account for changes in the threat landscape, as well as in response to legal and regulatory developments. Our cybersecurity efforts also include mandatory training for all employees and contractors on our security and privacy policies.


text: Our cybersecurity risk management approach provides a framework for identifying, monitoring, evaluating and responding to risks from cybersecurity threats and incidents. This framework includes steps for identifying the sources of potential cybersecurity threats or incidents, including potential threats and incidents associated with a third-party vendor or service provider, assessing the severity and risk of potential threats and incidents and implementing cybersecurity countermeasures and mitigation strategies. We recognize that our relationships with third parties may pose significant risks, and therefore we have implemented practices for building vendor diligence, onboarding and monitoring capabilities to assess those risks. These efforts can include internal briefings from our security and technical personnel, as well as external reports and threat intelligence from governmental, public and private sources, including external consultants and reports produced by security tools deployed in our technical environment.


text: Our incident response plan includes processes and procedures for assessing potential internal and external threats, activation and notification, crisis management and post-incident analysis designed to safeguard the confidentiality, availability and integrity of our platform and assets. A cross-functional incident response team, comprised of representatives from our internal security committee including information technology, information security, engineering, cloud operations, compliance, privacy, legal and members of our executive leadership team, is responsible for the monitoring and disposition of potential incidents, such as data breaches, intrusions and other security events, and implementing our detailed incident response plan. Our approach includes procedures to appropriately inform management, the audit committee of the board of directors and the full board of directors, as applicable, about cybersecurity threats and incidents. In fiscal 2024, we did not identify any cybersecurity incidents that materially affected, or are reasonably likely to materially affect, our business, results of operations or financial condition. For more information about these risks, please see "Risk Factors – Risks Related to Our Business" in this Annual Report on Form 10-K.


text: Our board of directors has oversight responsibility for our overall enterprise risk management. The audit committee of the board of directors oversees cybersecurity risk, with input from our internal security committee, based on its oversight of our risk management processes. In accordance with our incident response plan, the internal security committee meets at least monthly, provides cybersecurity updates to the audit committee quarterly and apprises the full board of directors as needed.


text: State regulators have increasingly enacted cybersecurity laws, including requirements for cybersecurity programs, data encryption, and breach notification. Many states have recently updated their data privacy regulations, and we expect this trend to continue. We actively monitor legislative and regulatory developments to ensure compliance.

companyName: BayCom Corp

ticker: BCML


text: Our internal security committee identifies and prioritizes protective measures across our enterprise and products, continuously driving improvements to our security approach as threats evolve. The committee members are key functional leaders from across the Company who share critical information and use data-driven strategies to manage cyber risks. The committee is led by our chief security officer and includes representatives from our security team, information technology, information security, incident response, engineering, enterprise risk, product management, cloud operations, legal and compliance teams. Our internal security committee has the primary responsibility for assessing, monitoring and managing our cybersecurity risks, including the prevention, detection, mitigation and remediation of cybersecurity incidents. The technical personnel comprising our internal security committee are experienced cybersecurity professionals and information security managers with many years of experience across a variety of technology sub-specialties.


text: Our incident response plan includes processes and procedures for assessing potential internal and external threats, activation and notification, crisis management and post-incident analysis designed to safeguard the confidentiality, availability and integrity of our platform and assets. A cross-functional incident response team, comprised of representatives from our internal security committee including information technology, information security, engineering, cloud operations, compliance, privacy, legal and members of our executive leadership team, is responsible for the monitoring and disposition of potential incidents, such as data breaches, intrusions and other security events, and implementing our detailed incident response plan. Our approach includes procedures to appropriately inform management, the audit committee of the board of directors and the full board of directors, as applicable, about cybersecurity threats and incidents. In fiscal 2025, we did not identify any cybersecurity incidents that materially affected, or are reasonably likely to materially affect, our business, results of operations or financial condition. For more information about these risks, please see "Risk Factors – Risks Related to Our Business" in this Annual Report on Form 10-K.


text: Denali's approach to cybersecurity seeks to defend the confidentiality, integrity and availability of our systems and information for our people and our patients.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: We also engage consultants to assist us in monitoring and testing our safeguards. Performance of our cybersecurity controls for certain systems is periodically reviewed by our internal quality functions. We further require third-party service providers who will be handling our company's sensitive information to certify that they implement appropriate security measures, consistent with all applicable laws, to maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: Additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, are included in this Annual Report on Form 10-K in Item 1A, "Risk Factors".


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Head of IT is primarily responsible to assess and manage our material risks from cybersecurity threats and has prior work experience in cybersecurity, holds relevant degrees, and current industry recognized cybersecurity certifications.


text: Our Head of IT oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Head of Information Technology is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following the identification and assessment of assets and assessing potential associated risks, implementation of protective measures, continuous monitoring and detection of unusual or suspicious activities, incident response and recovery management, regular security awareness and training, review and alignment of cybersecurity practices with industry recognized cybersecurity practices, compliance and regulation concerns Our Head of IT provides quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports; the Head of IT may be called upon to brief the board as well.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Head of IT and Cybersecurity, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we conduct annual security awareness training for personnel at all levels and functions, issue periodic simulated social engineering tests, and have established protocols to escalate cybersecurity incidents from identification through remediation. These activities are undertaken in collaboration with human resources, IT, and management.


text: The Company's information technology, communication networks, system applications, accounting and financial reporting platforms and related systems are integral to the operation of the business. The Company utilizes these systems, among others, for financial analysis, management, and reporting, and for various other aspects of the business.

companyName: CLEARONE INC

ticker: CLRO


text: Our Head of IT is primarily responsible to assess and manage our material risks from cybersecurity threats and has prior work experience in cybersecurity, holds relevant degrees, and has current industry recognized cybersecurity certifications.


text: Our Head of IT oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Head of IT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following: the identification and assessment of assets and assessing potential associated risks, implementation of protective measures, continuous monitoring and detection of unusual or suspicious activities, incident response and recovery management, regular security awareness and training, and review and alignment of cybersecurity practices with industry recognized cybersecurity practices, compliance, and regulation concerns.


text: Our Head of IT provides quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports; the Head of IT may be called upon to brief the board as well.


text: We rely on the information technology and systems maintained by our manager, RMR, and rely on our manager to identify and manage material risks from cybersecurity threats. RMR takes various actions, and incurs significant costs, to maintain and protect the operation and security of information technology and systems, including the data maintained in those systems. Our Audit Committee oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from RMR's chief information officer regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, RMR has a detailed incident response plan in place for contacting authorities and informing key stakeholders, including our management. We have not been materially affected and do not believe we are reasonably likely to be materially affected by any risks from cybersecurity threats, including as a result of previous incidents.

companyName: Industrial Logistics Properties Trust

ticker: ILPT


text: We rely on the information technology and systems maintained by our manager, RMR, and rely on our manager to identify, assess and manage material risks from cybersecurity threats. RMR takes various actions, and incurs significant costs, to maintain and protect the operation and security of information technology and systems, including the data maintained in those systems. Our Audit Committee oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from RMR's chief information officer regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, RMR has a detailed incident response plan in place for contacting authorities and informing key stakeholders, including our management. We have not been materially affected and do not believe we are reasonably likely to be materially affected by any risks from cybersecurity threats, including as a result of previous incidents.


text: Through its Manager, the Fund maintains a cybersecurity risk management program designed to identify, assess, manage, and mitigate threats, as well as respond to and recover from cybersecurity incidents. This program is coupled with an enterprise risk management program and covers the Fund's key information systems.

companyName: Venture Lending & Leasing IX, Inc.


text: The cybersecurity risk management program includes a comprehensive risk assessment that is applicable to the Fund's operations. This assessment is based on recognized standards for cybersecurity and information technology as set forth in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). It is reviewed and updated at least annually. Internal controls designed to mitigate risks presented in the assessment are tested annually by an independent third party. Additionally, the Manager, on behalf of the Fund, contracts with a qualified third party to perform annual assessments of the Company's cybersecurity risk management program and to perform cybersecurity risk evaluations of selected key vendors. Another third party is engaged to provide day to day IT services which include implementing, monitoring, and maintaining the preventative and detective measures specified as part of the Fund's cybersecurity risk management program.


text: The Committee receives periodic reports from management on potential cybersecurity risks and threats and receives presentations on cybersecurity topics from Hycroft's Information Systems Manager. The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.

companyName: HYCROFT MINING HOLDING CORP

ticker: HYMC


text: The Manager's Chief Compliance Officer led the development and oversees the implementation of the cybersecurity program, and is the head of the Manager's cybersecurity team, supported by the Director of Compliance. The Chief Compliance Officer is responsible for assessing and managing the Manager's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team, inclusive of all third parties engaged to provide operations, monitoring, detection, and remediation, has extensive experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes.


text: The Audit Committee of the Board of Directors oversees the Fund's cybersecurity risk exposures and the steps taken by management to monitor and mitigate identified risks. The Chief Compliance Officer briefs the Audit Committee on the effectiveness of the cyber risk management program at least on a quarterly basis. In addition, cybersecurity risks and cyber incidents, if any, are reviewed by the Fund's Board of Directors at least annually as part of the risk mapping exercise, or as warranted in the event of material incidents.


text: The Fund faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. See "Risk Factors – Risks Related to Cybersecurity" for further information on how our operations are subject to cyber incidents that could have a material adverse effect on our business, financial condition, results of operations, or cash flows.


text: We consider our information technology ("IT") and information systems to be valuable and vital assets and must be protected as such. We maintain a series of policies and supporting procedures designed to help ensure the security and confidentiality of our IT and information systems and to help ensure that they are properly protected from a variety of threats such as error, fraud, embezzlement, sabotage, terrorism, extortion, industrial espionage, service interruption, and natural disaster. Information is protected according to its sensitivity, value, and criticality with particular focus given to protecting confidential information, such as personal identifying information, unpublished financial results and other data deemed proprietary to us. Our cybersecurity network, including management, employees and service providers, prioritizes protecting and otherwise managing our information assets, and recognizes that information security is an important part of our business.

companyName: BrightSpire Capital, Inc.

ticker: BRSP


text: The Company's cybersecurity policies and procedures are fully integrated into its broader risk management framework, reflecting a holistic approach to cybersecurity risk management. Regular cybersecurity risk assessments are conducted to identify potential threats and vulnerabilities, with detailed mitigation strategies developed and implemented accordingly.

companyName: T Stamp Inc

ticker: IDAI


text: Our cybersecurity risk management program is a key component of our broader enterprise risk management ("ERM") infrastructure. Cybersecurity and information security, administered by our Head of IT and BrightSpire IT Partner (each, as defined below), is a key component of our broader ERM program, which includes diverse internal management, financial reporting, legal, compliance and risk management controls, policies and procedures primarily under the supervision of senior management. The results of our ERM layers of management control, risk control and compliance oversight and independent assurances in any given quarter are reviewed with senior management, our Audit Committee (independent directors, primarily responsible for oversight of our overall risk profile and risk management policies) and Board of Directors. We have focused on the following cybersecurity initiatives.


text: • Responsible Parties: We engaged a global leader in end-to-end IT solutions (the "BrightSpire IT Partner") to advance and maintain a comprehensive cybersecurity program. Our cybersecurity program is designed with the BrightSpire IT Partner's attention to and integration of certain information security standards issued by the SEC, the National Institute of Standards and Technology, and the International Organization for Standardization. We also have a dedicated senior employee to lead IT ("Head of IT") oversight and functions, together with our Chief Financial Officer, General Counsel (together, the "Information Security Group") and aforementioned BrightSpire IT Partner. Benefits provided by the Head of IT and BrightSpire IT Partner include a significant reduction in critical vulnerabilities, cost effective governance and risk services, current expertise/awareness to model, adaptation to and mitigation of new threats, leverage of internal team resources to focus on business priorities, and effectively meeting and managing evolving regulatory requirements in real time. Other members of management and team leaders assist in incident response efforts as well. • Cybersecurity Risk Management ("CRM") Program: The CRM program includes: (i) implementation of hardware and software infrastructure, primarily cloud based; (ii) "security first" approach to policies, processes and procedures (including general IT and security, information security, business continuity and incident response policies and plans); (iii) employee education, training and periodic testing and patching, including four to six sessions each calendar year (addressing spam, phishing, information security protocols, use of social media); and (iv) assessments of internal resources and diligence of external vendors and systems. Business continuity, disaster recovery and incident response procedures prioritize constant communication and follow a multi-step program including identification, preparation, implementation and resolution. • Cloud Services: We migrated and maintain our company data and communication services to a leading cloud-based service provider, security systems and protected environment. Employees working from home may only connect and conduct business activities through a virtual private network (VPN). • Security First Approach: Our cloud-based systems take a security first approach, including: (i) Perimeter Security (firewalls, antivirus, malware); (ii) Network Security (secure remote access, network patch management); (iii) Application Security (patch management, multi-factor authentication); (iv) Endpoint Security (email security/encryption, web filtering & URL defense, mobile device management); and (v) Data Security.


text: Cybersecurity Systems Review. We regularly review our cybersecurity systems, policies and procedures through a series of channels, including but not limited to our Audit Committee and Board of Directors, the BrightSpire IT Partner, our internal Information Security Group, our independent financial auditor, and outside counsel.


text: • Our Audit Committee and Board of Directors play an active role in reviewing our cybersecurity initiatives. The BrightSpire IT Partner provides our Board an annual review of our cybersecurity governance and risk management program, security metrics relevant to the period in review (including findings on phishing campaigns and vulnerability patchwork initiatives) and provides the Audit Committee and Board updates regarding the cybersecurity threat landscape (for example, the impact of artificial intelligence). In coordination with the Information Security Group, the General Counsel provides reports of material cybersecurity incidents and cybersecurity threats (if any) at each quarterly meeting of the Audit Committee and Board. • The BrightSpire IT Partner has established itself as a provider of managed services and technology solutions for over two decades, providing 24/7 oversight and services, including continuous testing and vulnerability scanning. The BrightSpire IT Partner also performs annual due diligence of key vendors on a rotating basis (including System and Organization Controls (SOC) report reviews, or alternatively solicit detailed questionnaires to evaluate such vendors cybersecurity preparedness and protections). • Our Head of IT has over two decades of experience in IT and cybersecurity work and developed and implemented our cybersecurity program with the BrightSpire IT Partner. Together with our Head of IT, the Information Security Group considers current cybersecurity trends and threats, including through discussions with the BrightSpire IT Partner, outside cybersecurity counsel, our independent financial auditor and internal auditor. The Information Security Group undertakes table-top business disruption, disaster recovery and related response strategies and plans on a periodic basis and seeks to review and update applicable policies and procedures at least annually.


text: No Material Incidents. Since inception in January 2018, we have not experienced any material cybersecurity or information security incidents. We have not incurred any expenses due to material information security incident penalties or settlements.


text: Cyber Liability Insurance. Through consultant driven data, analytics and peer benchmarking, we secured and maintain specific coverage to mitigate losses associated with cyber-attacks and other information security incidents, addressing both first-party and third-party losses from incident response, cyber extortion, data loss, business interruption, contingent business interruption, regulatory penalties, media liability, social engineering coverage, system failures and bricking/hardware replacement.


text: Our cybersecurity risk management program is a key component of our broader enterprise risk management ("ERM") infrastructure. Cybersecurity and information security, administered by our Head of IT and BrightSpire IT Partner (each, as defined below), is a key component of our broader ERM program, which includes diverse internal management, financial reporting, legal, compliance and risk management controls, policies and procedures primarily under the supervision of senior management. The results of our ERM layers of management control, risk control and compliance oversight and independent assurances are reviewed with senior management, our Audit Committee (independent directors, primarily responsible for oversight of our overall risk profile and risk management policies) and Board of Directors quarterly. We have focused on the following cybersecurity initiatives.


text: We have developed a cybersecurity incident response plan that provides a documented framework for handling cybersecurity incidents and facilitates coordination across multiple parts of the Company. Dedicated members of our information security team, led by our Senior Vice President, Information Technology and our Director of Information Security, continuously monitor threat intelligence feeds, handle vulnerability management and respond to incidents. In addition, we periodically perform simulations and drills at a technical level.

companyName: Construction Partners, Inc.

ticker: ROAD


text: Cybersecurity Insurance To help mitigate the financial risks associated with any cyber security incidents, Wyndham Hotels also maintains cyber insurance that is renewed annually and covers both cyber events and business interruption. We closely monitor costs of breaches within the industry in an effort to ensure that our coverage is sufficient to address all reasonably foreseeable threats and levels of risk.

companyName: WYNDHAM HOTELS & RESORTS, INC.

ticker: WH


text: • Responsible Parties: We engaged a global leader in end-to-end IT solutions (the "BrightSpire IT Partner") to advance and maintain a comprehensive cybersecurity program. Our cybersecurity program is designed to leverage certain information security standards, such as those issued by the National Institute of Standards and Technology, and the International Organization for Standardization. We also have a dedicated senior employee to lead IT ("Head of IT") oversight and functions, together with our Chief Financial Officer, General Counsel (together, the "Information Security Group") and aforementioned BrightSpire IT Partner. Benefits provided by the Head of IT and BrightSpire IT Partner include a significant reduction in critical vulnerabilities, cost effective governance and risk services, current expertise/awareness to model, adapt and mitigate new threats, leverage of internal team resources to focus on business priorities, and addressing evolving regulatory requirements. Our response plans require prompt notification to the Information Security Group in the event of a significant cybersecurity incident and prompt briefings on further developments as appropriate. Other members of management and team leaders assist in incident response efforts as well. • Cybersecurity Risk Management ("CRM") Program: The CRM program includes: (i) implementation of hardware and software infrastructure, primarily cloud based; (ii) "security first" approach to policies, processes and procedures (including general IT and security, information security, business continuity and incident response policies and plans); (iii) employee education, training and periodic testing and patching; and (iv) assessments of internal resources and diligence of external vendors and systems. Business continuity, disaster recovery and incident response procedures prioritize constant communication and follow a multi-step program including identification, preparation, implementation and resolution. • Cloud Services: We maintain our company data and communication services with a leading cloud-based service provider, security systems and protected environment. Employees working from home may only connect and conduct business activities through a virtual private network (VPN). • Security First Approach: Our cloud-based systems take a security first approach, including: (i) Perimeter Security (firewalls, antivirus, malware); (ii) Network Security (secure remote access, network patch management); (iii) Application Security (patch management, multi-factor authentication); (iv) Endpoint Security (email security/encryption, web filtering & URL defense, mobile device management); and (v) Data Security.


text: Cybersecurity Systems Review. We regularly review our cybersecurity systems, policies and procedures through a series of channels, including but not limited to our Audit Committee and Board of Directors, the BrightSpire IT Partner, our internal Information Security Group, our internal financial auditor and outside counsel.


text: • Our Audit Committee and Board of Directors play an active role in reviewing our cybersecurity initiatives. The BrightSpire IT Partner provides our Board an annual review of our cybersecurity governance and risk management program, security metrics relevant to the period in review and provides the Audit Committee and Board updates regarding the cybersecurity threat landscape. In coordination with the Information Security Group, the General Counsel provides reports of significant cybersecurity incidents and cybersecurity threats (if any) at each quarterly meeting of the Audit Committee and Board or ad hoc as appropriate. • The BrightSpire IT Partner has established itself as a provider of managed services and technology solutions for over two decades, providing 24/7 oversight and services, including continuous testing and vulnerability scanning. The BrightSpire IT Partner also performs annual due diligence of key vendors on a rotating basis (including System and Organization Controls (SOC) report reviews, or alternatively solicits detailed questionnaires to evaluate such vendors cybersecurity preparedness and protections). • Our Head of IT has over two decades of experience in IT and cybersecurity work and developed and implemented our cybersecurity program with the BrightSpire IT Partner. Together with our Head of IT, the Information Security Group considers current cybersecurity trends and threats, including through discussions with the BrightSpire IT Partner, outside cybersecurity counsel, our independent financial auditor and internal auditor. The Information Security Group undertakes table-top business disruption, disaster recovery and related response strategies and plans on a periodic basis and seeks to review and update applicable policies and procedures at least annually.


text: No Material Incidents. As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. Since inception in January 2018, we are not aware of any cybersecurity or information security incidents that have materially affected us to date. We have not incurred any expenses due to material information security incident penalties or settlements. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. Refer to the risk factor "We are highly dependent on information systems and third-parties, and system failures or cybersecurity incidents incurred by us or the third-parties that we rely on could significantly disrupt our ability to operate our business." in the section entitled "Risk Factors—Risks Related to Our Company and Our Structure" for more information regarding our cybersecurity risks.


text: Cyber Liability Insurance. Through consultant driven data, analytics and peer benchmarking, we secured and maintain specific coverage to mitigate certain losses associated with cyber-attacks and other information security incidents, addressing both first-party and third-party losses from incident response, including for example, cyber extortion, data loss, business interruption, contingent business interruption, regulatory penalties, media liability, social engineering coverage, system failures and bricking/hardware replacement.


text: Risk Management and Strategy As part of our enterprise risk management function, we have implemented processes to assess, identify and manage the material risks facing our company, including risks from cybersecurity threats. Our enterprise risk management function represents our overall risk management system. Our cybersecurity program is built upon recognized security frameworks. We believe that our processes provide us with a comprehensive assessment of potential cybersecurity threats. We conduct regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage the material risks from cybersecurity threats include the risks arising from threats associated with third-party service providers, including cloud-based platforms.


text: Internally, we have a security awareness training platform that includes training to reinforce our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The cybersecurity awareness training platform offers training on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all employees on a periodic basis, and it is supplemented by testing initiatives, including periodic phishing tests.


text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For instance, we have engaged an independent cybersecurity advisor to evaluate our cybersecurity controls and a cybersecurity firm to conduct continuous threat detection, response and remediation.


text: To date, we have not experienced a cybersecurity incident that has had a material impact on our business strategy, results of operations or financial condition, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, as discussed more fully under "Item 1A. Risk Factors," cybersecurity attacks are continually evolving to become more sophisticated and, while we have invested in the protection of our data and information technology to reduce the risk of a cybersecurity incident, our efforts may not be effective in preventing breakdowns or breaches in our systems.


text: Role of the Board. Our board of directors exercises direct oversight of our strategic risks through its oversight of our enterprise risk management function. The Audit Committee of the board of directors in particular is responsible for overseeing our IT security controls and the adequacy of our IT security program, compliance and controls with management. As part of such oversight, the board of directors, including members of the Audit Committee, receive periodic reports from management and our third-party service providers to assess the primary cybersecurity risks we face.


text: Role of Management. Our Senior Vice President, Information Technology and our Director of Information Security are together responsible for the day-to-day management of our cybersecurity risks. These professionals have extensive experience in the information technology area, including cybersecurity. In particular, our Senior Vice President, Information Technology has more than 30 years of professional experience in the field of management information systems and information security, including with other companies in our industry. Further, our Director of Information Security has more than 20 years of experience in the information security area, with a career spanning roles with the U.S. Air Force, healthcare, academia and private consulting, and holds various certifications related to cybersecurity.


text: Security Incident Response Plan. We have a security incident response plan in place. The incident response plan is a set of coordinated procedures that our incident response team executes with the goal of ensuring timely and accurate resolution of cybersecurity incidents.


text: Risk Management and Strategy Our comprehensive risk management strategy for the assessment, identification and management of material risks stemming from cybersecurity threats involves a systematic evaluation of potential threats, vulnerabilities, and their potential impacts on our organization's operations, data, and systems.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program, including legal, compliance, strategic, operational, and financial risk areas.


text: The cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and broader enterprise IT environment; • A team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls, and (iii) response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls; • Cybersecurity awareness training for users and senior management, including through the use of third-party providers for regular mandatory training; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and, • A risk management process for third-party service providers, suppliers and vendors, including a rigorous vetting process and ongoing monitoring mechanisms designed to ensure compliance with cybersecurity standards.


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity incidents, that have had a materially adverse effect on our operations, business, results of operations, or financial condition.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function. It has delegated oversight of cybersecurity and other information technology risks to the Audit Committee (the "Committee"). The Committee oversees the implementation of the cybersecurity risk management program.


text: Incident Response and Recovery Planning We have established comprehensive incident response and recovery plans and continue to periodically test and evaluate the effectiveness of those plans. Our incident response and recovery plans address—and guide our employees, management and the Board on—our response to a cybersecurity incident.

companyName: ESSENTIAL PROPERTIES REALTY TRUST, INC.

ticker: EPRT


text: Management is responsible for assessing and managing our material risks from cybersecurity threats. Management has primary responsibility for our overall cybersecurity risk management program and supervises both the internal cybersecurity personnel and external cybersecurity consultants. Hycroft's Information Systems Manager has many years of experience leading cybersecurity oversight and has extensive experience with information technology, including security, auditing, compliance, systems, and programming.


text: The management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants; and alerts and reports produced by security tools deployed in the IT environment. Our cybersecurity incident response plan governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior management and our Board of Directors.


text: The cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and broader enterprise IT environment; • A team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls, and (iii) response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls; • Cybersecurity awareness training for users and senior management, including through the use of third-party providers for regular mandatory training; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A risk management process for third-party service providers, suppliers and vendors, including a rigorous vetting process and ongoing monitoring mechanisms designed to ensure compliance with cybersecurity standards.


text: As of the date of this 2024 Form 10-K, the Company is not aware of any cybersecurity incidents, that have had a materially adverse effect on our operations, business, results of operations, or financial condition.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function. It has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees the implementation of the cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management on potential cybersecurity risks and threats and receives presentations on cybersecurity topics from Hycroft's Information Systems Manager. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.


text: Risk Management and Strategy We review cybersecurity risk as part of our overall enterprise risk management program. This ensures that cybersecurity risk management remains a top priority in our business strategy and operations.


text: Trust Stamp has adopted an Information Security Incident Response Plan that establishes policy and protocol to follow in response to an information security incident or event impacting Trust Stamp. This policy applies to all Trust Stamp employees holding management responsibilities. Incidents are reported by users via various methods including verbally, email, or other methods. The Development Operations team via the Chief Technology Officer or Executive Vice President is the main point of contact for technical support issues. It is to be expected that potential security incidents will be raised through this channel.


text: Our risk management strategy includes, among other elements: • Identification: We aim to proactively identify sources of risk, areas of impact, and relevant events that could give rise to cybersecurity risks, such as changes to our infrastructure, service providers, or personnel. • Assessment: We conduct periodic risk assessments to identify cybersecurity threats. We also conduct likelihood and impact assessments with the goal of identifying reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. • Management: Following our risk assessments, we design and implement reasonable safeguards to address any identified gaps in our existing processes and procedures.


text: We engage third parties, including consultants and auditors, to evaluate the effectiveness of our risk management program, control environment, and cybersecurity practices through security audits, penetration testing, and other engagements.


text: The Company's cybersecurity policies and procedures are fully integrated into its broader risk management framework, reflecting a holistic approach to cybersecurity risk management. Regular cybersecurity risk assessments are conducted to identify potential threats and vulnerabilities, with detailed mitigation strategies developed and implemented accordingly.


text: The Company engages third-party cybersecurity assessments to ensure an objective evaluation of its cybersecurity stance, including the effectiveness of its risk management strategies. Oversight of cybersecurity risks posed by third-party service providers is systematically managed, ensuring that all external risks are identified and mitigated. The Company did not have any material cybersecurity breaches during the year ended December 31, 2023.


text: Board of Director Governance The Board of Directors (the "Board") includes members with substantial cybersecurity expertise, ensuring informed oversight of cybersecurity risks. Documentation of the Board's involvement in cybersecurity oversight is maintained, highlighting the frequency and topics of discussions related to cybersecurity risks and incident response. The Board is regularly updated on cybersecurity risks and incidents through established reporting mechanisms, ensuring they are well-informed to make strategic decisions regarding the Company's cybersecurity posture.


text: Management's Governance Management's roles and responsibilities in cybersecurity oversight are clearly defined, with specific committees or positions designated for managing cybersecurity risks. The day-to-day management of cybersecurity is the responsibility of the Chief Technology Officer who oversees our technology team. These include procedures for incident response and regular reporting of cybersecurity information to the Board of Directors (the "Board"), ensuring effective communication and oversight. Cybersecurity risk management is seamlessly integrated into the Company's overall business strategy and decision-making processes, demonstrating a proactive approach to managing cybersecurity risks.


text: The Company has established clear criteria for determining the materiality of cybersecurity incidents, which include assessing potential or actual financial impacts, reputational damage, and operational disruptions. Documented incidents are meticulously recorded, detailing their nature, scope, and financial implications, ensuring transparency and accountability. The timeliness of Form 8-K filings following material cybersecurity incidents is strictly adhered to, with a thorough process in place for documenting any reasons for delayed disclosures. This ensures compliance with SEC requirements and maintains stakeholder confidence in the Company's cybersecurity posture.


text: Risk Management and Strategy We review cybersecurity risk as part of our overall enterprise risk management program with a goal of ensuring that cybersecurity risk management remains a top priority in our business strategy and operations.


text: The Company engages third-party cybersecurity assessments to ensure an objective evaluation of its cybersecurity stance, including the effectiveness of its risk management strategies. Oversight of cybersecurity risks posed by third-party service providers is systematically managed, ensuring that all external risks are identified and mitigated. The Company did not have any material cybersecurity breaches during the year ended December 31, 2024.


text: Board of Director's Governance The Board of Directors (the "Board") includes members with substantial cybersecurity expertise, ensuring informed oversight of cybersecurity risks. Documentation of the Board's involvement in cybersecurity oversight is maintained, highlighting the frequency and topics of discussions related to cybersecurity risks and incident response. The Board is regularly updated on cybersecurity risks and incidents through established reporting mechanisms, ensuring they are well-informed to make strategic decisions regarding the Company's cybersecurity posture.


text: Risk Management and Strategy The Company recognizes the critical importance of developing, implementing, and maintaining effective cybersecurity measures to protect our information systems and provide for the confidentiality, integrity, and availability of our data, as well as that of our customers, business partners and employees. Our cybersecurity processes are integrated into our overall enterprise risk management framework so that cybersecurity risks can be evaluated and managed alongside other business risks. Such integration supports our effort to promote a company-wide culture of cybersecurity risk management.

companyName: IBEX Ltd

ticker: IBEX


text: Risk Assessment. Our in-house security teams and third-party security firms periodically evaluate the Company's cybersecurity policies, processes, and practices. Such evaluations may include audits, assessments, penetration testing, threat modeling, tabletop exercises, and similar activities focused on evaluating the effectiveness of our cybersecurity processes and planning. The Company updates its cybersecurity policies, standards, processes, and practices periodically, as appropriate, based on the insights gained from these assessments, evolving industry standards, cybersecurity threat intelligence, changes to our infrastructure, and client-specific requirements.


text: The Company considers the following factors in assessing its cybersecurity risks, mitigation, and remediation strategies: the likelihood and degree of risk; potential impact, if a risk materializes; and the feasibility, cost and impact of controls. The specific controls used by the Company vary based on the systems and program involved, but typically include vulnerability and patch management, penetration testing, firewalls, intrusion prevention and detection systems, anti-malware (including anti-phishing) technical safeguards and access controls, privileged access management, endpoint threat detection and response, identity and access management, multi-factor authentication, logging and monitoring, cyber insurance, and physical security controls. The Company also incorporates threat intelligence and monitors emerging cybersecurity threats relevant to the BPO industry.


text: We have, and will continue to, integrate AI into our solutions, as well as explore potential third-party partnerships to help us be better positioned to offer our clients robust solutions. While AI offers significant benefits, it also presents risks and challenges. AI solutions are evolving and are not infallible, and we may encounter issues with data sourcing, technology integration, program bias into decision-making algorithms, security challenges and the protection of personal information and privacy. The Company typically conducts a risk assessment to identify potential threats and vulnerabilities in the third-party partners' systems, including reviews of data security, the AI model security, and compliance with applicable laws, regulations, and standards related to AI and data security.


text: Third-Party Risks. We have established processes to oversee and identify cybersecurity risks presented by third parties. Under these processes, contracts with third parties are to be reviewed for proper contractual controls, to include provisions mandating the implementation and maintenance of appropriate cybersecurity measures as well as legal recourse in the event of a security incident. We periodically conduct assessments of key vendor and business partners' cybersecurity practices and require them to adhere to our security standards, as appropriate. Additionally, we may perform additional due diligence on select third-party service providers by collecting and reviewing certifications when available. The Company also conducts periodic audits of third-party processes and certifications to consider their use of industry best practices.


text: Business Continuity, Incident Response and Disaster Recovery. The Company has established and maintains business continuity, incident response, and disaster recovery plans designed to address the Company's response to cybersecurity incidents and other potential disruptions. Our IT Security, Operations and Compliance teams routinely evaluate and update these plans to enhance our incident response preparedness. The Company also leverages third party incident response and threat detection services.


text: Education and Awareness. The Company provides regular, mandatory training for all personnel on cybersecurity threats and has processes and procedures in place to communicate out-of-cycle notices and updates regarding the Company's information security policies, standards, processes, and practices by the CTO as needed.