text: We assess material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. As our Company grows, we plan to develop a more robust and detailed strategy for cybersecurity in alignment with nationally accepted standards. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, Governance

companyName: Pelthos Therapeutics Inc.

ticker: PTHS


text: management and board of directors recognize the critical importance of maintaining the trust and confidence of our business partners and employees, including the importance of managing cybersecurity risks as part of our larger risk management program. While all of our personnel play a part in managing cybersecurity risks, one of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks that we face. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

secItem: Item 1C

stage1Category: Board Governance

stage1Method: unanimous


text: Management and Strategy have designed and implemented an information security program that is tailored to our operations and infrastructure, the nature of our products and services, and the sensitivity of data. Our information security program consists of processes that are designed to identify, assess, and manage material risks from cybersecurity threats.

companyName: Fintech Scion Ltd


text: have implemented cybersecurity risk management processes that include, for example, vulnerability assessments, application security assessments, penetration testing, third party security assessments, security audits, and ongoing risk assessments. In addition, we have implemented technical, physical, and organizational safeguards designed to mitigate material risks from cybersecurity threats, including, for example, depending on the environment or system: information security policies and standards, data protection policies and standards, security training and awareness campaigns, information protection processes, and systems monitoring for cybersecurity threats. Further, our assessment and management of material risks from cybersecurity threats are an important element of our overall enterprise risk management program and included in our annual enterprise risk assessment which we provide to senior management and the Board.


text: use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional services firms (including legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software and managed service providers, penetration testing firms, and forensic investigators.


text: Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our cybersecurity consultant, regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board retains oversight of cybersecurity because of its importance. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate. Our Cybersecurity consultant has extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks.


text: Assessment and Strategy regularly evaluate cybersecurity risk from computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human error and technological errors. Such risks are reviewed by our management on a periodic basis as deemed appropriate.

companyName: Transit Pro Tech Inc.


text: overall strategy in combatting known cybersecurity risks includes a variety of individual tactics, including: use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect data the deployment of updates and patches as they are available and maintaining the current versions of major software to reduce the the use of third-party service to conduct mandatory online training for all employees regarding identifying and avoiding cyber-security the review of the security procedures used by third parties that may host or otherwise have access to Fuel Tech's data.

stage1Category: Risk Management Process


text: deployment of third-party cyber-security experts to perform penetration testing on our internal and external networks and necessary, the use of third-party security experts if and when an incident is detected are not aware of having experienced any material cybersecurity incidents. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions. For more information, please see "Cybersecurity" under Item 1A "Risk Factors" above.

stage1Category: Strategy Integration


text: the Board of Directors has yet to establish any committees, Management regularly updates our Board regarding Management's efforts to minimize cybersecurity risks.


text: cybersecurity risk management program is being designed based on various cybersecurity frameworks, including National Institute of Standards and Technology and the Center for Internet Security, as well as information security standards issued by the International Organization for Standardization, including ISO 27001 and ISO 27002. The Company uses these frameworks and information security standards as a guide to identify, assess, and management cybersecurity risks relevant to the business. Formalization and implementation of robust IT security policies; Conducting vulnerability assessments; Revision of user access request documentation to clearly define the roles and permissions assigned to users; of the accuracy and completeness of user listings and access;

companyName: Sensus Healthcare, Inc.

ticker: SRTS


text: evidence related to system modifications; and with external specialists to aid in the ongoing evaluation of existing policies and procedures. Establishment of a dedicated cybersecurity governance committee; of cybersecurity incident response procedures and formats; Conducting penetration tests on a quarterly basis; Enhancement of segregation of duties to mitigate the risk of self-review of transactions within the system;


text: Company has not identified any risks from known cybersecurity threats and did not have any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, refer to Item 1A. Risk Factors – "The Company's operations may be impaired if our information technology systems fail to perform adequately or are the subject of a data breach or cyberattack," which is incorporated by reference into this Item 1C.


text: Board of Directors actively collaborates with management to supervise cybersecurity risks. The Chief Technology Officer ("CTO"), with over 10 years' experience in cybersecurity, leads the Company's overall cybersecurity function and monitors cybersecurity risks. The CTO works with internal personnel and third-party consultants to design and implement the controls on the prevention, detection, mitigation, and remediation of cybersecurity risks. The CTO maintains regular communication with the Board on matters related to cybersecurity and provides updates to management on a quarterly basis. In the event of a cybersecurity incident, the Board is to be promptly notified.

stage1Category: Management Role


text: considers cybersecurity risk as part of its risk oversight function and is in the process of establishing a cybersecurity governance committee. The cybersecurity governance committee will oversee the management's implementation of the cybersecurity risk management program.


text: management and strategy are an R&D stage pharmaceutical company, with no commercial operations or revenue streams. Since our IPO, our sole business activity has been ongoing research into our drug therapies. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted a formal cybersecurity risk management program or process for assessing cybersecurity risk currently.

stage1Method: majority


text: We recognize the critical importance of m aintaining the safety and security of our information technology systems and data and maintain a cybersecurity risk management program as a part of our overall risk management strategy that is focused on identifying, assessing and managing cybersecurity risks. We engage an Managed Services Provider ("MSP"), with a highly experienced and responsive staff including a virtual Chief Information Officer ("vCIO"), to assist us with the identification, monitoring and management of risks from cybersecurity threats. They assist us with our technology, infrastructure and risk management through the deployment of a number of security controls and tools. We also take steps to limit third-party vendors' access to our systems, and we are in the process of developing additional vendor risk management procedures.

companyName: Vivani Medical, Inc.

ticker: VANI


text: Risk Management and Strategy. The company's risk management programs for cybersecurity are integrated into the company's enterprise risk management and general compliance programs and processes.

companyName: Corteva, Inc.

ticker: CTVA


text: Cybersecurity Risk Management and Strategy We rely on information technology systems and data processing so that we or our service providers, collaborators, consultants, contractors or partners can operate to collect, process, transmit and store electronic information in our day-to-day operations. Our internal computer systems and data processing along with those of our third-party vendors, consultants, collaborators, contractors or partners may be vulnerable to risks from cybersecurity threats. To help manage these risks, we engage and rely on external experts, including an Information Technology MSP. We are also in the process of developing additional cybersecurity policies and procedures, as we continually work to enhance and evolve our program in light of the constantly evolving threats to our environment.


text: Our MSP assists us with our technology, infrastructure and risk management through the deployment of a number of security controls and tools, including, but not limited to, endpoint protection tools, phishing protection and access controls. We also take steps to limit third-party vendors' access to our systems, and we are in the process of developing additional vendor risk management procedures.


text: Aligning with various government and industry standards such as: National Institute of Standards and Technology ("NIST") Cybersecurity Framework, HIPAA, 21 CFR Part 11 and Sarbanes-Oxley ("SOX"), Conducting ongoing Security Awareness Training to keep employees informed of threats and how to spot them, Evaluating the cybersecurity policies of third-party vendors and service providers, Implementing redundant systems for mission critical operations, Developing and implementing Business Continuity/Disaster Recovery plans and procedures, and Ensuring robust protective measures such as: Email security including phishing protection Endpoint Security Perimeter Firewalls Physical Access controls Rapid Ransomware monitoring and recovery Multi-Factor Authentication Non-administrative computer access for typical users


text: Encryption of computing systems To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could affect our information or systems.


text: Governance Related to Cybersecurity Risks In addition to the services provided by our MSP, we have also formed an IT Steering Committee, whose members include representatives from our management team as well as our MSP, to review our cybersecurity program initiatives and related program metrics. Our IT Steering Committee provides cybersecurity updates and reports to our Audit Committee at each quarterly meeting or would report more frequently if there was a need to do so.


text: the critical importance of robust cybersecurity measures, the Company is committed to developing, implementing and maintaining measures to better safeguard our information systems and protect the confidentiality, integrity and availability of our data.

companyName: CoJax Oil & Gas Corp

ticker: CJAX

stage1Category: None/Other


text: Our management team actively evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs. To date, our operations or financial standing have not been materially impaired by any cybersecurity challenges. Looking ahead, the Company will mandate comprehensive cybersecurity training for both the Board and employees, covering key areas such as physical security of assets, data privacy and other information security policies and procedures.


text: Assessment and Strategy regularly evaluate cybersecurity risk from computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human error and technological errors. Such risks are reviewed by our management on a periodic basis as deemed appropriate.


text: e-mail services and cloud based storage systems offered by well-known reputable software and service providers which incorporate cybersecurity protections in their products.


text: use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect data necessary, the use of third-party security experts if and when an incident is detected.


text: The Chairs of the Cybersecurity Committee and the Audit Committee periodically update the full Board on specific committee-level topics and discussions. This enables the Board and its committees to coordinate the risk oversight role, particularly with respect to risk interrelationships.

companyName: Dynatrace, Inc.

ticker: DT


text: Our cybersecurity program utilizes a layered, defense-in-depth strategy to identify and mitigate cybersecurity threats. The company's information security team is responsible for the day-to-day management of the company's global information security program, which includes defining policies and procedures to safeguard our information systems and data, conducting vulnerability, threat and third-party information security assessments, information security event management (i.e., responding to ransomware and other cyber-attacks, business continuity and recovery), evaluating external cyber intelligence, supporting industry cybersecurity efforts and working with governmental agencies. The global information security team also develops training for personnel (e.g., employees and contractors) with access to Corteva's system to support adherence to the company's policies and procedures, along with increasing awareness of cyber-related risk. The personnel training includes, but is not limited to, mandatory onboarding training, phishing simulations with automated remediation training, table-top incident response exercises, and educational intranet posting and email campaigns.


text: Our Enterprise Risk Management Committee, which includes the company's Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), independently assesses and monitors the effectiveness of the company's cybersecurity risk management programs and strategies. The company's internal audit function also performs independent reviews and validation of the various programs, including policies and procedures as determined by their annual risk assessment.


text: The company leverages the U.S. Department of Commerce's National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("Framework") as the foundation of its global information security program. The NIST Framework provides standards, guidelines, and practices for organizations to better manage and reduce cybersecurity risk and is designed to foster risk and cybersecurity management communications amongst both internal and external organizational stakeholders. The company's information security team works with independent, third-party consultants annually to assess the maturity of the company's cybersecurity program within the NIST Framework and to develop strategic areas of focus for the company's programs commensurate with the company's business objectives.


text: As part of the company's global information security program, we leverage both internal and external assessments and partnerships with industry leaders to help approach information security company-wide. Additionally, the company maintains a comprehensive program that defines standards for the planning, sourcing, management, and oversight of third-party relationships and third-party access to its system, facilities, and/or confidential or proprietary data.


text: Cybersecurity incidents may create risk to the company that may impact its reputation, financial performance, ability to operate safely or at all, and the value of its intellectual property. Like most major corporations, the company is the target of industrial espionage, including cyberattacks, from time to time. The company has determined that these incidents have resulted, and could result in the future, in unauthorized parties gaining access to certain confidential business information. However, to date, Corteva has not experienced any known cybersecurity incidents that have materially affected the company, including the company's results of operations and financial condition, changes in the competitive environment, business operations and strategy. Although management does not believe that Corteva has experienced any material losses to date related to cybersecurity incidents, there can be no assurance that Corteva will not suffer such losses in the future. For more information on potential risk related to cybersecurity incidents, including intellectual property theft and operational disruption, please see "Item 1A – Risk Factors" of this report.


text: Governance. The company's Audit Committee and Governance and Compliance Committee provide board oversight of company cybersecurity risks. The Audit Committee conducts a minimum of two cybersecurity program updates per year, including a review of capital spend, budget, and staffing, as well as quarterly reports on cybersecurity threats and key risk indicators related to the company's progress on risk mitigation activities. The Governance and Compliance Committee, as part of its oversight for the enterprise risk management program company-wide, reviews and ensures that the company's oversight and governance structure related to company risks, including cybersecurity risks, remains appropriate and that risks are appropriately managed.


text: The company's CIO oversees the company's information technology programs and investments. The company's CISO reports to the CIO and oversees the company's information security programs. The company's CIO has over 30 years of information technology experience, including nine years in various information technology leadership roles. Our CIO holds a bachelor of science and master of science degrees in organizational communications as well as an M.B.A. in information technology. The company's CISO has over thirty years of experience in information security and is a Certified Information Security Manager (CISM), a Certified Data Privacy Solutions Engineer (CDPSE), as well as being Certified in Risk and Information Systems Control (CRISC). Our CISO holds a bachelor of science degree in electric engineering as well as an M.B.A. in operations, technology.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address the Company's cybersecurity threats and incidents. These efforts include a wide range of activities, including third-party annual penetration testing, internally managed weekly vulnerability testing, third-party compliance testing and ongoing internal testing and creation and modification of policies and procedures. The results of these assessments are reported at least annually to the Audit Committee and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and ongoing testing.

companyName: VINEBROOK HOMES TRUST, INC.


text: Both the CIO and CISO regularly report to the Audit Committee, Board and Governance and Compliance Committee, on the company's identification, prevention, detection, mitigation and remediation of cybersecurity risks and incidents. In 2023, the Board reviewed the company's cybersecurity program and maturity assessment, while the Audit Committee provided regular oversight of cybersecurity risks, with cybersecurity discussions and dashboard reviews of key performance indicators and risks at five committee meetings during the course of the year. With respect to specific incidents, the company leverages an incident response framework to elevate and evaluate specific incidents to the CIO and CISO, along with the company's senior leadership, including the finance and legal functions. In the event of a potentially material cybersecurity incident, the Audit Committee would be immediately notified and briefed.


text: Both the CIO and CISO regularly report to the Audit Committee, Board and Governance and Compliance Committee, on the company's identification, prevention, detection, mitigation and remediation of cybersecurity risks and incidents. In 2024, the Board reviewed the company's cybersecurity program and maturity assessment, while the Audit Committee provided regular oversight of cybersecurity risks, with cybersecurity discussions and dashboard reviews of key performance indicators and risks at five committee meetings during the course of the year. With respect to specific incidents, the company leverages an incident response framework to elevate and evaluate specific incidents to the CIO and CISO, along with the company's senior leadership, including the finance and legal functions. In the event of a potentially material cybersecurity incident, the Audit Committee would be immediately notified and briefed.


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. As the historic external property manager of the VineBrook Portfolio and a current subsidiary that engages in property management functions and employes the majority of our employees, we maintain cybersecurity policies, standards, processes and practices at the Manager that cover our 24 office locations and over 550 employees. In general, we seek to address cybersecurity risks of the Company through a comprehensive, cross-functional approach that is focused on continually assessing our information systems to detect, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.


text: As one of the critical elements of our overall risk management, our cybersecurity program is focused on the following key areas:


text: Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with our management and the Chief Technology Officer of the Manager that implement and oversee our cybersecurity program.


text: Risk Assessment: No less frequently than annually, we complete an assessment to identify potential cybersecurity threats and vulnerabilities to better prioritize and mitigate our cybersecurity risk. The assessment includes, among other things, evaluating the nature, sensitivity and location of information the Company collects, processes and stores and the resiliency of the underlying technologies, the validity and effectiveness of the Company's security policies, controls and processes and the cybersecurity preparedness of the third-party vendors used by the Company. We complete internally managed weekly vulnerability testing. To supplement our internal assessment, we also engage third-party consultants to assess system configurations through configuration review and annual penetration testing.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, multi-factor single-sign on authentication for all employees into line of business applications, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: We have established and maintains comprehensive business continuity plans that address potential impacts should the information or technology systems become compromised, and such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including key vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. This includes robust reviews with our technology partners who provide the commercial off the shelf software applications we rely on from, among others, Yardi, SalesForce and UKG.

stage1Category: Third-Party Risk


text: Education and Awareness: We provide regular, mandatory training for our employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. In addition, we provide end user education on various cybersecurity related topics through a partnership with our human resources team.


text: The Audit Committee oversees the Company's risk management policies, including the management of risks arising from cybersecurity threats. The Audit Committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including annual assessments of internal and third-party policies, vulnerability assessments, technological trends and information security considerations arising with respect to the Company. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with our management, including the Chief Technology Officer of the Manager.


text: The Chief Technology Officer of the Manager, in coordination with relevant senior management, which includes the Director of IT Operations and General Counsel of the Manager, work to conceive, implement, and monitor the effectiveness of a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any security incidents in accordance with the Company's business continuity plan. To ensure the effectiveness of these controls, our technology team continually monitors, hardens, and evolves systems' security postures to model and mirror various security frameworks. The Chief Technology Officer of the Manager will promptly notify the General Counsel of the Manager, the General Counsel of the Adviser and senior management, including our President, Senior Vice President of Acquisition & Dispositions and Senior Vice President of Asset Management, of any cybersecurity events, with material cybersecurity events promptly communicated to the Audit Committee and publicly disclosed as deemed necessary.


text: The Chief Technology Officer of the Manager has served in various roles in information technology and information security for over 30 years, including as one of the original architects of the business, operations, systems and information technology infrastructure in the institutional SFR homes sector with large investors in the VineBrook Companies since 2010. The Chief Technology Officer of the Manager holds an undergraduate degree in computer science/programming and a masters degree in business administration (MBA). In addition, he has been an educator, speaker, and published author on several technology related topics including cybersecurity, artificial intelligence, machine learning, geographic information systems, database architecture, and business intelligence. The Director of IT Operations of the Manager has over 25 years of experience in network designs, information technology operations management and cybersecurity and has completed various certifications from Microsoft, Fortinet, Qualys, Agile, Kaseya, Veeam, and CompTIA. In addition to our cybersecurity policies, standards, processes and practices, our Adviser maintains cybersecurity policies, standards, processes and practices that are based on recognized security frameworks such as the National Institute of Standards and Technology cybersecurity framework and the Azure Security Benchmark. Our Adviser deploys technical safeguards that are designed to protect our Adviser's information systems from cybersecurity threats and completes internal and external assessments to identify potential cybersecurity threats and vulnerabilities and to identify and oversee cybersecurity risks presented by third parties. The Adviser's Director of Information Technology, in coordination with relevant personnel of the Adviser, work to conceive, implement, and monitor the effectiveness of a program designed to protect their information systems from cybersecurity threats and to promptly respond to any security incidents. The Adviser's Director of Information Technology will promptly notify the Adviser's General Counsel and senior management, including our President, of any cybersecurity events, with material cybersecurity events promptly communicated to the Audit Committee and publicly disclosed as deemed necessary.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. See Item 1A. "Risk Factors—Risks Related to Our Business and the Single-Family Rental Housing Market—We are highly dependent on information systems and systems failures could significantly disrupt our business" and "Security breaches and other disruptions could compromise our information systems and expose us to liability, which would cause our business and reputation to suffer."


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. As the historic external property manager of the VineBrook Portfolio and a current subsidiary that engages in property management functions and employs the majority of our employees, we maintain cybersecurity policies, standards, processes and practices at the Manager that cover our 20 physical office locations and over 525 employees. In general, we seek to address cybersecurity risks of the Company through a comprehensive, cross-functional approach that is focused on continually assessing our information systems to detect, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.


text: Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with our Adviser's Director of Information Technology, our management and the Interim Chief Technology Officer of the Manager that implement and oversee our cybersecurity program.


text: Risk Assessment: No less frequently than annually, we complete an assessment to identify potential cybersecurity threats and vulnerabilities to better prioritize and mitigate our cybersecurity risk. The assessment includes, among other things, evaluating the nature, sensitivity and location of information the Company collects, processes and stores and the resiliency of the underlying technologies, the validity and effectiveness of the Company's security policies, controls and processes and the cybersecurity preparedness of the third-party vendors used by the Company. We complete internally managed weekly vulnerability testing and monthly penetration testing. To supplement our internal assessment, we also engage third-party consultants to assess system configurations through configuration review and annual penetration testing.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, multi-factor authentication, and single-sign on for all employees required to access line of business applications, intrusion prevention and detection systems, anti-malware functionality and access controls. Our technical safeguards are evaluated and improved through the use of first and third party vulnerability assessment tools and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: We have established and maintained an incident response process and have associated policies in place. As of the date of this filing, we are undertaking an update to our network and system and as such our incident response plan is being updated.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including key vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. This includes reviews with our technology partners who provide the commercial off the shelf software applications we rely on to deliver business services.


text: Education and Awareness: We work in partnership with our human resources team to provide mandatory training for our employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address the Company's cybersecurity threats and incidents. These efforts include a wide range of activities, including third-party annual penetration testing, internally managed weekly vulnerability testing and monthly penetration testing, third-party compliance testing and ongoing internal testing and creation and modification of policies and procedures. The results of these assessments are reported at least annually to the Audit Committee and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and ongoing testing.


text: The Audit Committee oversees the Company's risk management policies, including the management of risks arising from cybersecurity threats. The Audit Committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including annual assessments of internal and third-party policies, vulnerability assessments, technological trends and information security considerations arising with respect to the Company. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with our management and the Director of Information Technology of our Adviser.


text: The Interim Chief Technology Officer of the Manager, in coordination with relevant senior management, including but not limited to the Director of IT Operations, Information Security Manager, and General Counsel of the Manager and the Director of Information Technology of the Adviser, work to define, implement, and monitor the effectiveness of a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any security incidents in accordance with the Company's incident response plan. To ensure the effectiveness of the relevant controls, our technology team monitors, updates, and evolves systems' security postures to align to controls defined in the NIST Cybersecurity Framework. The Interim Chief Technology Officer of the Manager will promptly notify the Director of Information Technology of our Adviser, who will then notify the General Counsel of the Adviser and our President and Chief Executive Officer, of any cybersecurity events, with material cybersecurity events promptly communicated to the Audit Committee and publicly disclosed as deemed necessary.


text: The Interim Chief Technology Officer of the Manager has served in various roles in information technology and information security over the previous 30 years, holding company officer roles for both private and publicly traded companies including Chief Information Officer, Chief Security Officer, Chief Information Security Officer and Chief Technology Officer. The Chief Technology Officer of the Manager holds numerous security and technology credentials maintained in good standing including Certified Information Systems Security Professional (CISSP), as well as holding in good standing specialized security operations and data privacy credentials including ISACA Certified Information Security Manager (CISM) and IAPP Certified Information Privacy Manager (IAPP CIPM).


text: Our Senior Director of Information Security reports to our Chief Information Officer and is responsible for leading our enterprise-wide information security team. The team focuses on developing and implementing strategies, processes and response plans to protect the confidentiality, integrity, and availability of our assets. Our Senior Director of Information Security has prior experience as a chief information security officer and over 25 years of experience in Technology and Security. Our security team also includes members who maintain industry security certificates. Our team is additionally supported by third parties to assist in the operations of our program, compliance audits and security penetration testing.

companyName: Envista Holdings Corp

ticker: NVST


text: The Adviser's Director of Information Technology has served in various roles in information technology and information security for 25 years, including serving as Global Technology Manager at a multi-national publicly traded broker-dealer, and 15 years as the Director of Information Technology at a privately held financial services firm. The Adviser's Director of Information Technology holds an undergraduate degree in biochemistry and has attained numerous information technology certifications over the years including Microsoft Certified Systems Engineer (MCSE) and Cisco Certified network Professional (CCNP). The Adviser's Senior Infrastructure Engineer has over 20 years industry experience, holds an undergraduate degree in radiology, and has completed various Microsoft related information technology certifications. Combined, our Adviser's information technology team has over 50 years of experience covering all major aspects of network architecture and management. In addition to our cybersecurity policies, standards, processes and practices, our Adviser maintains cybersecurity policies, standards, processes and practices that are based on recognized security frameworks such as the National Institute of Standards and Technology cybersecurity framework and the Azure Security Benchmark. Our Adviser deploys technical safeguards that are designed to protect our Adviser's information systems from cybersecurity threats and completes internal and external assessments to identify potential cybersecurity threats and vulnerabilities and to identify and oversee cybersecurity risks presented by third parties. The Adviser's Director of Information Technology, in coordination with relevant personnel of the Adviser, works to conceive, implement, and monitor the effectiveness of a program designed to protect their information systems from cybersecurity threats and to promptly respond to any security incidents.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and we do not believe are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. See Item 1A. "Risk Factors, Risks Related to Our Business and the Single-Family Rental Housing Market, We are highly dependent on information technology and security breaches or systems failures could significantly disrupt our business" and "Breaches of our data security could materially harm our business and reputation."


text: Cyber threats are considered one of the most significant risks facing financial institutions. Since our company is externally managed, we rely upon the operational and investment risk oversight functions of our Adviser and its affiliates. To mitigate risk from cyber threats, our Adviser has a designated Global Chief Security Officer ("GCSO") who leads the global security department that is responsible for identifying, assessing and managing cybersecurity threats. The GCSO has experience in the public and private sectors, specializing in security, investigations and incident response. The global security department oversees the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, and Corporate Security. This converged security structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees and critical assets safe, upholding privacy rights, while enabling a secure and resilient business.

companyName: Invesco Real Estate Income Trust Inc.


text: Our Adviser's information security program is led by its Chief Information Security Officer ("CISO") who reports directly to the GCSO and has extensive experience in specializing in information security and risk management. Our Adviser's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets.


text: Our Adviser's cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or third-party incident. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness against cyber phishing threats.


text: Important to these programs is our Adviser's investment in threat-intelligence, its active engagement in industry and government security-related forums, and its utilization of external experts to challenge its program maturity, assess its controls and routinely test its capabilities.


text: Our board of directors oversees cybersecurity risk and receives updates, at a minimum, twice a year from the CISO (or designee) regarding cybersecurity, which updates include a review of our Adviser's global security program and cybersecurity, including risks and protections for us and our Adviser. The Global Operational Risk Management Committee, one of our Adviser's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. In addition, the CISO provides quarterly updates to our company's enterprise risk management committee, which in turn provides quarterly updates to our board of directors, and members of our management team are included in our Adviser's incident response process in the event a cyber security incident occurs that could materially impact us.


text: As of December 31, 2023, we have not experienced any cyber incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: The deployment of updates and patches as they are available and maintaining the current versions of major software to reduce the exposure to vulnerabilities. If necessary, the use of third-party security experts if and when an incident is detected.

companyName: SOLESENCE, INC.

ticker: SLSN


text: Cyber threats are considered one of the most significant risks facing financial institutions. Since our company is externally managed, we rely upon the operational and investment risk oversight functions of our Adviser and its affiliates. To mitigate risk from cyber threats, our Adviser has a designated Global Chief Security Officer ("GCSO") who leads its global security department, which is responsible for identifying, assessing and managing cybersecurity threats. The GCSO has experience in the public and private sectors, specializing in security, investigations and incident response. The global security department oversees, among other things, the following groups across Invesco: Information Security, Strategic Intelligence, Corporate Security, Business Continuity, Crisis Management, Global Privacy Office, Business Security, Projects and Strategy This structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees and critical assets safe, upholding privacy rights, and enabling a secure and resilient business.


text: Our Adviser's information security program is led by its Chief Information Security Officer ("CISO") who reports directly to the GCSO and has extensive experience in information security and risk management. Our Adviser's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets.


text: Our Adviser's cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or a third-party. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness of cyber phishing threats.


text: Our board of directors oversees cybersecurity risk and receives updates, at a minimum, twice a year from the CISO (or designee) regarding cybersecurity, which updates include a review of our Adviser's global security program and cybersecurity, including risks and protections for us and our Adviser. The Global Operational Risk Management Committee, one of our Adviser's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. In addition, the CISO provides quarterly updates to our enterprise risk management committee, which in turn provides quarterly updates to our board of directors, and members of our management team are included in our Adviser's incident response process in the event a cybersecurity incident occurs that could materially impact us.


text: As of December 31, 2024, we have not experienced any cyber incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: We are committed to protecting our information assets and systems. We have an enterprise-wide information security program designed to identify, protect against, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. We have installed privacy/security protection systems and devices on our network in an attempt to prevent cyberthreats and other unauthorized access to information.


text: We have adopted a comprehensive Information Security Policy applicable to all of our employees and business partners. We also maintain a Global Security Incident Response Plan ("GSIRP") to ensure we remain prepared in the event of a cyberattack or other form of network penetration. Our GSIRP is a cross functional plan that documents the details and decision-making process required during a response to a security incident, as well as the reporting protocol with clear escalation timelines and responsibilities. We test our GSIRP with tabletop exercises administered by a third party security consultant. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cyber issues.


text: Like most multinational corporations, our information technology systems have been subject to computer viruses, malicious codes, unauthorized access and other cyberattacks, and we expect the sophistication and frequency of such attacks to continue to increase. To date, no attempted cyberattack or other attempted intrusion on our information technology networks has resulted in a material adverse impact on our business strategy, results of operations or financial condition. There can be no assurance that future incidents will not materially affect us, including our business strategy, results of operations or financial condition. Please refer to "Item 1A. Risk Factors—Risks Related to Our Business" for further detail about the material cybersecurity risks we face.


text: We evaluate and manage risks relating to cybersecurity as part of our overall enterprise risk management program. We perform an annual assessment across the Company to identify and review potential risks. Risks are prioritized based on threat models to improve cybersecurity throughout the Company. Our Board of Directors oversees our enterprise risk management program.


text: The Audit Committee of our Board of Directors has the responsibility of exercising oversight with respect to our cybersecurity risk management and risk controls. Our Chief Information Officer provides periodic reports to the Audit Committee regarding our cybersecurity program, including our information risk management and oversight, security education and training, cyber threat detection and response processes, and relevant internal and industry cybersecurity attacks. The Board also receives a report out on cybersecurity issues and governance at least annually, with periodic updates as needed.


text: Risk Management and Strategy We are committed to taking action to protect our information assets and systems. We have an enterprise-wide information security program designed to identify, protect against, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats, including those associated with our use of third-party service providers. We have installed privacy/security protection systems and devices on our network in an attempt to prevent cyberthreats and other unauthorized access to information. Additionally, we conduct security risk assessments prior to engaging third party suppliers and other vendors and business partners to validate that they maintain appropriate safeguards to protect our and their information systems in connection with services they provide. This risk assessment is heightened with respect to vendors or business partners that have access to our critical systems and information.


text: We have adopted an Information Security Policy applicable to all of our employees and business partners. We provide security awareness education and training for our employees annually, conduct regular internal "phishing" testing and mandatory training for "clickers," and publish internal alerts to highlight any emerging or urgent security threats. We also maintain a Global Security Incident Response Plan ("GSIRP") to guide our response in the event of a cyberattack or other form of network penetration. Our GSIRP is a cross functional plan that documents the details and decision-making processes required during a response to a security incident, as well as the reporting protocol with escalation timelines and responsibilities. We test our GSIRP with tabletop exercises administered by a third party security consultant. We leverage the standards set by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as well as industry best practices to measure our security posture and manage risk. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cyber issues, although our insurer may deny coverage for a future claim or our insurance coverage may be insufficient to cover all losses from a cyberattack.


text: We evaluate and manage risks relating to cybersecurity as part of our overall enterprise risk management program. We perform an annual assessment across the Company to identify and review potential risks. Risks are prioritized based on threat models to improve cybersecurity throughout the Company.


text: Cybersecurity Governance Our Senior Director of Information Security reports to our Chief Information Officer and is responsible for leading our enterprise-wide information security team. The team focuses on developing and implementing strategies, processes and response plans to protect the confidentiality, integrity, and availability of our assets. Our Senior Director of Information Security has prior experience as a chief information security officer and over 25 years of experience in Technology and Security. Our security team also includes members who maintain industry security certificates. Our team is additionally supported by third parties to assist in the operations of our program, compliance audits and security penetration testing.


text: Our Board of Directors oversees our enterprise risk management program. The Audit Committee of our Board of Directors has the responsibility of exercising oversight with respect to our cybersecurity risk management and risk controls. Our Chief Information Officer provides periodic reports to the Audit Committee regarding our cybersecurity program, including our information risk management and oversight, security education and training, cyber threat detection and response processes, and relevant internal and industry cybersecurity attacks. The Board also receives a report out on cybersecurity issues and governance at least annually, with periodic updates as needed. Board members receive periodic presentations on cybersecurity topics from our Chief Information Officer and external experts as part of the Board's continuing education on topics that impact public companies.


text: Material Cybersecurity Risks, Threats, and Incidents Like most multinational corporations, our information technology systems have been subject to computer viruses, malicious codes, unauthorized access and other cyberattacks, and we expect the sophistication and frequency of such attacks to continue to increase. For example, during the second half of 2023, one of our largest distributors experienced a cybersecurity incident which impacted their ability to place orders and consequently impacted the timing of orders received. This incident, however, as well as other cyberattacks to date, did not have a material impact on our business strategy, results of operations or financial condition. There can be no assurance that future incidents will not materially affect us, including our business strategy, results of operations or financial condition. Please refer to "Item 1A. Risk Factors—Risks Related to Our Business" for further detail about the material cybersecurity risks we face.


text: Cybersecurity Risk Management and Strategy At STERIS, the enterprise risk management ("ERM") program is designed to identify, assess, and manage risks across STERIS's enterprise. Cybersecurity risk management is integrated into STERIS's ERM program, under which we regularly assess cybersecurity risks in accordance with what we believe are industry cybersecurity best practices. Further, we implement controls to protect the confidentiality, integrity and availability of STERIS's information systems and information. We maintain cybersecurity and incident response procedures to address our security standards and requirements and provide a framework for assessing and responding to cybersecurity threats and incidents. Additionally, as part of our ERM program, STERIS oversees and identifies risks associated with third-party service providers with whom we do business, which process includes due diligence, risk management assessments and contractual safeguards. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cybersecurity issues.

companyName: STERIS plc

ticker: STE


text: STERIS has an Executive Cybersecurity Steering Committee consisting of the Senior Vice President & Chief Financial Officer, the Vice President, Chief Accounting Officer, the Vice President, Investor Relations & Corporate Communications, the Vice President & Chief Information Officer ("CIO"), the Vice President, Chief Compliance Officer, the Senior Vice President, General Counsel & Company Secretary, and the Chief Information Security Officer ("CISO") that is responsible for providing governance, risk and compliance oversight for STERIS's incident response program, providing guidance and support for cybersecurity non-technical initiatives, and for verifying that appropriate actions are taken following an incident occurrence. We have adopted and maintain an incident response policy that covers our incident response program and the duties and responsibilities of our Incident Response Team ("IRT") responsible for managing and responding to cybersecurity incidents, including data breaches. Our IRT is led by the CISO and is comprised of senior management and others, including external resources, as required. Our incident response policy includes steps for detecting and investigating cybersecurity incidents, assessing the nature, scope, and severity of cybersecurity threats, identifying the impact of cybersecurity incidents, communicating cybersecurity incident disclosures, and implementing cybersecurity countermeasures and mitigation strategies.


text: A subcommittee of our IRT reviews and assesses associated public reporting implications of cybersecurity incidents. Our process also includes informing the Board of Directors and the Audit Committee following a material cybersecurity incident.


text: We engage third-party security experts to support our risk assessment activities and to provide system security enhancements. Our program includes regular vulnerability and penetration testing (internal and external) of our enterprise systems by independent external security experts.


text: Education and awareness training on information security and data protection is conducted regularly for Associates. Members of the IRT, the Executive Cybersecurity Steering Committee and the Board of Directors receive additional training on responding to cybersecurity incidents.


text: Our Board of Directors has oversight responsibility for the ERM program, and delegates the risk management assessment and risk management approach, including risks related to cybersecurity, to its Audit Committee. Among other responsibilities, the Audit Committee is responsible for monitoring internal controls, including those related to cybersecurity risk.


text: Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to monitor such potential cybersecurity risk exposures, putting in place appropriate mitigation measures and maintaining the cybersecurity program. Our cybersecurity program for our information systems is directed by our CIO and, with the cybersecurity team, our CIO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO is CISSP-ISSMP and CISM certified and is part of a team of experienced information system security professionals with diverse certifications, including CISSP, CISM, CNSS, CEH, CySA+, CompTIA - Security+, CySA+, PenTest+, and CASP+ and others. Management, including the CIO and CISO, update the Audit Committee on a regular basis on our cybersecurity program, material cybersecurity risks, mitigation strategies, cybersecurity metrics, developments in cybersecurity and proposed updates to our cybersecurity program.


text: In fiscal year 2024, STERIS did not experience any cyberattack or other attempted intrusion or other incident with respect to our information systems that materially affected or was likely to materially affect our business strategy, results of operations, financial condition or cash flows. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced or will not experience in the future undetected cybersecurity incidents. For more information about these risks, please see "Item 1A Risk Factors" in this annual report on Form 10-K.


text: Risk Management and Strategy We operate in an environment where cybersecurity risks is a dynamic and evolving factor. We are committed to appropriately managing and minimizing the impact of cybersecurity risk on the achievement of our business objectives. We view cybersecurity risk management as a fundamental business process essential to our overall success. As such, we have integrated our cybersecurity program into our comprehensive Risk Framework, which is in place to support the management and oversight of risk across our organization. The Risk Framework establishes a consistent approach for identifying, assessing, measuring, mitigating, and reporting on material risks, including cybersecurity risks. The Risk Framework is composed of process components such as risk governance, risk identification and assessment, risk measurement, risk response and remediation and risk analysis and reporting.

companyName: Tradeweb Markets Inc.

ticker: TW


text: Cybersecurity Risk Management and Strategy At STERIS, the ERM program is designed to identify, assess, and manage risks across STERIS's enterprise. Cybersecurity risk management is integrated into STERIS's ERM program, under which we regularly assess cybersecurity risks in accordance with what we believe are industry cybersecurity best practices. Further, we implement controls to protect the confidentiality, integrity and availability of STERIS's information systems and information. We maintain cybersecurity and incident response procedures to address our security standards and requirements and provide a framework for assessing and responding to cybersecurity threats and incidents. Additionally, as part of our ERM program, STERIS oversees and identifies risks associated with third-party service providers with whom we do business, which process includes due diligence, risk management assessments and contractual safeguards. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cybersecurity issues.


text: STERIS has an Executive Cybersecurity Steering Committee consisting of the Senior Vice President & Chief Financial Officer, the Vice President, Chief Accounting Officer, the Vice President, Investor Relations & Corporate Communications, the Vice President & Chief Information Officer ("CIO"), the Vice President, Chief Compliance Officer, the Senior Vice President, General Counsel & Company Secretary, and the Vice President, Chief Information Security Officer ("CISO") that is responsible for providing governance, risk and compliance oversight for STERIS's incident response program, providing guidance and support for cybersecurity non-technical initiatives, and for verifying that appropriate actions are taken following an incident occurrence. We have adopted and maintain an incident response policy that covers our incident response program and the duties and responsibilities of our Incident Response Team ("IRT") responsible for managing and responding to cybersecurity incidents, including data breaches. Our IRT is led by the CISO and is comprised of senior management and others, including external resources, as required. Our incident response policy includes steps for detecting and investigating cybersecurity incidents, assessing the nature, scope, and severity of cybersecurity threats, identifying the impact of cybersecurity incidents, communicating cybersecurity incident disclosures, and implementing cybersecurity countermeasures and mitigation strategies. A subcommittee of our IRT reviews and assesses associated public reporting implications of cybersecurity incidents. Our process also includes informing the Board of Directors and the Audit Committee following a material cybersecurity incident.


text: Education and awareness training on information security and data protection is conducted regularly for employees. Members of the IRT, the Executive Cybersecurity Steering Committee and the Board of Directors receive additional training on responding to cybersecurity incidents.


text: Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to monitor such potential cybersecurity risk exposures, putting in place appropriate mitigation measures and maintaining the cybersecurity program. Our cybersecurity program for our information systems is directed by our CIO and, with the cybersecurity team, our CIO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CIO has a Bachelor of Science in Computer Engineering, a Master of Business Administration, and over 35 years of experience working in the information technology field, including approximately 20 years of CIO positions. Our CISO is CISSP-ISSMP and CISM certified and is part of a team of experienced information system security professionals with diverse certifications, including CISSP, CISM, CNSS, CEH, CySA+, CompTIA - Security+, CySA+, PenTest+, and CASP+ and others. Management, including the CIO and CISO, update the Audit Committee on a regular basis on our cybersecurity program, material cybersecurity risks, mitigation strategies, cybersecurity metrics, developments in cybersecurity and proposed updates to our cybersecurity program.


text: In fiscal year 2025, STERIS did not experience any cyberattack or other attempted intrusion or other incident with respect to our information systems that materially affected or was likely to materially affect our business strategy, results of operations, financial condition or cash flows. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced or will not experience in the future undetected cybersecurity incidents. For more information about these risks, please see "Item 1A Risk Factors" in this annual report on Form 10-K.


text: As a leader in building and operating electronic marketplaces, we face a broad set of cybersecurity risks stemming from managing complex technology systems, handling sensitive data, and the digital nature of our business. Managing cybersecurity risk is critically important to our business. We have comprehensive cybersecurity risk management and governance systems in place across our global operations designed to support successful operation of our systems.


text: We maintain a cyber risk management program that is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The design of our program is based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework.

companyName: STEM, INC.

ticker: STEM


text: The general objectives for our cybersecurity program are to protect our information systems from cyber threats and to protect the confidentiality, integrity and availability of systems and information used, owned, or managed by Tradeweb and our customers. This involves a comprehensive and ongoing effort to protect against, detect, and respond to cybersecurity threats and vulnerabilities. Our cybersecurity program includes a number of components, such as: • conducting regular risk assessments to identify potential vulnerabilities and threats; • implementing strong cybersecurity frameworks by adopting policies, standards and guidelines derived from a combination of ISO/IEC 27001 principles, the National Institute of Standards and Technology Cybersecurity Framework and industry best practices; • enforcing strict access control policies as appropriate; • implementing strong encryption protocols; • utilizing advanced threat detection systems; • conducting regular security audits and penetration testing; • conducting thorough security assessment of third-party vendors and service providers on an ongoing basis; and • continuous monitoring of our and third-party systems.


text: As part of our cybersecurity program, we have robust incident response and business continuity plans designed to provide a framework for quick and effective remediation of cyber issues, which are tested periodically throughout the year. Additionally, we have worked to create a culture of security by providing regular cybersecurity training to employees to raise awareness about various cyber threats like phishing, social engineering, and insider threats. We provide additional targeted training to individuals responsible for managing our information systems. We also maintain cyber insurance coverage intended to mitigate certain costs associated with certain cybersecurity events.


text: In addition, each year, we undergo System and Organization Controls ("SOC") 1 and SOC 2 audit reviews performed by an independent third-party firm to test our information technology systems internal controls. In 2023, we also engaged a third-party service provider to conduct a cybersecurity maturity assessment of our information security program. We also regularly engage additional assessors, auditors and service providers in connection with the implementation, assessment, enhancement and evaluation of our cybersecurity program, including our risk management processes.


text: We have not been a victim of a cyber-attack or other cybersecurity incident that has had a material impact on us, our business strategy, results of operations or financial condition; however, we have from time to time experienced non-significant cybersecurity events, including attempted denial of service attacks, malware infections, phishing and other information technology events that are typical for an electronic financial services company of our size. An actual, threatened or perceived cyber-attack or breach of our security could materially affect us, including our business strategy, results of operations and financial condition in many ways, including through the loss of clients or client confidence, expenditure of significant costs to repair system, network or infrastructure damages as well as to protect against future cyber-attacks, security breaches or harm and potential litigation or other claims or actions, including from regulatory agencies. For additional information regarding risks related to cybersecurity threats, see Part I, Item 1A. – "Risk Factors — Risks Relating to Cybersecurity and Intellectual Property — Actual or perceived security vulnerabilities in our systems, networks and infrastructure, breaches of security controls, unauthorized access to confidential or personal information or cyber-attacks could harm our business, reputation and results of operations" and "— Systems failures, interruptions, delays in service, catastrophic events and resulting interruptions in the availability of our platforms or solutions could materially harm our business and reputation."


text: Role of our Board of Directors The Board of Directors of Tradeweb Markets Inc. exercises direct oversight of the strategic risks to the Company. The Audit Committee of the Board reviews guidelines and policies governing the process by which senior management assesses and manages our exposure to risk, including our major financial and operational risk exposures including those derived from cybersecurity risk, and the steps management takes to monitor and control such exposures. Our Board and our Audit Committee each receive periodic reports from our Chief Information Security Officer and Chief Risk Officer to assess key cybersecurity risks for the Company and the measures implemented to mitigate them, as well as updates regarding changes to our cybersecurity risk profile or newly identified significant risks. In addition, the Audit Committee reports to the Board on these matters at each regularly scheduled Board meeting. The Board and Audit Committee provide feedback and recommendations accordingly.


text: Role of Management We operate on a "three lines of defense" risk governance model, with partnership and communication across the three lines. The first line of defense is comprised of the business and technology managers, the second line of defense is comprised of the Compliance, Risk and Information Security teams and the third line of defense is comprised of the Internal Audit function. The second and third lines of defense focus on providing the first line of defense with advisory and assurance functions for informed and actionable risk-based decisions. The Enterprise Risk Committee (the "ERC") is chaired by our Chief Risk Officer and includes our President, Chief Technology Officer, General Counsel, Global Head of Enterprise Risk, Chief Information Security Officer, Head of Global Compliance, Global Head of Human Resources, Head of Internal Audit and various global heads of business lines and corporate functions. The ERC is responsible for the governance and oversight of our Risk Framework, which includes cybersecurity risks. Its responsibilities include, supervising risk mitigation strategies and their implementation, overseeing compliance and regulatory aspects, managing crisis, approving risk tolerance, reviewing and approving material policy changes and evaluating the effectiveness of the organization's risk management practices. The ERC regularly obtains reports from the Chief Information Security Officer who maintains the primary responsibility for assessing and managing the cybersecurity risks, to evaluate the principal cybersecurity risks for the Company and review strategies in place to mitigate them. The ERC meets quarterly and reports to senior management, including the Chief Executive Officer and Chief Financial Officer. Senior management provides oversight and support in aligning cyber risk management with the Company's strategic decisions, fostering a culture of risk awareness across the organization and allocating adequate resources to support the initiatives.


text: From time to time, the CISO and other members of our executive leadership team discuss cybersecurity-related matters with the full Board at its scheduled meetings. Outside of scheduled meetings, management also periodically notifies or updates the Cybersecurity Committee or the Board, as appropriate, regarding certain types of cybersecurity incidents and matters.


text: Our Chief Information Security Officer leads a highly qualified cybersecurity team in assessing, managing and reducing material risks from cybersecurity threats to protect critical operations and delivery of service. Our Chief Information Security Officer has over 25 years of industry experience, with more than a decade of CISO experience at various financial institutions. Many members of the cybersecurity team hold Certified Information Systems Security Professional and Certified Information Systems Auditor certifications. In addition, our Global Head of Enterprise Risk has over a decade of experience managing enterprise risk programs and maintains multiple information security certifications. We also belong to several professional and recognized industry organizations related to cybersecurity, including FS-ISAC, FCA Cyber Coordination Group and SIFMA in order to stay up-to-date on industry-wide trends.


text: Risk Management and Strategy We operate in an environment where cybersecurity risk is dynamic and evolving. We are committed to appropriately managing and minimizing the impact of cybersecurity risk on the achievement of our business objectives. We view cybersecurity risk management as a fundamental business process essential to our overall success. As such, we have integrated our cybersecurity program into our comprehensive Risk Framework, which is in place to support the management and oversight of risk across our organization. The Risk Framework establishes a consistent approach for identifying, assessing, measuring, mitigating, and reporting on material risks, including cybersecurity risks. The Risk Framework is composed of process components such as risk governance, risk identification and assessment, risk measurement, risk response and remediation and risk analysis and reporting.


text: The general objectives for our cybersecurity program are to protect our information systems from cyber threats and to protect the confidentiality, integrity and availability of systems and information used, owned, or managed by Tradeweb and our customers. This involves a comprehensive and ongoing effort to protect against, detect, and respond to cybersecurity threats and vulnerabilities. Our cybersecurity program includes a number of components, such as: • conducting regular risk assessments to identify potential vulnerabilities and threats; • implementing strong cybersecurity frameworks by adopting policies, standards and guidelines derived from a combination of ISO/IEC 27001 principles, the National Institute of Standards and Technology Cybersecurity Framework and industry best practices; • enforcing strict access control policies as appropriate; • implementing strong encryption protocols; • utilizing advanced threat detection systems; • conducting regular security audits and penetration testing; • conducting thorough security assessments of third-party vendors and service providers on an ongoing basis; and • continuous monitoring of our and third-party systems.


text: In addition, each year, we undergo System and Organization Controls ("SOC") 1 and SOC 2 audit reviews performed by an independent third-party firm to test our information technology systems internal controls. We also regularly engage additional assessors, auditors and service providers in connection with the implementation, assessment, enhancement and evaluation of our cybersecurity program, including our risk management processes.


text: We have not been a victim of a cyber attack or other cybersecurity incident that has had a material impact on us, our business strategy, results of operations or financial condition; however, we have from time to time experienced non-significant cybersecurity events, including attempted denial of service attacks, malware infections, phishing, subversion of internal security controls and other information technology events that are typical for an electronic financial services company of our size. An actual, threatened or perceived cyber attack or breach of our security could materially affect us, including our business strategy, results of operations and financial condition in many ways, including through the loss of clients or client confidence, expenditure of significant costs to repair system, network or infrastructure damages as well as to protect against future cyber attacks, security breaches or harm and potential litigation or other claims or actions, including from regulatory agencies. These risks extend to the third parties we rely on to provide certain services, including technology services, to us. Please see Part I, Item 1A. —"Risk Factors—Risks Relating to the Operation and Performance of Our Business—We rely on third parties to perform certain key functions, and their failure to perform those functions could result in the interruption of our operations and systems and could result in significant costs and reputational damage to us." For additional information regarding risks related to cybersecurity threats, see also Part I, Item 1A. – "Risk Factors — Risks Relating to Cybersecurity and Intellectual Property Actual or perceived security vulnerabilities in our systems, networks and infrastructure, breaches of security controls, unauthorized access to confidential or personal information or cyber attacks could harm our business, reputation and results of operations" and "— Systems failures, interruptions, delays in service, catastrophic events and resulting interruptions in the availability of our platforms or solutions could materially harm our business and reputation."


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional service firms such as legal counsel, threat intelligence providers, cybersecurity consultants and software providers, penetration testing services, and other third-party service providers including for identity management solutions.

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: Role of our Board of Directors The Board of Directors of Tradeweb Markets Inc. exercises direct oversight of the strategic risks to the Company. The Audit and Risk Committee of the Board reviews guidelines and policies governing the process by which senior management assesses and manages our exposure to risk, including our major financial and operational risk exposures including those derived from cybersecurity risk, and the steps management takes to monitor and control such exposures. Our Board and our Audit and Risk Committee each receive periodic reports from our Chief Information Security Officer, Chief Risk Officer and Chief Administrative Officer to assess key cybersecurity risks for the Company and the measures implemented to mitigate them, as well as updates regarding changes to our cybersecurity risk profile or newly identified significant risks. In addition, the Audit and Risk Committee reports to the Board on these matters at each regularly scheduled Board meeting. The Board and Audit and Risk Committee provide feedback and recommendations accordingly.


text: Role of Management We operate on a "three lines of defense" risk governance model, with partnership and communication across the three lines. The first line of defense is comprised of the business and technology managers, the second line of defense is comprised of the Compliance, Risk and Information Security teams and the third line of defense is comprised of the Internal Audit function. The second and third lines of defense focus on providing the first line of defense with advisory and assurance functions for informed and actionable risk-based decisions. The Enterprise Risk Committee (the "ERC") is chaired by our Chief Risk Officer and includes our Chief Technology Officer, General Counsel, Chief Administrative Officer, Global Head of Enterprise Risk, Chief Information Security Officer, Head of Global Compliance, Global Head of Human Resources, Head of Internal Audit and various global heads of business lines and corporate functions. The ERC is responsible for the governance and oversight of our Risk Framework, which includes cybersecurity risks. Its responsibilities include, supervising risk mitigation strategies and their implementation, overseeing compliance and regulatory aspects, managing crises, approving risk tolerance, reviewing and approving material policy changes and evaluating the effectiveness of the organization's risk management practices. The ERC regularly obtains reports from the Chief Information Security Officer who maintains the primary responsibility for assessing and managing the cybersecurity risks, to evaluate the principal cybersecurity risks for the Company and review strategies in place to mitigate them. The ERC meets quarterly and reports to senior management, including the Chief Executive Officer and Chief Financial Officer. Senior management provides oversight and support in aligning cyber risk management with the Company's strategic decisions, fostering a culture of risk awareness across the organization and allocating adequate resources to support the initiatives.


text: Our Chief Information Security Officer leads a highly qualified cybersecurity team in assessing, managing and reducing material risks from cybersecurity threats to protect critical operations and delivery of service. Our Chief Information Security Officer has over 25 years of industry experience, with more than a decade of CISO experience at various financial institutions. Many members of the cybersecurity team hold Certified Information Systems Security Professional and Certified Information Systems Auditor certifications. In addition, our Global Head of Enterprise Risk has more than a decade of experience managing enterprise risk programs and maintains multiple information security certifications. We also belong to several professional and recognized industry organizations related to cybersecurity, including FS-ISAC, FCA Cyber Coordination Group and SIFMA in order to stay up-to-date on industry-wide trends.


text: We maintain a cyber risk management program that is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The design of our program is based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework.


text: We have implemented a cyber incident response standard operating procedure (the "SOP") detailing actions to be taken in the event of a cyber incident. Pursuant to the SOP, any suspected cyber breaches or detected vulnerabilities are promptly reported by our cybersecurity team to our Chief Technology Officer ("CTO") and Chief Legal Officer ("CLO") for further assessment and/or remediation. In addition, we require our employees to regularly participate in mandatory cybersecurity training that covers critical aspects of digital security, including phishing prevention, threat awareness, and safe data handling practices. Cybersecurity risk considerations are also incorporated into our broader business continuity planning. In addition to our internal processes, our partnerships with various third-party vendors comprise a key component of our cyber risk management program. We engage several reputable third-party companies to monitor and maintain the performance and effectiveness of our products and services, as well as to conduct System and Organization Controls (SOC) assessments and our mandatory cybersecurity training for employees.


text: Our Compliance and Security Officer ("CSO") is the head of our experienced cybersecurity team and is responsible for assessing and managing our cyber risk management program. Our CSO collaborates with our business, engineering, human resources, legal, and other functions to implement and enforce our cyber policies. Our CSO reports to our CTO, and they collectively inform our senior management regarding the prevention, detection, mitigation, and remediation of incidents and vulnerabilities.


text: The Audit Committee of the Board of Directors (the "Board") oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Each quarter,, our CTO updates the Audit Committee on the development and effectiveness of our cyber risk management program. In addition, the Audit Committee is responsible for periodically reviewing and discussing with management our practices with respect to cybersecurity and information security risk management. In addition, cybersecurity risks are reviewed by the Board as part of the Company's corporate risk mapping exercise.


text: Although we have experienced, and will continue to experience, cyber incidents in the normal course of our business, prior cyber incidents have not had a material adverse effect on our business. For a further explanation of the cybersecurity risks and threats that we could be subject, see "A failure of our information technology and data security infrastructure could adversely affect our business and operations" in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: We have implemented a cyber incident response standard operating procedure (the "SOP") detailing actions to be taken in the event of a cyber incident. Pursuant to the SOP, any suspected cyber breaches or detected vulnerabilities are promptly reported by our cybersecurity team to our Chief Technology Officer ("CTO") and Chief Legal Officer ("CLO") for further assessment and/or remediation. In addition, we require our employees to regularly participate in mandatory cybersecurity training that covers critical aspects of digital security, including phishing prevention, threat awareness, and safe data handling practices. Cybersecurity risk considerations are also incorporated into our broader business continuity planning. In addition to our internal processes, our partnerships with various third-party vendors comprise a key component of our cyber risk management program. We engage several reputable third-party companies to monitor and work to maintain the performance and effectiveness of our products and services, as well as to conduct System and Organization Controls (SOC) assessments and our mandatory cybersecurity training for employees. We are also implementing systems and processes designed to oversee, identify and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use.


text: Our Compliance and Security Officer ("CSO"), who has extensive cybersecurity knowledge and skills gained from more than 20 years of work experience at the Company and elsewhere, is the head of our experienced cybersecurity team and is responsible for assessing and managing our cyber risk management program. The CSO receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CSO collaborates with our business, engineering, human resources, legal, and other functions to implement and enforce our cyber policies. Our CSO reports to our CTO, and they collectively inform our senior management regarding the prevention, detection, mitigation, and remediation of incidents and vulnerabilities.


text: The Audit Committee of the Board of Directors (the "Board") oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Each quarter, our CTO updates the Audit Committee on the development and effectiveness of our cyber risk management program. In addition, the Audit Committee is responsible for periodically reviewing and discussing with management our practices with respect to cybersecurity and information security risk management. In addition, cybersecurity risks are reviewed by the Board as part of the Company's corporate risk mapping exercise.


text: Although we have experienced, and will continue to experience, cyber incidents in the normal course of our business, as of the date of this report, prior cyber incidents have not had a material adverse effect on the Company, including our business strategy, results of operations, and financial conditions. For a further explanation of the cybersecurity risks and threats to which we could be subject, see "A failure of our information technology and data security infrastructure could adversely affect our business and operations" in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and approved medications ("Information Systems and Data").


text: Our information security team, supported by our legal and compliance departments, help identify, assess and manage our cybersecurity threats and risks. Our information security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, depending on the context, including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing certain reports of threats and threat actors, conducting scans of certain environments, evaluating our and our industry's risk profile, evaluating certain threats reported to us, conducting third-party threat assessments, coordinating with law enforcement about certain threats, conducting internal audits and threat assessments, and conducting vulnerability assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident detection and response procedures and policies; disaster recovery/business continuity plans; risk assessments; implementation of certain security controls; encryption of certain data; network security, access, and physical controls for certain systems; management, tracking and disposal of certain assets; systems monitoring; employee training; penetration tests by third-party service providers; tabletop exercises conducted by third parties; and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the information security team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: Management's role – Management is responsible for assessing and managing our material cybersecurity risks, practices and policies on a day-to-day basis.