text: We partner with and build relationships with third parties who have access to our IT systems to support an overall ecosystem around cybersecurity that we believe helps reduce third party cybersecurity risk affecting our level of cybersecurity risk. We assess cybersecurity risk from our suppliers and service providers and have in place oversight processes to identify and manage such risks. Those processes are cross-functional and form part of our enterprise risk management program, and they are supported by our security, compliance and sourcing organizations. We require suppliers and service providers identified as potential cybersecurity risks to adopt security-control principles based on NIST or similar global standards, and our form contracts for them include provisions drafted to reduce the cybersecurity risk that they may pose for us. We obtain various Service Organization Control 1 and 2 reports from third parties relating to physical security, information security, account administration, transactional processing and reconciliation, client reporting and layers of electronic security controls. Notwithstanding our cybersecurity controls that cover third parties, because it is more difficult to control and mitigate risk associated with third parties than risk internal to our own organization, we believe that these relationships with third parties create additional exposure to cyber risk.


text: In the event of a cybersecurity breach, our readiness, responsiveness and resiliency are critical. As part of our continuing efforts to assess and enhance our readiness and responsiveness, we conduct periodic mock practice scenarios in which participants at various levels of the Company, including members of senior management and IT technical personnel, play out responses to various cybersecurity breach scenarios. Thereafter, we debrief and identify areas of improvement, to continually develop response capabilities and processes that are as efficient and that operate as quickly as possible in the event of a breach, to reduce potential harm that could be caused by inefficiencies and delay. Additionally, we regularly assess our systems' resiliency and recovery capabilities in case of a cybersecurity breach, both self-managed as well as by qualified third parties.

companyName: Sylvamo Corp

ticker: SLVM

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: Furthermore, our approach to improving readiness for potential cybersecurity breaches is designed to be integrated and coordinated among all aspects of the cybersecurity incident management lifecycle, including that we assess and consistently work to improve our site-level emergency response, our technology and cyber incident response, our executive-level crisis management, our business and operational continuity, our IT resilience and our disaster recovery. These efforts also take into account and balance against cybersecurity risk our Company's business needs and operations, and to inform ourselves in conducting this balancing, we obtain input from appropriate employees from our affected business operations, enterprise risk management, business continuity, business operations, information technology and cybersecurity organizations.

stage1Method: majority


text: To enhance our cybersecurity risk management, we leverage industry associations, third-party benchmarking, audits, threat intelligence feeds and other similar resources, which inform our cybersecurity efforts and help us determine how best to allocate resources. We utilize third-party service providers to assist us in assessing, enhancing, implementing, monitoring and testing our cybersecurity program, areas of cyber risk and cyber risk management.


text: A cybersecurity threat resulting in a material cybersecurity incident could materially affect us and our business strategy, results of operations and financial condition, especially if it causes one or more of the following to occur: our incurring substantial costs to resolve the incident and address legal, reputational and other fallout from the incident; one or more of our IT systems become unavailable to operate our business; unauthorized third parties gain access to our sensitive and confidential business information; we lose access to information on our IT systems necessary to operate our business; and our customers' and suppliers' trust in our ability to protect their information is damaged to the extent that it impairs our ability to do business with them.

stage1Category: Strategy Integration


text: While we have a cybersecurity program designed to protect and preserve the integrity of our information systems, we also maintain cybersecurity insurance to manage potential liabilities resulting from specific cyberattacks. There is no guarantee that our cybersecurity program will be sufficient to prevent or mitigate the risk of a cyberattack or the potentially serious reputational, operational, legal or financial impacts that may result. Also, there is no guarantee that our cyberattack insurance coverage limits will fully cover any future claims or that such insurance proceeds will be paid to us in a timely manner. We have experienced cybersecurity incidents in the past that were not material, but future incidents could have a material impact on our business strategy, results of operations, financial condition and reputation. See "We are subject to information technology risks related to breaches of security pertaining to sensitive company, customer, employee and vendor information as well as breaches in the technology used to manage operations and other business processes" in Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: Our board of directors has overall responsibility for risk management oversight, with its committees assisting the board in performing this function based on their respective areas of expertise. Our board oversees cybersecurity matters and risk, and the Audit Committee also oversees risk that includes cybersecurity risk. The board periodically reviews our processes for assessing and addressing key strategic, operational, compliance and risk management matters concerning cybersecurity, and as part of such assessment receives briefings on such matters from our Chief Information Security Officer ("CISO"). These briefings include reports on the threat landscape, our strategies, efforts and investments to address threats, and updates on incidents. The Audit Committee also receives reports from the Company's Vice President of Internal Audit assessing internal controls that include cybersecurity controls. Furthermore, our cybersecurity risk management processes are integrated into our enterprise risk management program and our compliance risk management program, both of which are also overseen by our board.

stage1Category: Board Governance


text: Our CISO has approximately 20 years of experience in the cybersecurity industry. She is responsible for developing, coordinating and overseeing our cybersecurity strategy, policy, program and solutions, and for providing cybersecurity guidance to key management and internal company oversight bodies. Our CISO manages our cybersecurity organization, which covers all regions in which we operate and which is staffed with employees dedicated full-time to cybersecurity. Our CISO reports directly to our Chief Information Officer ("CIO") and reports on cybersecurity at least quarterly to senior management and semi-annually to the full board of directors, or more often as needed.

stage1Category: Management Role


text: Our CISO is a standing member of our Enterprise Risk Council, which seeks to strengthen our company's processes with respect to the identification, assessment, management and monitoring the risks most likely to impact our strategic success, including cybersecurity risk. The council is chaired by our VP, Internal Audit, and its members are employees drawn from various areas of our organization. The council meets at least quarterly or more often as needed, to further strengthen risk management activities across the Company, including the risk of cybersecurity incidents.


text: Cybersecurity threats and incidents are monitored and addressed through the processes described above in "- Risk Management and Strategy" and, as part of such processes, cybersecurity incidents are evaluated by the company's cybersecurity organization, which escalates information about incidents, as appropriate for the severity of the incident, to the CISO and by the CISO to senior leadership.


text: The CISO informs, as appropriate, the Enterprise Risk Council, the CIO, the Company's senior leadership and, as noted above, the board of directors and its Audit Committee, on safeguards to prevent, detect, mitigate and remediate cybersecurity incidents. The CIO and CISO both report directly on a regular basis to the Company's senior leadership on progress towards specific IT risk management objectives, with the CISO focusing on cybersecurity objectives.


text: RISK MANAGEMENT AND STRATEGY Our overall cybersecurity strategy is to: • Cultivate a security-embedded organization and culture within the Company • Extend security from technology throughout the Company's organization, practices and processes (we call this our cybersecurity mesh) • Evolve our cyber resiliency.


text: To that end, we have robust cybersecurity risk management processes that include technical security controls, policy enforcement mechanisms, monitoring systems, contractual arrangements, tools and services and management oversight to assess, monitor, identify, detect and manage risks from cybersecurity threats, and to respond to, conduct forensic analysis of, escalate appropriately and report cybersecurity incidents. We proactively obtain intelligence about potential cybersecurity threats, hunt for cybersecurity threats and consistently work to enhance our cybersecurity operations.


text: We have adopted cybersecurity control principles based on the National Institute of Standards and Technology Cybersecurity Framework (NIST), the Center for Internet Security (CIS) and ISO 27001. Further, our cybersecurity controls are designed to comply with applicable laws concerning protection of private information, including the EU General Data Protection Regulation (GDPR), Brazil's Lei General de Prote o de Dados Pessoais (LGPD) and the California Consumer Privacy Act of 2018 (CCPA).


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: GigaCloud Technology Inc

ticker: GCT


text: Our cybersecurity protections include physical, administrative and technical safeguards that cover both our information systems (also referred to herein as "information technology" or "IT" systems) and the people with access to our IT systems. We develop, maintain, test and periodically update detailed plans and procedures that are designed to help us prevent, and if necessary, timely and effectively respond to, cybersecurity incidents, which provide for the appropriate Company personnel and management to be involved depending on the type and severity of the incident.


text: Our IT systems architecture is embedded with cybersecurity features. We utilize a range of third-party software providing layers of defense against cyberattacks, and we have employees and consultants whose jobs are to continually assess and reduce the potential attack surface, to monitor, detect and respond in near real time to incidents to minimize damage, and to enhance the security environment and scale with business needs as they evolve. We conduct continuous monitoring of our potential cybersecurity vulnerabilities and attack vectors.


text: Our IT systems are accessible by our employees and certain third parties as necessary and appropriate to perform services for or otherwise do business with us. We strictly limit access to our IT systems, including that we use authentication controls and conduct real-time monitoring of access.


text: We address the cybersecurity threat risk posed by employees and third parties with access to our IT systems, including that we integrate cybersecurity risk management into the culture of our organization by: maintaining policies addressing various aspects of security necessary to protect our IT assets and data; requiring cybersecurity awareness and training programs for persons with access to our IT systems to build their cybersecurity skills and knowledge; consistent messaging to our employees (including from our top leadership) of the importance of managing cybersecurity risk, participating in our cybersecurity training and following our cybersecurity policies; routinely testing responses by our employees to mock efforts to breach our cybersecurity protections; and policies and procedures to follow in the event a cyber breach were to occur at the Company, including in response to the breach and to evaluate the level and materiality of the breach.


text: We partner with and build relationships with third parties who have access to our IT systems to support an overall ecosystem around cybersecurity that we believe helps reduce third party cybersecurity risk affecting our level of cybersecurity risk. We assess cybersecurity risk from our suppliers and service providers and have in place oversight processes to identify and manage such risks, including that we have systems that constantly monitor each third party with access to our systems and that allow such third parties to see and resolve their risks while we continue to monitor. Our processes to protect against third party cybersecurity risk are cross-functional and form part of our enterprise risk management program, and they are supported by our security, compliance and sourcing organizations. We require suppliers and service providers identified as potential cybersecurity risks to adopt security-control principles based on NIST or similar global standards, and our form contracts for them include provisions drafted to reduce the cybersecurity risk that they may pose for us. We obtain various Service Organization Control 1 and 2 reports from third parties relating to physical security, information security, account administration, transactional processing and reconciliation, client reporting and layers of electronic security controls. Notwithstanding our cybersecurity controls that cover third parties, because it is more difficult to control and mitigate risk associated with third parties than risk internal to our own organization, we believe that these relationships with third parties create additional exposure to cyber risk.

stage1Category: Third-Party Risk


text: In the event of a cybersecurity breach, our readiness, responsiveness and resiliency are critical. As part of our continuing efforts to assess and enhance our readiness and responsiveness, we conduct periodic mock practice scenarios in which participants at various levels of the Company — including employees responsible for responsive actions in the event of a breach, IT technical personnel and members of senior management — play out responses to various cybersecurity breach scenarios. Thereafter, we debrief and identify areas of improvement, to continually develop response capabilities and processes that are as efficient and that operate as quickly as possible in the event of a breach, to reduce potential harm that could be caused by inefficiencies and delay. Additionally, we regularly assess our systems' resiliency and recovery capabilities in case of a cybersecurity breach, both self-managed as well as by qualified third parties.


text: Furthermore, our approach to improving readiness for potential cybersecurity breaches is designed to be integrated and coordinated among all aspects of the cybersecurity incident management lifecycle, including that we assess and consistently work to improve our site-level emergency response, our technology and cyber incident response, our executive-level crisis management, our business and operational continuity, our IT resilience and our disaster recovery. These efforts also take into account and balance against cybersecurity risk our Company's business needs and operations, and to inform ourselves in conducting this balancing, we obtain input from appropriate employees from our affected business operations, enterprise risk management, business continuity, business operations, information technology and cybersecurity organizations.


text: To enhance our cybersecurity risk management, we leverage industry associations, third-party benchmarking, audits, threat intelligence feeds and other similar resources, which inform our cybersecurity efforts and help us determine how best to allocate resources. We utilize third-party service providers to assist us in assessing, enhancing, implementing, monitoring and testing our cybersecurity program, areas of cyber risk and cyber risk management.


text: A cybersecurity threat resulting in a material cybersecurity incident could materially affect us and our business strategy, results of operations and financial condition, especially if it causes one or more of the following to occur: our incurring substantial costs to resolve the incident and address legal, reputational and other fallout from the incident; one or more of our IT systems become unavailable to operate our business; unauthorized third parties gain access to our sensitive and confidential business information; we lose access to information on our IT systems necessary to operate our business; and our customers' and suppliers' trust in our ability to protect their information is damaged to the extent that it impairs our ability to do business with them.


text: While we have a cybersecurity program designed to protect and preserve the integrity of our information systems, there is no guarantee that our cybersecurity program will be sufficient to prevent or mitigate the risk of a cyberattack or the potentially serious reputational, operational, legal or financial impacts that may result. We have experienced cybersecurity incidents in the past that were not material, but future incidents could have a material impact on our business strategy, results of operations, financial condition, cash flows and reputation. See "We are subject to information technology risks related to breaches of security pertaining to sensitive company, customer, employee and vendor information, breaches in the technology used to manage operations and other business processes, and the increasing use of artificial intelligence" in Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: Our board of directors has overall responsibility for risk management oversight, with its committees assisting the board in performing this function based on their respective areas of expertise. Our board oversees cybersecurity matters and risk, and the Audit Committee also oversees risk that includes cybersecurity risk. The board periodically reviews our processes for assessing and addressing key strategic, operational, compliance and risk management matters concerning cybersecurity, and as part of such assessment receives briefings on such matters from our Chief Information Security Officer ("CISO"). These briefings include reports on the threat landscape, our strategies, efforts and investments to address threats, and updates on incidents. The Audit Committee also receives reports from the Company's Vice President of Internal Audit assessing internal controls that include cybersecurity controls. Furthermore, our cybersecurity risk management processes are integrated into our enterprise risk management program and our compliance risk management program, both of which are also overseen by our board.


text: Our CISO has approximately 21 years of experience in the cybersecurity industry. She is responsible for developing, coordinating and overseeing our cybersecurity strategy, policy, program and solutions, and for providing cybersecurity guidance to key management and internal company oversight bodies. Our CISO manages our cybersecurity organization, which covers all regions in which we operate and which is staffed with employees dedicated full-time to cybersecurity. Our CISO reports directly to our Chief Information Officer ("CIO") and reports on cybersecurity at least quarterly to senior management and semi-annually to the full board of directors, or more often as needed.


text: Our CISO is a standing member of our Enterprise Risk Council, which seeks to strengthen our company's processes with respect to the identification, assessment, management and monitoring the risks most likely to impact our strategic success, including cybersecurity risk. The council is chaired by our VP, Internal Audit, and its members are employees drawn from various areas of our organization. The council meets at least quarterly or more often as needed, to further strengthen risk management activities across the Company, including the risk of cybersecurity incidents.


text: Cybersecurity threats and incidents are monitored and addressed through the processes described above in "- Risk Management and Strategy" and, as part of such processes, cybersecurity incidents are evaluated by the company's cybersecurity organization, which escalates information about incidents, as appropriate for the severity of the incident, to the CISO and by the CISO to senior leadership.


text: The CISO informs, as appropriate, the Enterprise Risk Council, the CIO, the Company's senior leadership and, as noted above, the board of directors and its Audit Committee, on safeguards to prevent, detect, mitigate and remediate cybersecurity incidents. The CIO and CISO both report directly on a regular basis to the Company's senior leadership on progress towards specific IT risk management objectives, with the CISO focusing on cybersecurity objectives.


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data include confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also maintain a third-party security program to identify, prioritize, assess, mitigate and remediate third-party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: Krispy Kreme, Inc.

ticker: DNUT


text: The Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Traeger, Inc.

ticker: COOK


text: As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. Our incident response plans coordinate the activities that we and our third-party cybersecurity provider take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs periodically.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information, or intellectual property. Risk from cybersecurity threats, including relating to past incidents, have not materially affected our systems or business. Any significant disruption to our operations or access to our systems could adversely affect our business and results of operations. Further, a penetration of our systems or a third party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation, and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See "Risk Factors - Risks Related to Cybersecurity, Data Privacy, and Information Technology."


text: The Chief Information Officer ("CIO") leads our global information security organization responsible for overseeing the Company's information security program. Our CIO has over 25 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies. The teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments, and findings.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. The Audit Committee of the Board of Directors oversees our annual enterprise risk assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats. The Audit Committee also oversees our cybersecurity risk and receives regular reports from our CIO on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: Risk Management and Strategy We have processes in place for assessing, identifying, and managing material risks from unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities. In addition, we engage with independent third-party partners, including cybersecurity assessors, consultants, and auditors, to assess and consult on our cybersecurity capabilities, prioritize areas of risk, and assist with execution of our risk management and strategic plans. Our collaboration with these third parties includes audits, threat assessments, and consultation on security enhancements. In an effort to mitigate data or security incidents that may originate from third-party suppliers, we also identify, prioritize, assess, and address third-party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure that their efforts will be successful.


text: As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and risk assessments. We provide cybersecurity awareness training to employees with access to information systems, including corporate employees. We also maintain an incident response plan. Our incident response plan outlines the process for our coordination with our third-party cybersecurity providers to respond to and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with applicable legal obligations and mitigate brand and reputational damage. In addition, our incident response plan includes actions designed to enhance processes and responsiveness to address future incidents. We continue to strengthen our systems, cybersecurity training, policies, programs, response plan, and other similar measures.


text: Our management team, including our Chief Technology Officer, Mr. Wan Xin, is responsible for assessing and managing our material risks from cybersecurity threats. Mr. Wan bears the critical responsibility of assessing, monitoring and managing our cybersecurity risks and digital assets. Possessing extensive experience in the field of information security, Mr. Wan's substantial professional knowledge and experience are indispensable to the formulation and implementation of our cybersecurity strategy. Under Mr. Wan's supervision, our management team has primary responsibility for our overall cybersecurity risk management program and supervises our internal cybersecurity personnel.


text: As previously disclosed in the Company's Current Report on Form 8-K filed with the SEC on December 11, 2024, during the fourth quarter of fiscal 2024, unauthorized activity on a portion of our information technology systems resulted in the Company experiencing certain operational disruptions, including with online ordering in parts of the U.S. (the "2024 Cybersecurity Incident"). Our online ordering, retail shops, and core business functions are now fully operational. The incident materially affected the Company's business operations and is reasonably likely to materially impact the Company's results of operations and financial condition. In the fourth quarter of fiscal 2024, we incurred approximately $3 million of remediation expenses related to the 2024 Cybersecurity Incident. In addition, we estimate that we lost revenue within our U.S. segment in an amount of $11 million related to the incident with a corresponding estimated $10 million impact on Adjusted EBITDA (includes margin on the aforementioned lost revenues, as well as operational inefficiencies). We expect to continue to incur costs in fiscal 2025 related to the incident, including operational inefficiencies early in the first quarter and costs related to fees for our cybersecurity experts and other advisors. The Company holds cybersecurity insurance that is expected to offset a portion of the losses and costs from the incident. As of the date of this report, except as set forth herein, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition. For more information regarding cybersecurity risks that have and may in the future materially affect us, see "Risk Factors—Risks Related to Cybersecurity, Data Privacy, and Information Technology" included in Item 1A of Part I of this Annual Report on Form 10-K.

stage1Category: Incident Disclosure


text: Our Chief Information Officer ("CIO") leads our global information security organization responsible for overseeing the Company's information security program. Our Chief Information Security Officer ("CISO") is primarily responsible for identifying, assessing, monitoring, and managing cybersecurity threats to our overall enterprise. Our CIO has over 25 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Our CISO, who reports directly to the CIO, has over 30 years of information technology infrastructure and security experience, including developing and leading cybersecurity risk management programs for a variety of companies. Additionally, the team supporting the CISO has relevant educational and professional information technology security experience, including holding similar positions at other large companies. The CISO receives information regarding cybersecurity incidents and threats primarily from our third-party cybersecurity providers. The CISO then provides periodic reports to the CIO, including reporting on significant cybersecurity incidents, strategy, results of employee trainings, and any other notable cybersecurity matters.


text: Cybersecurity risk is among the top risks that the Company actively monitors. Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. The Audit and Finance Committee ("Audit Committee") of the Board of Directors oversees our annual enterprise risk assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats. The Audit Committee also oversees our cybersecurity risk and receives reports from our CIO on various cybersecurity matters, mitigation measures, and the status of our information security priorities. In addition, the Audit Committee reports to the Board of Directors on any significant cybersecurity incidents, such as the 2024 Cybersecurity Incident.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security processes, and (iii) our response to cybersecurity incidents; and • cybersecurity awareness training of our employees, including senior management.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Our Business and Industry—Our failure or the failure of third-party service providers on which we rely to protect our marketplace, networks and systems against cybersecurity incidents, or otherwise to protect our confidential information, could damage our reputation and substantially harm our business and operating results."


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity, to the extent material. The full board of directors may also receive briefings from our management team directly on our cybersecurity risk management program, such as presentations on such cybersecurity topics that impact public companies from our Chief Technology Officer and internal security staff.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Our Business and Industry— Our failure or the failure of third-party service providers on which we rely to protect our marketplace, networks and systems against cybersecurity incidents, or otherwise to protect our confidential information, could damage our reputation and substantially harm our business and operating results. "


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and any particular incidents through briefings from internal security personnel to Mr. Wan or our management team; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in our IT environment.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Executive Vice President of Technology, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including the Executive Vice President of Technology and Vice President of Infrastructure and Architecture, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes knowledge related to information technology, cybersecurity and incidence response, risk management, control analysis and corporate governance.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with, or effective in protecting our systems and information. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Executive Vice President of Technology, internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.


text: AGM's CSO holds an undergraduate degree in Management Information Systems and Business Administration, which he received magna cum laude. He has over 25 years of cyber-related experience, having served in various roles in technology and cybersecurity, including as Head of IT Risk Management, Executive Director of IT & Risk Compliance, and Global IT Risk Evaluation Lead at large financial institutions and consulting firms. He was also previously AGM's CISO for nearly eight years. AGM's CISO holds a master's degree in Business Information Systems and has served in various roles in information technology and information security for over 25 years across a number of large financial institutions, including as Director, Cybersecurity and Risk.

companyName: Apollo Global Management, Inc.

ticker: APO


text: Our management team, including the Executive Vice President of Technology and Vice President of IT Infrastructure and Architecture, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes knowledge related to information technology, cybersecurity and incidence response, risk management, control analysis, and corporate governance. Our Executive Vice President of Technology and Vice President of IT Infrastructure and Architecture have extensive experience in the management of cybersecurity risk management programs, having each served in various leadership roles in information technology and information security for over 10 years. We also have experienced data security, risk, and compliance professionals reporting to our Executive Vice President of Technology and Vice President of IT Infrastructure and Architecture. In addition to our in-house cybersecurity capabilities, we also engage with external assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: AGM's board of directors is involved in overseeing the Company's risk management program, including with respect to cybersecurity, which is a critical component of the Company's overall approach to enterprise risk management ("ERM"). For additional information about our risk management framework, see "Part II—Item 7A. Quantitative and Qualitative Disclosures About Market Risk—Risk Management Framework." Our cybersecurity policies and practices are fully integrated into our ERM framework through our reporting, risk management and oversight channels and are based, in part, on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance", our board of directors has an oversight role, as a whole and also at the committee level, in overseeing management of AGM's risks, including our cybersecurity risks. AGM's Chief Information Security Officer ("CISO") and AHL's CISO, with support from the broader Technology team, are responsible for information security strategy, policies and practices. • Collaborative Approach. The Company utilizes a cross-functional approach involving stakeholders across multiple departments, including Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards. The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to help mitigate cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company regularly engages third parties, including auditors and consultants, to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Company's risk management function, and the Company adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Cybersecurity threat risks have not materially affected the Company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect the Company, see "Item 1A. Risk Factors—Operating Risks—We rely on technology and information systems, many of which are controlled by third-party vendors, to maintain the security of our information and technology networks and to conduct our businesses, and any failures or interruptions of these systems could adversely affect our businesses and results of operations."


text: Retirement Services AHL's information security program is managed by its CISO with collaboration across lines of businesses and corporate functions. AHL's CISO is a senior-level executive responsible for establishing and executing AHL's information security strategy, including cybersecurity oversight. AHL's information security program implements a detailed cyber incident response plan that provides controls and procedures for handling cyber incidents and incorporates a cross-functional approach to addressing cyber risk, with engagement among internal working groups. AHL's CIO and CISO are members of AHL's management operational risk committee, which reports to AHL's management risk committee, which reports to AHL's board risk committee.


text: Cybersecurity Governance In our asset management business, our board of directors' oversight of cybersecurity risk management is supported by the audit committee of the AGM Board of Directors (the "AGM Audit Committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. Our board of directors, the AGM Audit Committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from the Company's risk management professionals, the Company's Chief Security Officer ("CSO"), CISO, other members of management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from Technology, Legal, Compliance, and ERM. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, the Board and/or the AGM Audit Committee receive quarterly risk updates from our risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM board or the AGM Audit Committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from AHL's CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.


text: In our retirement services business, our board of directors' oversight of cybersecurity risk management is supported by the AHL board of directors, the AHL board's audit, risk, and legal and regulatory committees, the AHL management risk committee, the AHL management operational risk committee and AHL management. AHL's Chief Information Officer ("CIO"), CISO, General Counsel and certain other members of AHL's senior management meet periodically with the audit, risk, and legal and regulatory committees of AHL's board of directors to review AHL's information technology and cybersecurity risk profile and to discuss risk mitigation plans.


text: Apollo and Athene Cyber teams coordinate with and leverage one another across a number of areas. The CISOs meet regularly to discuss cyber-related risks, programs and projects. Other members of Apollo and Athene's Cyber teams meet as needed on a variety of topics and open lines of communications are present to allow for the information sharing across the retirement services and asset management businesses.


text: Asset Management The AGM CISO, in coordination with Technology and ERM, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the AGM Audit Committee or AGM board, as appropriate.


text: AHL's CIO has over 30 years of insurance and financial services operations and technology experience, having held numerous operations and technology leadership positions, including as the Global Business Information Officer of Consumer Businesses and Chief Information Officer of Life and Retirement at large insurance companies. He holds an undergraduate degree in Business Management and a master's degree in Management Information Systems. AHL's CISO is responsible for managing Athene's information security program. He has over 15 years of information security experience and is a Certified Information Systems Security Professional, Certified Information Systems Auditor, Certified Information Systems Manager, and Check Point Certified Engineer. He holds an undergraduate degree in Statistical Science and a master's degree in business.


text: Cybersecurity threat risks have not materially affected the Company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect the Company, see "Item 1A. Risk Factors—Operating Risks— We rely on technology and information systems, many of which are controlled by third-party vendors, to maintain the security of our information and technology networks and to conduct our businesses, and any failures or interruptions of these systems could adversely affect our businesses and results of operations."


text: Cybersecurity Governance In our asset management business, our board of directors' oversight of cybersecurity risk management is supported by the audit committee of the AGM Board of Directors (the "AGM Audit Committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. Our board of directors, the AGM Audit Committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from the Company's risk management professionals, the Company's Chief Security Officer ("CSO"), CISO, other members of management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from Technology, Legal, Compliance, and ERM. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, the AGM board and/or the AGM Audit Committee receive quarterly risk updates from our risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM board or the AGM Audit Committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from AHL's CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Barings Private Credit Corp


text: AHL's CIO has over 30 years of insurance and financial services operations and technology experience, including as chief information officer at large insurance companies, and received a Bachelor of Science in business management and a Master of Business Administration in management information systems. AHL's CISO is responsible for managing Athene's information security program. AHL's CISO has over 25 years of information technology experience and over 20 years of information security experience; is a Certified Information Systems Security Professional, a Certified Information Systems Manager; and holds a Bachelor of Arts in statistical science, a Bachelor of Science in computer science, and a Master of Business Administration in business.


text: Risk Management and Strategy Information security and data privacy are the foundation of our cybersecurity program. We have a dedicated team of members of management in cross functional roles devoted solely to our cybersecurity strategy, design, implementation, monitoring and continuous improvement. The cybersecurity team collaborates with both internal and external parties in the delivery of network security, anti-malware, email security, endpoint security, detection/alerting, application security, data security, identity and access management, incident response, cybersecurity awareness, vulnerability management, and IT risk and threat intelligence. The cybersecurity team is also responsible for informing management of material events and key developments and coordinating with other teams in information technology, legal and privacy, as appropriate for analysis and compliance with legal and contractual obligations. Certain state laws and regulations impose privacy obligations, as well as obligations to provide notification of security breaches in certain circumstances.

companyName: HireRight Holdings Corp


text: We have established policies and standard operating procedures to define and implement our cybersecurity strategy, which includes multiple layers of administrative, operational, technical and physical safeguards used to protect information systems and data. Additionally, we have dedicated internal resources and processes in place for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into our overall risk management processes. The processes for assessing, identifying and managing material risks from cybersecurity threats, including threats associated with our use of third-party service providers, include identifying the relevant assets that could be affected, determining possible threat sources and threat events, assessing threats based on their potential likelihood and impact, and identifying controls that are in place or necessary to manage and/or mitigate such risks. Our third-party service providers are subject to a screening process, which includes risk and security assessments of the provider's data security protocols and a review of contract terms to verify that privacy laws and consumer data protection regulations are considered and incorporated into the services provided to us.


text: We have implemented internal controls designed to both prevent and detect cyber attacks and continue to review and enhance our internal controls and procedures in response to the heightened risk and occurrence of cyber threats. Our cybersecurity controls, which are the mechanisms in place to prevent, detect and mitigate risks in accordance with our policies and procedures, are designed to satisfy the regulatory requirements to which we are subject and are monitored and tested both internally and externally. We are currently ISO 27001 certified and obtain an annual SOC2, Type 2 report from a qualified external auditor attesting to the effectiveness of our key cybersecurity controls. Additionally, we maintain redundant data center capabilities for business continuity and disaster recovery in the event of a cybersecurity incident that impacts the availability of our primary operational platforms. Continuously enhancing our IT environment to meet the increasing needs of cybersecurity and privacy regulations remains a top priority.


text: Incident Response Our cybersecurity strategy includes considerations around incident detection and response. We maintain a current cybersecurity incident response plan to prepare for, detect, respond to, and learn from cybersecurity incidents. The incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management. Additionally, we have engaged a leader in third-party security solutions to conduct periodic technical and management tabletop exercises to assist in preparing for and responding to cybersecurity incidents. These preparedness exercises are intended to provide hands-on training for the participants and helps us to assess our processes and capabilities in addressing cybersecurity threats. We maintain documented incident response protocols to ensure immediate and consistent application of our processes in the event of an incident. Management and the Board of Directors are apprised of cybersecurity incidents deemed to have a moderate or higher impact to our business, even if the event is ultimately determined to be immaterial.


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company and assists as necessary with the oversight of other third-party service providers and their cybersecurity programs as discussed further below. The Adviser's cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Adviser's risk management program and processes, which include cyber risk assessments.


text: We employ a governance framework that facilitates awareness, oversight accountabilities and risk management activities across the business. This framework includes oversight by the Privacy and Cybersecurity Committee of our Board of Directors, which reviews the effectiveness of the Company's governance and management of information technology risks, including those relating to business continuity, cybersecurity, regulatory compliance and data management. Members of the Privacy and Cybersecurity Committee have broad ranges of expertise and experience in information technology and security. Our chairman of the committee has over twenty years of experience in the field of information security management, having previously held various management and executive-level positions specializing in data center infrastructure and cloud usage, IT systems, consumer identity systems, and back office platforms, The Audit Committee of our Board of Directors is responsible for oversight of our disclosures with respect to cybersecurity incidents or breaches and related compliance matters. In addition to oversight by our Board of Directors and other committees, management meets at least quarterly to consider cybersecurity threats or incidents and the impact they may have on our results of operations. Cybersecurity threats or incidents are considered on both a stand alone and aggregate basis to properly assess the impact of such events and the need for disclosure on Form 8-K as required by SEC rules requiring public companies to promptly disclose material cybersecurity incidents. To date, the risks from cybersecurity threats, including as a result of any previous immaterial cybersecurity incidents, have not materially affected our business strategy, results of operations, or financial condition.


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company and assists as necessary with the oversight of other third party service providers and their cybersecurity programs as discussed further below. The Adviser's cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on its Chief Compliance Officer ("CCO") and the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with its use of such entities.


text: Board Oversight of Security Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO and the Chief Information Security Officer of the Adviser ("CISO") regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, and the CISO of the Adviser, manage the Company's cybersecurity program. The CCO of the Company oversees the Company's compliance program and relies on the Adviser's CISO and the Adviser's CCO to assist with assessing and managing material risks from cybersecurity threats. The Adviser's CISO has 10 years of experience in actively managing cybersecurity and information security programs for financial services companies with complex information systems. The Company's CCO has been responsible for this oversight function as CCO to the Company for 1 year and has worked in the regulatory and financial services industry for over 30 years, during which the CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: We have a comprehensive approach to identifying and managing cybersecurity risks that involves our information technology security personnel, senior management, Audit Committee and Board of Directors. Our cybersecurity risk management function is integrated into our overall risk management system and processes.

companyName: Douglas Elliman Inc.

ticker: DOUG


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with its use of such entities. The Company's Chief Compliance Officer ("CCO") also plays an oversight role in the area of cybersecurity preparedness with respect to these entities.


text: Board Oversight of Security Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Adviser's Chief Information Security Officer ("CISO") regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management and the CISO of the Adviser manage the Company's cybersecurity program. The CCO of the Company oversees the Company's compliance program and relies on the Adviser's CISO to assist with assessing and managing material risks from cybersecurity threats. The Adviser's CISO has 15 years of experience in actively managing cybersecurity and information security programs for financial services companies with complex information systems.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any impact from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Risk Management and Strategy Cybersecurity risk management is an integral part of our overall enterprise risk management program. In order to assess, identify, manage and address the risk of cybersecurity threats or incidents, the Company has established a Cybersecurity Risk Management Program, which uses a risk-based approach to implement multi-layered controls designed to enable the Company to maintain agility while protecting critical infrastructure and data. This program, which is an integral part of our overall enterprise risk management program, implements controls and frameworks designed to align with industry best practices, including those based on the National Institute of Standards and Technology Cybersecurity Framework, the Sarbanes-Oxley Act of 2002 and HIPPA.

companyName: Bausch & Lomb Corp

ticker: BLCO


text: The Cybersecurity Risk Management Program is designed to identify potential vulnerabilities and threats and develop strategies to mitigate and remediate them. To assess, identify, manage, address and minimize the effects of a cybersecurity threat or incident, or a series of related cybersecurity threats or incidents, the Company undertakes a range of activities, including monitoring of its systems and networks, incident response planning, and employee training. The Company also has business continuity and disaster recovery plans in place in the event of a cybersecurity incident, which are regularly reviewed and updated as needed. The Company also regularly engages third-party assessors, consultants, auditors, and other experts to help identify, assess and address potential threats or incidents.


text: The Cybersecurity and Risk Management Team, as described below, is responsible for the operationalization of the Company's cybersecurity practices, which consists of, but are not limited to: (i) updating and enhancing the Cybersecurity Risk Management Program, (ii) overseeing third-party assessors, consultants, auditors, and other experts, and (iii) assessing, identifying, managing and addressing potential threats or incidents.


text: When a cybersecurity threat or incident is identified, the Cybersecurity and Risk Management Team will perform a technical investigation which typically consists of the following phases: i. Detection, which includes identifying the threat or incident, gathering all available facts surrounding the matter and performing an initial analysis to determine its level of severity. If the incident is classified as "Severity 1," the Materiality Committee, as defined below, is notified to further assess the matter.


text: ii. Containment and Eradication, which includes determining the cause and vulnerabilities so that the threat or incident can be isolated and eliminated. iii. Recovery, which includes repairing the impacted systems, and if applicable, notifying and instructing impacted parties of next steps.


text: iv. Post-Incident, which includes issuing a report summarizing the threat or incident, and the steps taken in assessing and eliminating the threat, as well as steps to implement to attempt to prevent similar future incidents.


text: The Materiality Committee is responsible for assessing whether a threat or an incident has materially affected or is likely to materially affect the Company's business strategy, results of operations or financial condition. The Materiality Committee considers both quantitative and qualitative factors. Once it is determined that a matter has had a material impact or it is reasonably likely to have a material impact on the Company, the Materiality Committee is required to immediately report the incident to the Disclosure Committee and Audit and Risk Committee (the "Audit Committee") of the Board of Directors (the "Board").


text: The Company emphasizes continuous risk evaluation and mitigation to improve the Cybersecurity Risk Management Program's resilience and instill a culture of vigilance across the Company's business. To promote employee awareness of best practices, the Company socializes policies and tips through its intranet site, sends regular phishing simulations, emails newsletters and hosts cybersecurity learning exercises, all in addition to standard company-wide cybersecurity awareness trainings. The Company also participates in various cybersecurity network memberships, including: • H-ISAC: a global cybersecurity best practice-sharing and threat intelligence network for health care stakeholders and • Domestic Security Alliance Council: a partnership between U.S. government agencies and private sector organizations that exchanges security and intelligence information.


text: The Company has also implemented a risk management process designed to mitigate cybersecurity risks that arise from utilizing third-party service providers. The Company's control over and ability to monitor the security posture of third parties with whom it does business remains limited and there can be no assurance that the Company can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including the Company's right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on its business from any such compromise or failure.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors—Risks Relating to Information Technology—We have become increasingly dependent on information technology systems and infrastructure and any breakdown, interruption, breach or other compromise of our information technology systems or those of our third party service providers could subject us to liability or interrupt the operation of our business, which could have a material adverse effect on our business, financial condition, cash flows and results of operations and could cause the market value of our common shares to decline" under Item 1A of this Annual Report Form 10-K.

stage1Category: None/Other


text: Because cybersecurity and data privacy can affect all facets of the Company's business, the Company employs governance structures that facilitate cross-functional, proactive risk management. The Board is responsible for oversight of the Company's risks from cybersecurity threats and incidents and the Audit Committee maintains primary responsibility related to monitoring this oversight. As noted above, the Company has in place the following teams who are responsible for maintaining various phases of the Cybersecurity Risk Management Program: • Cybersecurity and Risk Management Team which is led by the VP, IT Security and Risk Management, who reports directly to the Chief Information Officer ("CIO"). The Cybersecurity and Risk Management Team is overseen by:


text: (i) the Executive Committee, which consists of, among others, the CEO, Chief Financial Officer, Chief Legal Officer and Chief Compliance and Privacy Officer, and (ii) the Audit Committee. The Cybersecurity and Risk Management Team is responsible for maintaining and carrying out the Cybersecurity Risk Management Program.


text: • Materiality Committee, which is led by the CIO, Controller and Chief Accounting Officer, and Deputy General Counsel. The Cybersecurity and Risk Management Team informs the Materiality Committee of Severity 1 incidents and the Materiality Committee is then responsible for assessing whether a threat or an incident has materially affected or is likely to materially affect the Company's business strategy, results of operations or financial condition. Once it is determined that a matter has had a material impact or it is reasonably likely to have a material impact on the Company, the Materiality Committee is required to immediately report the incident to the Disclosure Committee and Audit Committee. • Audit Committee, which is comprised of independent directors, oversees the Cybersecurity and Risk Management Team and the team's implementation of its Cybersecurity Risk Management Program. The Audit Committee receives quarterly updates regarding cybersecurity risks and/or policy. In addition, the Materiality Committee updates the Audit Committee, as necessary, regarding any material cybersecurity incidents. • Disclosure Committee, which is led by the Chief Legal Officer and Chief Financial Officer. The Disclosure Committee is informed of potentially material threats and incidents by the Cybersecurity and Risk Management Team and Materiality Committee and the Disclosure Committee is responsible for the preparation, review and filing of any disclosure required by applicable law.


text: The Company's VP, IT Security and Risk Management and CIO who collectively lead our Cybersecurity and Risk Management Team have relevant degrees and certifications in Information Technology and Security and have extensive experience in their current and prior roles related to IT Security. Along with leading the Company's cybersecurity learning and awareness trainings, they also regularly participate in various third-party industry conferences and trainings.


text: Risk Management and Strategy Cybersecurity risk management is an integral part of our overall enterprise risk management program. In order to assess, identify, manage and address the risk of cybersecurity threats or incidents, the Company has established a Cybersecurity Risk Management Program, which uses a risk-based approach to implement multi-layered controls designed to enable the Company to maintain agility while protecting critical infrastructure and data. This program, which is an integral part of our overall enterprise risk management program, implements controls and frameworks designed to align with industry best practices, including those based on the National Institute of Standards and Technology Cybersecurity Framework, the Sarbanes-Oxley Act of 2002 and HIPAA.


text: The Company emphasizes continuous risk evaluation and mitigation to improve the Cybersecurity Risk Management Program's resilience and to instill a culture of vigilance across the Company's business. To promote employee awareness of best practices, the Company socializes policies and tips through its intranet site, sends regular phishing simulations, emails newsletters and hosts cybersecurity learning exercises, all in addition to standard company-wide cybersecurity awareness trainings. The Company also participates in various cybersecurity network memberships, including: • H-ISAC: a global cybersecurity best practice-sharing and threat intelligence network for health care stakeholders and • Domestic Security Alliance Council: a partnership between U.S. government agencies and private sector organizations that exchanges security and intelligence information.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors—Risks Relating to Information Technology—We have become increasingly dependent on information technology systems and infrastructure and any breakdown, interruption, breach or other compromise of our information technology systems or those of our third party service providers could subject us to liability or interrupt the operation of our business, which could have a material adverse effect on our business, financial condition, cash flows and results of operations and could cause the market value of our common shares to decline" under Item 1A of this Annual Report on Form 10-K.


text: Because cybersecurity and data privacy can affect all facets of the Company's business, the Company employs governance structures that facilitate cross-functional, proactive risk management. The Board is responsible for oversight of the Company's risks from cybersecurity threats and incidents and the Audit Committee maintains primary responsibility related to monitoring this oversight. As noted above, the Company has in place the following teams who are responsible for maintaining various phases of the Cybersecurity Risk Management Program: • Cybersecurity and Risk Management Team which is led by the VP, IT Security and Risk Management, who reports directly to the interim Chief Information Officer ("CIO"). The Cybersecurity and Risk Management Team is overseen by: (i) the Executive Committee, which consists of, among others, the Chief Executive Officer, Chief Financial Officer, Chief Legal Officer and Chief Compliance and Privacy Officer, and (ii) the Audit Committee. The Cybersecurity and Risk Management Team is responsible for maintaining and carrying out the Cybersecurity Risk Management Program. • Materiality Committee, which is led by the interim CIO, Controller and Chief Accounting Officer, and SVP, Assistant General Counsel. The Cybersecurity and Risk Management Team informs the Materiality Committee of Severity 1 incidents and the Materiality Committee is then responsible for assessing whether a threat or an incident has materially affected or is likely to materially affect the Company's business strategy, results of operations or financial condition. Once it is determined that a matter has had a material impact or it is reasonably likely to have a material impact on the Company, the Materiality Committee is required to immediately report the incident to the Disclosure Committee and Audit Committee. • Audit Committee, which is comprised of independent directors, oversees the Cybersecurity and Risk Management Team and the team's implementation of its Cybersecurity Risk Management Program. The Audit Committee receives quarterly updates regarding cybersecurity risks and/or policy. In addition, the Materiality Committee updates the Audit Committee, as necessary, regarding any material cybersecurity incidents. • Disclosure Committee, which is led by the Chief Legal Officer and Chief Financial Officer. The Disclosure Committee is informed of potentially material threats and incidents by the Cybersecurity and Risk Management Team and Materiality Committee and the Disclosure Committee is responsible for the preparation, review and filing of any disclosure required by applicable law.


text: The Company's VP, IT Security and Risk Management and interim CIO, who collectively lead our Cybersecurity and Risk Management Team, have relevant degrees and certifications in Information Technology and Security and have extensive experience in their current and prior roles related to IT Security. Along with leading the Company's cybersecurity learning and awareness trainings, they also regularly participate in various third-party industry conferences and trainings.


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are fully integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity policies, standards and practices follow recognized frameworks established by the National Institute of Standards and Technology ("NIST"). The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with specific the goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: A.K.A. BRANDS HOLDING CORP.

ticker: AKA


text: Risk Management and Strategy Consistent with overall ERM policies and practices, the Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains a global presence, with cybersecurity threat operations functioning 24/7 with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides periodic mandatory training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management, internal audit and other key business functions, as well as the members of the Board and the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. • Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the company's ERM function and the Company's Chief Information Security Officer.


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least once each year, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the Company's Chief Information Security Officer.


text: The Company's Chief Information Security Officer reports to the Company's Chief Information Officer who is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Chief Information Security Officer works in coordination with Company management. The Company's Chief Information Security Officer has served in various roles in information technology and information security for 25 years, including several Fortune 500 companies as a consultant specializing in risk management and security architecture, VP of Engineering for a payment solutions provider and security principal for an international telecommunications company in the Fortune 100, and has held many of the information security industry's most advanced certifications including ISC2's CISM (Chief Information Security Manager) and CISSP (Chief Information Security Professional), as well as an early adopter of the Cloud Security Alliance's CCSK (Certificate of Cloud Security Knowledge). The Company's Chief Information Officer has served in various roles in information technology for 21 years.


text: The Company's Chief Information Security Officer, in coordination with Company management, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. The Chief Information Security Officer and Company management monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.