text: BlackRock's Enterprise Risk Management Framework BlackRock recognizes the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Cybersecurity represents an important component of BlackRock's approach to ERM. BlackRock leverages a multi-lines-of-defense model with cybersecurity operational processes executed by global information security and other teams and dedicated internal audit technology and technology risk management ("TRM") teams that independently review technology risks. BlackRock's cybersecurity program is fully integrated into its ERM framework and is aligned with recognized frameworks, including NIST CSF, FFIEC CAT, FedRAMP, SOC 1/2, ISO 27001/2 and others. BlackRock aims to inform and continuously improve its cybersecurity program through engagement with regulatory, client, insurer, vendor, partner, peer, government and industry organizations and associations, as well as external audit, technology risk, information security and other assessments.


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's Board of Directors (BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC"). • Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks. • Safeguards: The Fund deploys a range of people, process and technical controls that are designed to protect the Fund's information systems from cybersecurity threats, which may include, among others: physical security controls; perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention; tabletop exercises, ongoing vulnerability and patch management; vendor due diligence; multi-factor authentication; device encryption; application security, code testing and penetration testing; endpoint security, including anti-malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges; employee awareness, training, and phishing testing; data loss prevention program and monitoring; information security incident reporting and monitoring; and layered and comprehensive access controls. • Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address the Fund's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis. • Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third-party systems. Operational incidents can arise as a result of failures by third parties with which BlackRock does business, such as failures by internet, communication technology and cloud service providers or other vendors to adequately follow processes and procedures, safeguard their systems or prevent system disruptions or cyberattacks. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.

companyName: BlackRock Private Credit Fund

secItem: Item 1C


text: • Education and Awareness: BlackRock's employees and contractors are required to complete an annual information security training to equip them with effective tools to address cybersecurity threats, and to receive communications on BlackRock's evolving information security policies and procedures.


text: BlackRock's global information security team, in collaboration with the technology risk and internal audit teams, engages in the periodic assessment and testing of BlackRock's cyber risks and cybersecurity program. These efforts may include a wide range of activities, including audits, assessments, wargames and "tabletop" exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. BlackRock also participates in financial services industry and government forums in an effort to improve both internal and sector cybersecurity defense. BlackRock regularly engages third parties and advisors to assess its cybersecurity control environment. The results of certain program and control assessments are reported to the Risk Committee, and BlackRock adjusts its cybersecurity program as appropriate based on the information provided by these assessments.


text: As of December 31, 2024, the Fund is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect the Fund's business strategy, results of operations, or financial condition.

stage1Category: Strategy Integration

stage1Method: unanimous


text: Cybersecurity Governance The Board of Trustees of the Fund periodically receives reports from BlackRock and from the Advisers regarding BlackRock's cybersecurity program. Team members who support the Fund's information security program have relevant educational and industry experience.


text: At the BlackRock parent level, BlackRock's Board is actively engaged in the oversight of BlackRock's risk management program. The Risk Committee assists the Board with its oversight of BlackRock's levels of risk, risk assessment, risk management and related policies and processes, including risks arising from cybersecurity threats. The Risk Committee receives regular reports on BlackRock's cybersecurity program, technology resilience risk management and related developments from members of our information security team, including the CISO. The Board and the Risk Committee also receive information regarding cybersecurity incidents that meet certain reporting thresholds. On an annual basis, senior members of BlackRock's technology, risk and information security teams provide a comprehensive overview of BlackRock's cyber risk and related programs to a joint session of the Board's Risk and Audit Committees.


text: Technology and cybersecurity risks at BlackRock are also overseen by the TRCC, a dedicated management risk governance committee and sub-committee of the firmwide ERC. The chair of the TRCC is appointed by the head of Enterprise Risk Management at BlackRock and its members include the CISO as well as a broad range of senior business stakeholders across BlackRock. The TRCC is responsible for oversight of BlackRock's technology and cybersecurity risk management practices and helps ensure that technology and cybersecurity risks remain within firmwide risk tolerances and technology and cybersecurity risk issues are escalated as appropriate to the ERC and other committees. The TRCC also reviews any relevant technology and cybersecurity risk related issues and helps ensure that they are appropriately escalated, reported, and remediated.


text: Incident Response and Recovery Planning: We have established and maintained comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: STORE CAPITAL LLC


text: BlackRock's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by BlackRock's CISO. As of December 31, 2024, the CISO had over 30 years of experience in information technology with a 25-year concentration in information security, including previously serving as the CISO at several global financial institutions, and held the Certified Information Systems Security Professional certification. The CISO works closely with the leadership team and other subject matter experts in the global cybersecurity group, who collectively have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and overseeing cybersecurity controls in technology risk and audit functions, as well as having relevant degrees and industry-leading certifications.


text: The CISO and members of the TRCC monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation of BlackRock's incident response plan.


text: The Company is externally managed by the Adviser and has no employees or internal information systems. Therefore, we rely on the cybersecurity strategy, expertise and policies provided and implemented by 26North, the indirect parent company of our Adviser and affiliate of our Administrator, as well as other service providers.

companyName: 26North BDC, Inc.

stage1Category: Risk Management Process

stage1Method: majority


text: Each of the Company, 26North and our industry generally is highly dependent on information systems and technology and as a result, could be prone to cybersecurity threats and attacks. In response, 26North maintains a cybersecurity program that includes policies and controls designed to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated.


text: As part of its overall risk management efforts, 26North has developed and implemented a cybersecurity risk management program (the "RMP") that applies to our business and operations. The RMP is designed to protect the confidentiality, integrity and availability of the critical systems involved in our business and the information stored in those systems. The RMP leverages a combination of standards and best practices from the National Institute of Standards and Technology Cybersecurity Framework, the International Organization for Standardization, and the Center for Internet Security, among others.


text: 26North utilizes technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, including from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. In addition, 26North has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats. Such controls help us and 26North protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.


text: 26North conducts annual cybersecurity awareness training for all employees and conducts quarterly phishing exercises to assess employee cybersecurity awareness. 26North also performs tabletop exercises and disaster recovery tests to simulate a response to a cybersecurity incident, and uses the findings therefrom to improve practices, procedures, and technologies. 26North also assesses the risks from cybersecurity threats that impact our third-party service providers and has established oversight processes to identify and manage cybersecurity risks associated with the products or services we or 26North procure from such suppliers.


text: An independent third-party also assesses and reports on 26North's internal incident response preparedness, adherence to best practices and industry frameworks, and compliance with applicable laws and regulations. The external independent third-party helps identify areas for continued focus and improvement. Finally, 26North carries cyber security insurance that provides a level of financial protection against the potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover or be sufficient to cover all losses or claims that may result from a cybersecurity incident.


text: 26North has also developed an incident response plan that provides guidelines for preparing for, responding to and recovering from cybersecurity incidents, and facilitates coordination across multiple operational functions. The incident response plan includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response plan includes notification to the applicable members of 26North's technology leadership team, including 26North's General Counsel ("GC") and Chief Technology Officer ("CTO"), and, as appropriate, escalation to an internal ad-hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on their nature, incidents may also be reported to the Risk Committee (as defined below) or the board of directors of 26North, as well as to our Chief Compliance Officer, the Audit Committee of our Board of Directors and to our full Board of Directors, if appropriate.


text: We conduct periodic risk assessments to identify cybersecurity threats and assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include the identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems and safeguards in place to manage such risks.

companyName: PMV Pharmaceuticals, Inc.

ticker: PMVP


text: Our Board of Directors has overall responsibility for risk oversight and has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. The leadership team at 26North has delegated oversight of cybersecurity and related risks to a committee (the "Risk Committee"). The Risk Committee is a cross-functional committee that governs and oversees the RMP. The Risk Committee includes members of 26North's senior executive team, including its CFO, CTO, Chief Compliance Officer and senior partners from 26North's legal, operations, finance, investment and strategy teams. The Risk Committee, will, through regular consultation with 26North's internal cybersecurity team assess, discuss, and prioritize the approach to high-level risks, mitigative controls, and ongoing cybersecurity efforts. Further, our Chief Compliance Officer works closely with 26North's CTO to monitor ongoing cybersecurity threats and provide regular updates to our Board of Directors.

stage1Category: Board Governance


text: 26North's CTO regularly updates the full Risk Committee and oversees a team of dedicated professionals responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The CTO has a Bachelor of Science in Computer Engineering from the University of Virginia and 25 years of experience leading technology teams, maintaining IT infrastructure within financial services firms, and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures to mitigate these threats.

stage1Category: Management Role


text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have implemented and utilize a risk-based approach that incorporates various information security processes designed to assess, identify and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity and availability of information technology systems and the data residing therein. The critical data contained on our information systems include intellectual property, confidential information that is proprietary, strategic or competitive in nature, and sensitive, personal information that we collect, use, store and transmit digitally in the ordinary course of our business. These processes are managed and monitored by a dedicated information technology team, which is led by our Senior Vice President of Information Technology, and include mechanisms, controls, technologies, systems, and other processes designed to monitor and evaluate our threat environment, prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. Our cybersecurity program is informed by certain industry standards and best practices as outlined by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We use email security tools, managed detection and response, third party managed security services, regular vulnerability scans and threat intelligence feeds. We also have an incident response plan designed to mitigate and remediate identified cybersecurity incidents and escalate certain incidents as appropriate to management and the Audit Committee. We assess third-party service providers with a cyber security questionnaire and a follow up meeting or audit based upon the risk profile of the third party with access to personal, confidential or proprietary information to implement and maintain cybersecurity practices intended to be consistent with applicable legal standards and industry best practices.

companyName: Apogee Therapeutics, Inc.

ticker: APGE


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share. To mitigate the aforementioned consequences of cybersecurity incidents, we carry cyber attack insurance. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our internal information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants, third party service providers, or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: Our Senior Vice President of Information Technology, a certified CISSP, who reports directly to the Chief Financial Officer and has over twenty years of experience managing information technology and cybersecurity, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which comprises solely independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President of Information Technology. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our clinical trial and related data, or Information Systems and Data.

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.


text: Our information security function, which is led by our Vice President of Information Technology, or VP of IT, helps identify, assess and manage our cybersecurity threats and risks. The information security function identifies and assesses cybersecurity threats and risks by monitoring and evaluating our threat environment and our risk profile using various methods including, for example: manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats, evaluating threats reported to us, internal and external audits, leveraging third party threat assessments, conducting vulnerability identification assessments, and leveraging external threat intelligence.


text: Depending on the environment or system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, disaster recovery and business continuity plans, encryption of certain data, network security controls, data segregation for certain data, access controls, physical controls, systems monitoring, penetration testing, and cybersecurity insurance. Certain information about our assessment and management of material risks from cybersecurity threats is included in risk management reports as applicable to senior leadership and the audit committee.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example: cybersecurity consultants, managed cybersecurity service providers, and professional service firms, including legal counsel, forensic investigators, and penetration testing service providers.


text: We also use third-party service providers to perform a variety of functions throughout our business, such as software-as-a-service providers, hosting companies, supply chain resources, contract research organizations, and contract manufacturing organizations. Depending on the nature of the services provided, the sensitivity of the critical systems, information and assets at issue, and the identity of the provider, we may conduct a review of security assessments provided by the vendor and impose contractual obligations related to cybersecurity on the vendor.

stage1Category: Third-Party Risk


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. "Risk Factors" in this Annual Report, including "If our information technology systems or those of third parties with whom we work, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."

stage1Category: None/Other


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. Our board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our VP of IT, who has over 25 years of experience in information technology including IT leadership in Department of Defense Research. Our VP of IT who reports to our Chief Financial Officer, or CFO, who has 23 years of experience as a CFO, including supervisory responsibility over IT and cybersecurity functions.


text: Our VP of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our VP of IT is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CFO, General Counsel, or GC, and Chief Executive Officer, or CEO. Our GC, CFO, and other leadership personnel work with our incident response team to help assess impact and mitigate and remediate cybersecurity incidents of which they are notified, in addition to notifying the audit committee of our board of directors, as appropriate.


text: Our board of directors' audit committee receives annual reports from our CFO concerning our significant cybersecurity threats and risk and the processes the Company has implemented to address them. Our audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Cybersecurity Governance We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks, which includes engagement with both senior management and the Board. Our Board is responsible for overseeing our enterprise risk management activities in general, including those related to cybersecurity, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on our risk management process and the risk trends related to cybersecurity at least annually. Further, the Audit Committee specifically assists the Board in its oversight of risks related to cybersecurity. To help ensure effective oversight, the Audit Committee receives reports on information security and cybersecurity from the CIO at least four times a year.

companyName: United Parks & Resorts Inc.

ticker: PRKS


text: Cybersecurity Risk Management and Strategy We have an established process led by our Chief Information Officer ("CIO") that governs how we assess, respond and report, internally and externally, the occurrence of cybersecurity incidents and threats. Typical incidents and threats are cataloged and reported to the CIO on a weekly basis together with details regarding the mitigation actions implemented as well as other possible mitigation actions that could be implemented to mitigate or prevent future similar incidents. Urgent or severe incidents are reported to the CIO immediately where triage then begins and does not end until the threat has been mitigated. Depending on the nature and severity of an incident, our process provides for escalating notification to our CEO and the Board including the Chairman of the Board, our Lead Independent Director and the Audit Committee chair. Otherwise, the Audit Committee receives quarterly reports that summarize the new threats identified over the quarter as well as threats that were mitigated over the quarter, with details on the quantity, severity, and addressability of the incidents.


text: The Company has adopted the Center for Internet Security ("CIS") framework for cybersecurity defense. The CIS framework is a leading set of best practices for cybersecurity policies and procedures created by the non-profit Center for Internet Security, which are used or referenced by multiple legal, regulatory, and policy frameworks. The CIS framework includes: (1) a prioritized set of safeguards to mitigate the most prevalent cyber-attacks against systems; and (2) a set of a recommended actions for cyber defense that provide specific and actionable ways to thwart the most pervasive attacks.


text: Our approach to cybersecurity risk management includes the following key elements: • Multi-Layered Defense and Continuous Monitoring – We work to protect our computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from penetration testing and bulletins published by CIS to help prevent future attacks. We utilize data analytics to detect anomalies and search for cyber threats. Our Security Incident and Event Management ("SIEM") system provides comprehensive cyber threat detection and response capabilities and maintains a 24x7 monitoring system which complements the technologies, processes and threat detection techniques we use to monitor, manage and mitigate cybersecurity threats. From time to time, we engage third-party consultants or other advisors to assist in assessing, identifying and/or managing cybersecurity threats. We also periodically use our Internal Audit function to conduct additional reviews and assessments. • Insider Threats – We maintain an insider threat program designed to identify, assess, and address potential risks from within the Company. Our program evaluates potential risks consistent with industry practices, customer requirements and applicable law, including privacy and other considerations. • Training and Awareness – We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees with network access participate annually in required training, including spear phishing and other awareness training. • Supplier Engagement – We require our suppliers to comply with our standard information security terms and conditions, in addition to any requirements from our customers, as a condition of doing business with us, and require them to complete information security questionnaires to review and assess any potential cyber-related risks depending on the nature of the services being provided.


text: We regularly receive vulnerability threat information from our product vendors as well as CIS and other third-party sources. In order to prioritize mitigation efforts, we categorize threats based on likelihood of occurrence and the potential severity of an incident related to the threat. The Information Technology Department reports overall threat collection and mitigation status at least monthly to the CIO and at least quarterly to the Board and ERMC.


text: Cyber threats are discussed routinely (weekly, monthly, and quarterly) and ad-hoc based on the activities of that time. These threats are used to gauge the size and competency of the organization, the effectiveness of our tools, the sensitivity of the applications we use, and the security of the fundamental architecture that our system is built upon. This then drives decisions for staff, tools, and changes that may require capital or other funding.


text: We conduct third-party penetration testing on both a routine and ad-hoc basis. Routine penetration testing occurs at least annually and focuses on specific elements within our system, usually without notification to any of the Company's employees involved in those systems. Ad-hoc penetration testing occurs when we learn of a specific vulnerability of concern or when we resolve an alert from an imposing threat.


text: We also conduct table-top cyber exercises on an annual basis to ensure that the organization is prepared in the event that a significant breach actually occurs. These table-top exercises simulate a real cyber event (such as a ransom letter) in order to walk through the response process, gain information regarding how we react to incidents, identify areas of vulnerability, and recommend changes based on the outcome of the exercises.


text: While we have experienced cybersecurity incidents in the past, to date we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and the resiliency of our networks and continue to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. As discussed more fully under Item 1A – "Risk Factors", however, the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. No matter how well designed or implemented our cybersecurity controls are, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventative measures against cybersecurity breaches in a timely manner.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Executive Vice-President and Chief Financial Officer and President and Chief Executive Officer. Our Executive Vice-President and Chief Financial Officer is part of our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Repare Therapeutics Inc.


text: Our cybersecurity function is part of our Information Technology Department and is managed by our CIO who oversees the management of cybersecurity risk and the protection and defense of our networks and systems. Our CIO has over 30 years of experience assisting IT leadership within the Department of Defense and other federal government agencies with IT architecture and solutions including cyber security. Within the Information Technology Department, these activities are orchestrated through cooperation between our cyber security group and our network engineering group. The individuals performing these functions include cybersecurity professionals with broad experience and expertise, including cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance and include professionals who are qualified as Certified Information Systems Security Professionals. The teams within our cybersecurity group and our network engineering group work together to: identify and mitigate risks; respond to active cyber activity on our networks; respond to recent activity publicized by the Center for Internet Security (CIS) or other reputable cybersecurity organizations; and respond to patches and updates provided by our vendors.


text: In addition, our Enterprise Risk Management Committee ("ERMC") considers risks relating to cybersecurity, among other significant risks, and applicable mitigation plans to address such risks. The ERMC is a cross-functional committee that reports to the Executive Leadership Team and is chaired by our Chief Financial Officer. The ERMC meets during the year at least quarterly and receives periodic updates on cybersecurity risks from the CIO, who is a member of the committee.


text: Management of Cybersecurity Risks and Cybersecurity Strategy We have developed and implemented a cybersecurity program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Neumora Therapeutics, Inc.

ticker: NMRA


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity program shares common methodologies, reporting channels and governance processes as the risk management programs of other departments within our company, including the legal, compliance, strategic, operational, and financial departments.


text: Key elements of our cybersecurity program includes but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • ad hoc internal review of the cybersecurity practices of key service providers, suppliers, and vendors who have access to our critical systems and information based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors— Our information technology systems, or those used by our third party research institution collaborators, CROs, CMOs, or other contractors or consultants, may fail or suffer cyberattacks or security breaches."


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity program.


text: The Committee receives annual reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives briefings from management on our cybersecurity program. Board members receive presentations on cybersecurity topics from our Senior Director of Infrastructure and Cybersecurity, internal security staff or external experts as part of the board of directors' continuing education on topics that impact public companies.


text: The audit committee receives periodic reports from our information technology function concerning our significant cybersecurity threats and risks and the processes we have implemented to address them. The board of directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our management team, including our Senior Director of Infrastructure and Cybersecurity (20 years of cybersecurity risk management experience) and Chief Information Officer (five years of cybersecurity risk management experience), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes demonstrated expertise in cybersecurity, life sciences, and security industry certifications such as Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP).


text: Our management team takes steps to stay informed about and monitor supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and other data related to our ongoing research and development initiatives, which we refer to as Information Systems and Data.


text: Our information technology function helps identify, assess and manage our cybersecurity threats and risks. Our information technology function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, automated vulnerability scanning tools of the threat environment, third-party cybersecurity audits, and use of external intelligence feeds.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, vulnerability management, disaster recovery and business continuity plan, Incident response policy, system monitoring, data encryption and access controls.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our information technology function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time in identifying, assessing, and managing material risks from cybersecurity threats, including for example thread intelligence providers, cybersecurity software providers, managed cybersecurity service providers and cybersecurity testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies and contract research organizations. We manage cybersecurity risks associated with our use of these providers using several approaches, as deemed necessary, including security questionnaires, review of compliance reports, audits and the imposition of information security contractual obligations on vendors.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Executive Vice-President and Chief Financial Officer, our Vice-President of Finance and Corporate Controller and our Vice-President of Information Technology, who each have over 20 years of relevant experience.


text: Management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our management and audit committee are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: FRACTYL HEALTH, INC.

ticker: GUTS


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our VP of Information Technology, who reports to our General Counsel & Chief Operating Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards in collaboration with management. Personnel at all levels and departments know our cybersecurity policies through training. Random attack simulations are conducted monthly to familiarize all personnel with various phishing methods with positive reinforcement on identifying and reporting suspicious content to the IT Department.


text: We engage third parties like a penetration testing firm and our managed service provider in connection with our risk assessment processes. These service providers assist us in identifying vulnerabilities to design and implement, suggesting remediation of our cybersecurity policies and procedures, as well as monitor and test our safeguards. We require each third-party service provider to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to "Item 1A. Risk Factors," in this Annual Report on Form 10-K, including the risk factors entitled "Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operation."


text: One of the key functions of our board of directors is oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers manage the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole and through the audit committee.


text: Our VP of Information Technology, and our management committee on cybersecurity, which includes our audit committee, are primarily responsible for assessing and managing our material risks from cybersecurity threats. The VP of Information Technology has twenty years of experience in IT on-premise and cloud infrastructure, enterprise applications, and operations across large and mid-size life science companies with a focus on IT controls for compliance and security.


text: Our VP of Information Technology oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our VP of Information Technology or department designee are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents include weekly assessments for all endpoints and real-time notifications from security solutions, which include a combination of cloud and client-based applications.


text: Our VP of Information Technology provides annual briefings to the audit committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our VP of Information Technology or department designee provides annual briefings to the board of directors on cybersecurity risks and activities.


text: Our information security processes are designed to assess, identify and manage material risks from cybersecurity threats. In conducting our business activities, we are entrusted with confidential information from our clients, business partners and employees. Confidential information may include sensitive business, proprietary and technical information, as well as personal information. Our Information Security Management System ("ISMS"), based on ISO/IEC 27001, is an integral part of our overall enterprise risk management system, and serves as a framework for handling cybersecurity threats and incidents, including such threats and incidents associated with our use of services by information technology suppliers. The ISMS is operated by our Global Information Security team headed by our Global Chief Information Security Officer ("CISO"). We maintain physical, electronic and procedural safeguards designed to guard confidential and proprietary information contained within our information systems from loss, misuse, unauthorized access, disclosure, alteration or destruction. We have layered defenses designed to protect against intrusions that could affect the confidentiality, integrity and availability of information.

companyName: SS&C Technologies Holdings Inc

ticker: SSNC


text: As an important part of our cybersecurity programs, we perform defined due diligence procedures prior to engaging with new vendors. The level of due diligence varies depending on the materiality, level of risk and complexity of the arrangements. The vendors' financial condition, information security programs and regulatory reporting are also typically reviewed and considered prior to entering into a vendor agreement.

companyName: Repay Holdings Corp

ticker: RPAY


text: We prepare for security incidents by analyzing threat intelligence, holding periodic cybersecurity incident tabletop exercises, and reviewing lessons learned on a regular basis. Our incident management process is communicated to employees during periodic security awareness training. Our employees are trained to report incidents, including security weaknesses, malfunctions, threats and breaches immediately to the concerned internal departments and to our information security group. Our computer security incident response team is trained to manage incident response.


text: We conduct systematic and manual assessments designed to identify information security vulnerabilities, such as external party penetration tests, internal manual penetration tests, source code scanning and other techniques. We perform information technology risk assessments on a periodic basis designed to detect risks for which controls and mitigation strategies are developed.


text: We engage with external experts, including cybersecurity assessors and consultants, in evaluating and testing our information systems and information security controls, enabling us to obtain specialized knowledge and insights.


text: We perform information technology supplier risk assessments on a periodic basis. Information technology suppliers to SS&C that access, handle, transmit, process or store personal information or other customer data on our behalf are assessed and are also subject to periodic due diligence procedures.


text: Cybersecurity risk is overseen by the board of directors, with additional oversight of the relevant risk framework and controls provided by the Audit Committee. The Audit Committee oversees our policies with respect to risk assessment and risk management generally, including guidelines and policies to govern the process by which our exposure to risk is handled. As set forth in its charter, Audit Committee oversight includes periodic review of our information security controls and procedures and the processes and procedures for managing cybersecurity risks.


text: Our CISO, who reports to SS&C's Chief Technology Officer, provides periodic updates to the Audit Committee or to the board of directors on cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents, industry trends and other areas of importance.


text: Our CISO is responsible for our overall information security strategy, policy, security engineering, operations, cybersecurity threat detection and response. Our CISO has over 20 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other companies. Global Information Security team members provide regular reports to our CISO with respect to the prevention, detection, mitigation and remediation of cybersecurity incidents, and otherwise aid our CISO in operating the ISMS. Global Information Security team members have relevant education, certifications, and industry experience.


text: We, our clients and our vendors are regularly the target of attempted cyber-attacks, and we must continuously monitor and develop our systems to protect our technology infrastructure and data from misappropriation or corruption. Such cybersecurity incidents could lead to disruptions in our systems; the unauthorized release or destruction of our or our clients' or other parties' confidential or otherwise protected information; and corruption of data. We regularly re-evaluate, modify and enhance our information security processes as new technologies emerge or new risks are identified. In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operating results, cash flows or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Risk factors - Risks Relating to Our Business - We face risks from cyber-attacks, breaches of digital security, IT system failures and network disruptions that could adversely affect our reputation and our business." for more information about these risks.


text: Our Company has a dedicated team of technology professionals who consistently monitor risks related to cybersecurity. Our Corporate Vice President and Chief Information Officer, as well as our Chief Information Security Officer ("CISO") are responsible for managing our information technology ("IT") security program. Our CISO is a Certified Information Systems Security Professional (CISSP), holds a Masters Degree in Computer Information Systems, and has over 20 years of relevant expertise in assessing and managing cybersecurity risks. Their teams are responsible for leading an enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes. To identify and address potential information security risks, we use a defense-in-depth methodology that employs multiple, redundant defensive measures and outlines actions to take in the event of a security control failure or vulnerability exploitation. To protect the Company from cybersecurity threats, we utilize a combination of internal resources and external consultants and providers. These consultants and providers provide services such as penetration testing, incident response, and third-party assessments. In addition, we use a combination of both proprietary and commercial solutions to proactively manage and mitigate threats to our IT environment and these processes have been integrated into the Company's overall risk management system.

companyName: VICOR CORP

ticker: VICR


text: Risks from Cybersecurity Threats While we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial conditions, we do expend significant resources (including cyber insurance costs) to address the ongoing risks from cybersecurity threats. We believe these risks could be material in light of the sensitive data that we collect, process and store in the operation of our business. See "Risk Factors" above.


text: Our CISO oversees security, including the corporate IT environment, our public cloud presence, and security standards that are used as a framework for managing security across our Company. Our CISO is also responsible for security awareness, administering our corporate security training, and sponsoring our cybersecurity policy and standards. Our cybersecurity plan is reviewed annually, and our Audit Committee has delegated to the Executive Security Incident Response Team which is made up of our Chief Financial Officer, a Board member and senior management representatives in the legal, IT and finance functions, oversight of our cybersecurity program. The Executive Security Incident Response Team receives regular updates directly from our CISO and Vicor product security experts from various business and operational areas. We maintain various security certifications across the Company, and part of our compliance program includes processes to oversee and identify material risks from cybersecurity threats and include the use of third-party service providers to perform regular audits to ensure our security management program remains current.


text: Our objective for managing information security and cybersecurity risk is to avoid or minimize the impacts of both internal and external threat events and other efforts to penetrate or otherwise compromise the confidentiality, integrity, or availability of our systems. We work to achieve this objective by hardening networks and systems against attack, and by diligently managing visibility and monitoring controls within our data and communications environment to recognize events and respond appropriately.


text: To keep the Executive Security Incident Response Team apprised of the continually shifting landscape, the CISO typically provides quarterly updates to the Executive Security Incident Response Team on information security and cybersecurity matters. The Executive Security Incident Response Team maintains oversight of the efforts made to maximize information security and cybersecurity efforts. Potential concerns related to information security and cybersecurity will be escalated to the Board of Directors and Audit Committee, as appropriate.


text: Our cybersecurity infrastructure undergoes external audits. These efforts demonstrate our commitment to maintaining the highest level of cybersecurity protection. Our external third-party providers also evaluate and rank our cybersecurity maturity and coverage as part of their services. To stay informed about emerging threats, we regularly consult with external providers and other sources such as government publications and notices.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While Vicor Corporation maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: We face risks associated with security breaches through cyberattacks, cyberintrusions or otherwise, and other significant disruptions of information technology networks and related systems. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Refer to Risk Factors in Part I, Item 1A for a disclosure of our cybersecurity risks. We continue to monitor cybersecurity risks to prevent and mitigate materially negative impacts on the Company's reputation, financial performance, customer or vendor relationships and potential litigation or regulatory investigations or actions.

companyName: CBL & ASSOCIATES PROPERTIES INC

ticker: CBL


text: As part of its regular oversight of risk management, our audit committee is responsible for the oversight of cybersecurity risk and threat mitigation related to our information technology and information systems including protection and security of employee and customer data. Our Senior Vice President – Technology Solutions is responsible for the day-to-day management of our cybersecurity program and reports directly to our President. Our Senior Vice President – Technology Solutions has served in this role for over four years and has more than 25 years of experience in the aggregate, including more than ten years with the Company, in various information technology roles. Our audit committee is responsible for overseeing cybersecurity risks, and our management team reports to our audit committee on the Company's cybersecurity program, current cybersecurity projects and industry trends and efforts to mitigate cybersecurity risk on at least a semi-annual basis.


text: Cybersecurity Risk Management and Strategy We have designed and implemented a comprehensive program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed this program based on the National Institute of Standards and Technology cybersecurity framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We monitor and regularly assess our cybersecurity risks and adjust our program accordingly.


text: Our Head of Information Technology and Security, or Head of IT, has primary responsibility for day-to-day management of our cybersecurity risk management program, including leading a dedicated team of information technology professionals to monitor cybersecurity risks on behalf of TScan. Our Head of IT has over 16 years' experience with information technology and cybersecurity risk management programs.

companyName: TScan Therapeutics, Inc.

ticker: TCRX


text: We maintain a cybersecurity incident response plan which outlines our response and action in the event of a major cybersecurity incident. The cybersecurity incident response plan sets forth a process for detecting and responding to cybersecurity incidents, determining their scope and risk, developing an appropriate response to mitigate and remediate the incident, communicating effectively to varying levels and personnel within the Company depending on the severity of the threat, effectively communicating to stakeholders and participants and reducing the likelihood of similar future incidents. In the event of a real or perceived cybersecurity incident, the Senior Vice President – Technology Solutions would, as soon as practicable, inform the Cybersecurity Incident Response Team, the members of which would then collaborate with the Senior Vice President – Technology Solutions to manage material risks.


text: We have adopted and require employees to abide by our personally identifiable information policy to help protect personal employee, vendor and tenant information. Employees are required to complete regular cybersecurity training and education annually, which is followed-up with quarterly testing and re-training, as necessary.


text: We contract with an independent cybersecurity provider to perform an annual cybersecurity risk and vulnerability assessment. We regularly test areas of potential vulnerability, utilizing penetration testing, ransomware-focused disaster recovery tests as well as testing exercises for other higher risk areas.


text: We conduct annual reviews of third-party hosted applications where sensitive Company data is shared. Additionally, cybersecurity tools and services are configured to identify threats and risks that may be associated with the use of third-party applications or solutions.


text: We maintain cybersecurity risk insurance coverage; however, there is no assurance that the insurance the Company maintains will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related losses.


text: Risk Management & Strategy Wesbanco generally approaches cybersecurity threats through a cross-functional, multi-layered approach, with the specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to Wesbanco; (ii) maintaining the confidence of its customers and business partners; and (iii) preserving the confidentiality of its customers' and employees' information. Wesbanco's Information Security and Cybersecurity program is integrated into its overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. The bank also partners with trusted security vendors to enhance incident response capabilities, evaluate framework and compliance assessments, provide continuous monitoring, provide guidance on strategies, evaluate compliance with existing laws and regulations, design and implement cyber policies and procedures, and provide threat intelligence services.

companyName: WESBANCO INC

ticker: WSBC


text: As detailed in Item 1A "Risk Factors - Risks Related to the Use of Technology", third-party technology relationships pose a risk to the organization. As such, third-party risk management processes are aligned with regulatory requirements and are another key focus area within the bank's enterprise risk management framework. Wesbanco employs a third-party risk management program that includes a systematic evaluation of potential risks associated with engaging third-party vendors, suppliers or partners that may have access to Wesbanco's sensitive information, systems or networks. This process is also intended to provide for the security and integrity of Wesbanco's data that may be stored on third-party systems. The process identifies and addresses potential security vulnerabilities, safeguarding Wesbanco's information assets and reducing the overall risk of cyber threats. Third-party providers are evaluated during onboarding and throughout the ongoing relationship based on the level of risk that the service being provided presents to the organization. The evaluation process includes a thorough review of operational practices related to cybersecurity and considers factors that impact the protection of bank and customer data.


text: Wesbanco continues to foster a risk averse focus and leverages various threat intelligence sources to continually evaluate current and future risks to the organization. The bank invests in continuing education of the security team and in technologies that help protect its systems and data. Required security awareness training is provided to all employees to ensure that corporate policies are understood and followed. The bank's cybersecurity strategy and roadmap are frequently evaluated and updated according to multiple inputs including any tangible cybersecurity incidents. Incident Management and Response is led by a cross functional incident response team that handles critical incidents inclusive of cybersecurity incidents. In addition to handling critical incidents, the response team coordinates an annual tabletop exercise aimed at continually practicing documented incident response processes. These tabletop exercises include participation from executive leadership and periodically members of the board of directors. The Incident Response team is chaired by the Chief Security Officer and membership of the Incident Response team includes representation from Human Resources, Information Technology, Fraud and BSA, Corporate Communications, Risk Management, Investor Relations, Retail Banking, Compliance, Bank Operations, Legal Counsel, Customer Support, and Digital Banking and Payments.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Cybersecurity threats, a security strategy roadmap, and key risk indicators are shared with management and the board of directors through both committee reporting structures and periodic reports of the Chief Security Officer. In addition, management updates our Enterprise Risk Management Committee, as necessary, regarding significant cybersecurity incidents. Our Enterprise Risk Management Committee regularly reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The Technology Governance Committee, a management level steering committee also receives periodic reports from the Chief Security Officer for security risk assessments, security program effectiveness evaluations, occurrence and response to cyber incidents, effectiveness of mitigation strategies, regulatory compliance, and external assessments and benchmarking. As part of the Enterprise Risk Management Framework, cybersecurity oversight also utilizes the concept of three lines of defense which allows for multiple challenge response processes to continually mature the cybersecurity program. Cybersecurity best practices from the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS") are used to establish, operate, and validate security controls.


text: The Enterprise Risk Management Committee is a board-level committee focusing on enterprise risk, including cybersecurity risks. Multiple directors have decades of experience, not only in the banking sector, but also have been responsible for cybersecurity and technology departments at larger organizations. The Chief Security Officer is responsible for providing the Information Security strategy and operational planning for the overall Information Security program, and has decades of experience in the industry, advanced education degrees, and holds industry standard technical and security certifications. Several members of the Information Security team also hold multiple security certifications that tie directly to their job responsibilities. These certifications include, but are not limited to, ISC2 Certified Information Systems Security Professional (CISSP), ISACA Certified Information Systems Auditor (CISA), ISACA Certified Information Security Manager (CISM), EC-Council Certified Ethical Hacker (CEH), CompTIA Security+, CompTIA CySA+, CompTIA CASP+, and CompTIA PenTest+.


text: While Wesbanco and its third-party providers have in the past experienced cybersecurity incidents, Wesbanco is not aware of any current incidents or new types of threats which have materially affected or are reasonably likely to materially affect Wesbanco, including its business strategy, results of operations, or financial condition. We face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors – Interruption to Our Information Systems or Breaches in Security Could Adversely Affect Wesbanco's Operations." for additional detail.


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management program is designed to assess, identify, and manage material risks from potential unauthorized breaches of or access to our electronic information systems, and the information we store on our systems. Our program includes a wide variety of mechanisms, controls, technologies, methods, systems and other processes as further described below that are designed to prevent, detect, or mitigate unauthorized access, data loss, theft, misuse or other security incidents and vulnerabilities affecting our systems and the information we store on our systems. The information we store includes confidential, proprietary, business, and personal information of ours, our customers, our employees and other third parties that we collect, process, store and transmit as part of our business. Our program is aligned with the National Institute for Standards and Technology Risk Management Framework (NIST RMF), other industry-recognized standards and our contractual requirements. We also leverage government partnerships, industry and government associations, third-party benchmarking, the results from regular internal and third-party audits, threat intelligence feeds and other similar resources to inform and guide our cybersecurity processes and resource allocation. Additionally, we use processes and third-party technologies to oversee and minimize impact to our data, including two-factor authentication, encryption, Company secured email and dedicated cybersecurity support personnel.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: Our cybersecurity risk management strategy is led by our Chief Information Security Officer (CISO) and a team of information security and other professionals, as detailed further below, who are responsible for implementing and maintaining our cybersecurity data protection practices. This team works in close coordination with the Audit Committee of our Board of Directors, which is responsible for oversight of cybersecurity risk, senior management and other business functions and teams across the Company to identify threats by performing risk assessments and analyzing effectiveness of controls against identified risks.


text: As part of our risk management process, our cybersecurity risk management team oversees our vulnerability management practices and conducts routine application security assessments, yearly penetration testing, periodic security audits and ongoing risk assessments designed to identify cybersecurity risks to our environment. We continue to leverage third-party services for security operations through a dedicated managed security service provider to monitor and respond to cyber threats. This provider plays a critical role in, mitigating threats to our environment, as well as alerting and responding to events and incidents in close coordination with our internal team. For example, this provider performs searches across live and historical data to provide analysis based on threat intelligence and use cases to develop trends and data models to reduce false positives and enhance search criteria for future use. In addition to our routine practices, we also conduct testing, audits and assessments in connection with acquisitions, the implementation of new software, processes or activities requiring changes in our information technology environment, new cybersecurity events or developments and receipt of new risk intelligence. Further, we have adopted an enterprise-wide cybersecurity training and awareness program requiring all employees to complete annual cybersecurity training. The program is supported with monthly education and simulations with remedial training assignments to increase user awareness.


text: We maintain an incident response plan (IRP) aligned with NIST RMF when responding to incidents. The IRP sets out a coordinated approach to investigating, containing documenting and mitigating incidents. Our CISO, with oversight from our Chief Information Officer (CIO), is responsible for executing the relevant cybersecurity incident response plan, which includes response criteria for materiality, applicable requirements for incident disclosure and reporting and escalation procedures to various individuals and departments, including our Audit Committee, key stakeholders, and senior management, including our General Counsel, Chief Financial Officer and Chief Executive Officer, for risks with a potentially material impact for responding to cybersecurity incidents. In addition to our in-house team and third-party security operations services, we also engage assessors, consultants, auditors and other third parties from time to time to assist with assessing, identifying, and managing cybersecurity risks. For example, we leverage third-party security and compliance companies with subject matter expertise in these areas for threat identification and remediation. We continue to work with the U.S. Department of Defense on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks, including through participation in the Department of Defense's collaborative information sharing. We also partner with other work groups to support understanding and deployment of the Cybersecurity Maturity Model Certification (CMMC) to promote readiness in complying with cybersecurity requirements for handling CUI and federal contract requirements.


text: As of December 31, 2024, we were not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Cybersecurity and Data Privacy Oversight Montrose maintains a dedicated cybersecurity team, led by our CISO and reporting to our CIO. Our CIO has deep expertise in cybersecurity and data management, as well as technical strategy and infrastructure, as part of his over 20 years of experience serving in this and similar roles across multiple organizations. Furthermore, our CISO is a Certified Information Security Manager (CISM) and brings over 25 years of experience in information technology, governance, compliance, and risk management.


text: The CISO is responsible for developing and deploying Montrose's overall cybersecurity and data privacy strategy, policies, procedures, and threat detection and response actions, with the support of Montrose's cybersecurity team. The cybersecurity team implements Montrose's cybersecurity and data privacy policies and procedures, including governance, compliance, and risk management practices, to safeguard Montrose's information systems and data. Collectively, the CISO and the cybersecurity team manage and evolve Montrose's cybersecurity posture with the objective of preventing cybersecurity incidents and increasing system resiliency to minimize business impact should an incident occur.


text: At the management level, Montrose's Enterprise Cybersecurity Council, consisting of our CIO, CISO, Director of Information Security, Director of Infrastructure, and senior security architects and engineers, meets monthly to review and assess cybersecurity risks and evaluate performance metrics to identify areas for continual improvement and system strengthening. Furthermore, the Council reviews project implementation status for targeted cybersecurity measures and tracks employee cybersecurity training completion and phishing email response rates. Council members have extensive cybersecurity experience and hold certifications including CISM, Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH) and Cisco Certified Network Associate (CCNA).


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks. The Audit Committee maintains delegated oversight of cybersecurity risks, bringing in third-party expertise as needed to advise on cybersecurity infrastructure, policies, and practices. Our CIO and CISO brief the Audit Committee quarterly, at a minimum, on Montrose's cybersecurity risks, business-impacting incidents, and ongoing and future cybersecurity project implementations. In addition, the Audit Committee's third-party cybersecurity advisor meets regularly with the CIO and CISO to review our cybersecurity strategy and our continued progress toward meeting our objectives. The full Board of Directors receives quarterly updates from the Audit Committee regarding its oversight of cybersecurity risks and is also periodically briefed on our cybersecurity risk management program directly by our CIO and CISO.


text: In accordance with our Incident Response Plan, in the event of a potentially material cybersecurity event, the Audit Committee as well as our General Council, Chief Financial Officer, and CEO would be notified, briefed, and involved in oversight of mitigation, reporting, and recovery measures as appropriate.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: We designed and assessed our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I. Item 1A. "Risk Factors—General Risks—Our information technology systems, or those of any of our CROs, manufacturers, other contractors, consultants, collaborators or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee oversight of cybersecurity risks including oversight of management's implementation of our cybersecurity risk management program. Pursuant to its charter, the audit committee's oversight of the integrity of our information technology systems and cybersecurity risks includes the review and assessment with management of the adequacy of controls and security for our information technology systems, processes and data, as well as our contingency plans in the event of a breakdown or security breach affecting our information technology systems.


text: As part of its oversight, the audit committee will receive reports from management on our cybersecurity risks including any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The audit committee reports to the full Board regarding its activities, including those related to cybersecurity. In addition, management may from time to time directly provide the full Board with briefings on our cyber risk management program, including presentations on cybersecurity topics from our Security Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Vice President of Information Technology and Security Officer, who reports to the Chief Financial Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Vice President of Information Technology and Security Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Vice President of Information Technology and Security Officer's experience includes 15 years of experience across digital and cyber defense, and has most recently led the cyber function for the last six years at two emerging biotechnology companies.


text: Our management team takes efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk management and strategy We have implemented a risk-based approach designed to identify, assess and manage cybersecurity threats that could materially affect our business and information systems. We attempt to identify and assess risks from cybersecurity threats by evaluating our threat environment using various methods including, for example: maintaining manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating threats reported to us, and completing third-party cybersecurity threat assessments.

companyName: Annexon, Inc.

ticker: ANNX


text: We use cybersecurity consultants and penetration testing firms in an effort to identify, assess, and manage material risks from cybersecurity threats. We use third-party service providers in various elements to our business operations such as data hosting providers. To help manage cybersecurity risks associated with our use of third-party service providers, we primarily engage with industry-preferred service providers, and we also contractually require service providers with access to personal, confidential, or proprietary information to maintain data security controls and practices.


text: Our board of directors is kept apprised of cybersecurity risks and assessments through regular presentations to the Audit Committee regarding our information security and privacy governance and reports on information security and privacy incidents. Cybersecurity threats, including as a result of any past cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. For more information regarding how cybersecurity risks may affect us, see the "Risk Factors" section.

companyName: Adaptive Biotechnologies Corp

ticker: ADPT


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Cybersecurity risks and the failure to maintain the security, confidentiality, integrity, or availability of our information technology systems or data, and those maintained on our behalf, could lead to adverse consequences that materially adversely affect our business, including, without limitation, regulatory investigations or actions, a material interruption to our operations, including clinical trials, damage to our reputation and/or subject us to costs, loss of customers or sales, fines and penalties or lawsuits."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee is responsible for advising on our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and risk management processes are managed by certain members of our management, including our CFO (who has prior experience in strategic business operations). Our CFO has supervisory responsibility over IT and cybersecurity functions. Our management is responsible for helping to integrate cybersecurity risk considerations into our overall risk management strategy, helping prepare for and respond to cybersecurity incidents, and reviewing security assessments and other security-related reports. Our incident response team is responsible for remediating cybersecurity incidents of which they are notified.


text: We maintain a cybersecurity policy, reviewed with our audit committee, which is designed to address cybersecurity risks to us (including by escalating certain cybersecurity incidents to members of management and the board of the audit committee, in each case depending on the circumstances). We also maintain incident response procedures designed to assist us in responding to cybersecurity incidents.


text: We recognize the critical importance of developing, implementing and maintaining robust cybersecurity programs in order to mitigate risk and to safeguard the sensitive data collected, processed and stored by us. Our cybersecurity programs are guided in part by certain regulatory requirements (including payment network rules) that require periodic testing and external reviews. Cybersecurity is also one of the initiatives we have identified to guide our ongoing corporate sustainability efforts. Our Chief Information Security Officer ("CISO"), who reports directly to our Chief Technology Officer ("CTO"), has day-to-day responsibility for our cybersecurity programs. Given the significant risks associated with cybersecurity incidents in the payment processing business, our cybersecurity programs are generally operated in a dedicated and independent manner.


text: Risk Identification and Assessment We employ structured processes and procedures to identify and assess cybersecurity risks and events. Our CISO oversees a cybersecurity risk assessment program that includes, for each identified material risk, an evaluation of the applicable threat level for such risk and the current mitigation plan for such risk. The cybersecurity risk assessment receives input from cross-functional teams across our organization. We also engage various third parties (including penetration testers, auditing firms and managed security service providers) to assist in identifying and assessing material cybersecurity risks.


text: Our cybersecurity-related risks are managed using a combination of documented policies and procedures, management oversight and security systems and hardware. Relevant policies are developed with the assistance of appropriate subject matter experts and are reviewed at least annually. As part of these policies and procedures, we maintain a Security Incident Response Plan (the "SIRP") that is intended to establish a structured and coordinated approach to handling cybersecurity incidents in our business. During the past year, we conducted a tabletop exercise with our executive management team that simulated a cybersecurity incident to evaluate the effectiveness of our SIRP, identify potential improvements and enhance our incident response readiness.


text: Employee and contractor compliance is bolstered by hiring, onboarding and termination procedures that are designed to align with cybersecurity objectives. All of our employees and contractors are required to complete security awareness training (which covers the policies and other information regarding our cybersecurity programs) both at the time of hire or engagement and then on annual basis. We also routinely disseminate cybersecurity and physical security educational materials to all employees and contractors.


text: We utilize a variety of physical security controls to protect our offices and assets from unauthorized access, tampering and environmental hazards. Our systems include third party logging, intrusion detection and penetration systems to monitor our information systems for anomalous and suspicious activity in support of our security objectives and incident management plans.


text: We regularly engage third party assessors and other firms to perform a variety of control testing and other reviews that are required by applicable regulatory requirements (including payment network rules) and industry standards. These firms also provide educational opportunities and materials intended to keep our team members, including our CISO, up to date on the latest industry developments and best practices.


text: Unauthorized access: Unauthorized access could be due to password theft, malware attacks, employee involvement, or hackers. Preventing unauthorized access is a top priority within our cybersecurity protocols.

companyName: AtlasClear Holdings, Inc.

ticker: ATCH