text: Our Information Security and Privacy teams reduce first and third-party risk by maintaining a proactive security posture aligned with current threats, detecting cybersecurity events and responding quickly, and building procedures to rapidly recover. These teams are managed by the Vice President, Information Security and Privacy, who reports to the Senior Vice President, Chief Strategy and Digital Officer. Our cybersecurity leaders collectively have more than 25 years of relevant experience and multiple professional certifications.


text: Internal and third-party risks are reviewed, monitored, and managed by our Cybersecurity and Privacy teams, audited by an Internal Audit team and various external experts, and tracked within an Enterprise Risk Management framework. We regularly engage third-party experts to assess the effectiveness of our cybersecurity programs. Biennially, an external independent consultancy team conducts an assessment of our cybersecurity program using the inputs from accepted Cybersecurity Frameworks. Targeted assessments are conducted regularly by internal and third-party experts to ensure compliance with specific federal and state laws and regulations. We continue to participate in the VISA TIP program and AMEX STEP program around our PCI DSS compliance.

companyName: GENESCO INC

ticker: GCO

secItem: Item 1C


text: Our processes for identifying and managing first and third-party risks from cybersecurity threats include: • Continuous monitoring of our systems and network for cybersecurity events; • Regular testing of our Security Incident Response Plan, Business Continuity plans, and Disaster Recovery plans; • Required annual security training for our employees with access to email, as well as tailored training for employees in more sensitive roles. Periodic testing to ensure the security training is effective.


text: External managed security services providers and industry-leading security tools continuously monitor our systems and network for cybersecurity threats. Our cybersecurity teams evaluate the escalated threats, and if necessary, take steps to contain and recover from pervasive threats in accordance with our Security Incident Response Plan. The plan includes reporting and escalation procedures to inform the Executive Committee, Audit Committee, and full Board, as appropriate to enable them to carry out their oversight responsibilities, and to ensure timely compliance with applicable reporting rules. Our Business Continuity Management and Disaster Recovery plans include procedures for business recovery and are tested regularly.


text: No risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Advisor and other third-party service providers. The Advisor manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Kennedy Lewis Capital Co


text: Cybersecurity Program Overview The Advisor has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Advisor actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Advisor to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Advisor's risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on its Chief Compliance Officer ("CCO") and the experience of risk management, legal, information technology, and compliance personnel of the Advisor when identifying and overseeing risks from cybersecurity threats associated with its use of such entities.

stage1Category: Management Role

stage1Method: majority


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the CCO of the Advisor regarding the overall state of the Advisor's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, and the CCO of the Advisor, manage the Company's cybersecurity program. The CCO is responsible for monitoring and reporting to the board about the Advisor's compliance with its responsibilities for the Advisor's and the Company's cybersecurity program. The CCO has been responsible for this oversight function as CCO to the Company since inception and has worked in the financial services industry for more than 30 years, during which time the CCO has gained experience in assessing and managing risk applicable to the Company.

stage1Method: unanimous


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our cybersecurity risk management program includes: • Experienced third-party consultants and/or service providers that assist us to develop, implement, and maintain information technology risk management measures. • Oversight of executive management with experience in areas relating to cybersecurity. • Threat protection software, including, anti-virus, anti-malware, email link protection, and email spam filters that are fine-tuned to mitigate threats to our organization. • Cloud-based service providers that require strong passwords, access controls, and multi-factor authentication. • Periodic cybersecurity and phishing awareness training of our employees, including computer-based training and internal communications. • Annual business continuity testing. • Periodic reporting to the board of directors on matters relating to cybersecurity.

companyName: Global Self Storage, Inc.

ticker: SELF


text: Management of Material Risks & Integration into Overall Risk Management Our management team engages with experienced third-party service providers to assist us to develop, implement, and maintain information technology risk management measures. In addition, we have executive management with experience in areas relating to cybersecurity. We also foster a culture of cybersecurity awareness and have incorporated cybersecurity considerations into our decision-making processes. Our management team works closely with our third-party service providers to identify, evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our collaboration with third-party service providers includes threat assessments and consultation on security enhancements. In addition, the Company provides cybersecurity and phishing awareness training to our employees periodically.


text: Oversight of Board of Directors The board of directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats and oversees the Company's cybersecurity risk management activities. The board of directors receives updates on the Company's cybersecurity risks and protective measures periodically. Cybersecurity matters are reported to the board of directors so that the board of directors can effectively carry out their oversight role.

stage1Category: Board Governance


text: Risks from Cybersecurity Threats We have not identified risks from known cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risks Related to our Self Storage Properties and our Business - We rely on information technology in our operations, and any material failure, inadequacy, interruption or security breach through cyber-attacks, cyber-intrusions, or other methods could disrupt our information technology networks and related systems and harm our business."


companyName: Overland Advantage


text: Cybersecurity Program Overview The Advisor has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks applicable to the Company. The Advisor actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

stage1Category: Risk Management Process


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of information technology risk management, legal and compliance personnel of the Advisor, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters. The Board receives periodic updates from the Company's Chief Compliance Officer regarding the overall state of the Advisor's cybersecurity program, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's Chief Compliance Officer, is responsible for assessing and managing material risks from cybersecurity threats. The Chief Compliance Officer oversees the Company's risk management function generally and relies on the Chief Technology Officer of the Advisor to assist with assessing and managing material risks from cybersecurity threats. The Chief Technology Officer of the Advisor has over 26 years of experience in actively managing information technology programs, including cybersecurity, and is supported by an experienced team who assist with the cyber programs applicable to the Company. The Chief Compliance Officer has been responsible for this oversight function as Chief Compliance Officer to the Company for over one year and has worked in the financial services industry for over 32 years, during which the Chief Compliance Officer has gained expertise in assessing and managing risk applicable to the Company.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

stage1Category: Strategy Integration


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: BEASLEY BROADCAST GROUP INC

ticker: BBGI


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that is based on their respective risk profile and criticality to our business.


text: We have no t identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Risk Factor - "We are vulnerable to disruptions and security breaches of our information technology infrastructure and confidential information, which could cause material adverse effects on our business and reputation."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from the Chief Technology Officer and internal security staff as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including the Senior Vice President of Information Technology & Security and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes a Senior Vice President of Information Technology & Security with 20 years of experience in information technology and a General Counsel with 11 years of cybersecurity oversight responsibilities.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engage d by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure We manage cybersecurity threats as part of our general risk mitigation, evaluation, and oversight processes. We implement our cybersecurity program internally through established policies, standards, and the use of enterprise security services that focus on emerging and ongoing cybersecurity risks. We manage these risks to our employees, customers, stockholders, and business partners through a coordinated and consistent IT risk management process overseen by the Senior Manager, IT who assumes the role of our Chief Information Security Officer ("CISO").

companyName: Sonendo, Inc.

ticker: SONX


text: Our information risk management framework is designed to manage and protect against risks in three broad categories: (i) operational risk; (ii) financial risk; and (iii) safety, environmental, and regulatory risk. We consider and evaluate reputational risk as an element of each of these risk categories.


text: We conduct regular security and awareness training for all new hires and for current employees. Employees are required to apply risk assessment processes and to professionally assess risks in the course of performing their job duties.


text: We conduct vulnerability scans of business critical systems on an annual, quarterly, and daily basis. We utilize external third parties to assist in assessing our systems, conduct scans and provide reports based on these scans and we address vulnerabilities as they are identified. We generally review current and prospective third party service providers for cybersecurity risks.


text: Management, under the supervision of our Chief Information Security Officer (CISO), is directly responsible for assessing and managing cybersecurity risks and otherwise implementing our cybersecurity program, which includes our Incident Response Policy and Incident Response Procedure. The CISO reports directly to our Chief Executive Officer. Our CISO has over ten years of IT experience and nine years of significant experience managing cybersecurity threats across our industry. The CISO may call upon business and legal stakeholders across our company to manage cybersecurity threats and incidents.


text: The audit committee of our board of directors is responsible for oversight of the company's programs, policies, procedures, and risk management activities related to information security and data protection. The audit committee meets regularly with CISO to discuss threats, risks, and ongoing efforts to enhance cyber resiliency, as well as changes to the broader cybersecurity landscape. Management promptly updates our board of directors regarding significant threats and incidents as they arise.


text: Cybersecurity Risk Management and Strategy We continuously monitor our information systems to assess, identify, and manage risks from vulnerabilities and assess cybersecurity threats. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process. We monitor risks through routine security assessments and implementation of enhancements to security measures used to protect our systems and data. We address system alerts on an ongoing basis. We maintain an Incident Response Plan Policy ("IRP") that sets forth processes we will follow to address incidents defined therein to include actual or reasonably suspected cyber incidents. Our information technology team promptly responds to system alerts and reported incidents that indicate the suspected presence of an incident and escalates in accordance with the IRP. The IRP, among other things, provides for a cross-functional team consisting of representatives from informational technology, risk management, legal, and communications, an Incident Response Team ("IRT"), that collaborates to quickly assess the impact, mitigate risks to information systems, and resolve incidents while improving information systems. Depending on the incident, we may utilize third-parties for assistance in investigating and addressing cybersecurity incidents.

companyName: Nkarta, Inc.

ticker: NKTX


text: We also utilize certain third-party service providers to perform a variety of critical business functions and recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. We have certain vendor management processes designed to help manage cybersecurity risks associated with our use of certain of these providers. Additionally, we strive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process.

stage1Category: Third-Party Risk


text: We have not had cyber incidents that have materially affected our business or financial condition. For details about our risks associated with cybersecurity threats, see "—Computer system interruptions or security breaches of our information systems could significantly disrupt our product development programs and our ability to operate our business." in the section titled "Risk Factors" in Part I, Item 1A in this Annual Report on Form 10-K.


text: Cyber Risk Management and Strategy We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of the Investment Manager and other third-party service providers. The Investment Manager manages our day-to-day operations and has implemented the Investment Manager's Information Security Program ("ISP") that applies to the Company and its operations.

companyName: AB Commercial Real Estate Private Debt Fund, LLC


text: Governance Related to Cybersecurity Risks Management is responsible for identifying and assessing material risks for the business on an ongoing basis, including in relation to cybersecurity. As part of this process, our IRT is tasked with implementing and maintaining our cybersecurity programs, including establishing processes to ensure that potential cybersecurity risk exposures are monitored and putting in place appropriate mitigation measures. Our Chief Financial and Business Officer oversees our information technology department which monitors the prevention, detection, mitigation, and remediation of cyber incidents, if any, and reports all potential incidents and an initial assessment of such incident to the IRT. Our Chief Financial and Business Officer has over 7 years of experience with overseeing risk, compliance, and information technology functions.


text: Our Board of Directors (the "Board") oversees our risk management program as part of its general oversight function. The Board's Audit Committee is delegated the responsibility for reviewing and discussing with management our program to identify, assess, manage, and monitor significant business risks, including financial, operational, privacy, business continuity, legal and regulatory, reputation risks, and security, including cybersecurity. The Audit Committee receives quarterly updates from management regarding investigated incidents and periodic updates from management regarding cybersecurity matters (including the current threat landscape and cybersecurity risks). The Audit Committee may provide updates to the Board on the substance of these reports and any recommendations for improvements that the Audit Committee deems appropriate.


text: Cybersecurity is a significant and integrated component of the Company's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. The Company engages third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits.


text: The Information Technology ("IT") Department of the Company is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats. The Information Technology Department is managed by the Chief Information Officer (the "CIO") who reports directly to the Company's Chief Operating Officer and Chief Financial Officer. The CIO has more than 38 years of relevant experience both with the Company and with other organizations in the IT field. The CIO also oversees the Company's Information Security Program and manages a third-party consultant that is an expert in the Information Security field and acts as our Information Security Officer ("ISO"). The Information Security Program is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The IT Department conducts on-going technology and IT threat meetings to ensure the latest threats are addressed in addition to penetration, business continuity/ disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Company's management-level Information Technology and Information Security Committee ("IT/IS Committee"), and presents information security and cybersecurity updates on a monthly basis to the IT/IS Committee and periodically to the Board of Directors.


text: The IT/IS Committee provides oversight, from a risk perspective, of information systems security. As referenced above, the CIO and ISO provide information security updates to the IT/IS Committee at each IT/IS Committee meeting. Additional information security training for the committee is provided through targeted training overseen by the ISO. In addition, as discussed below, the Company has implemented an Incident Response Plan to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of the Company. The Incident Response Plan is implemented and maintained by the CIO and ISO and is subject to annual review and approval by the Board of Directors. At least annually, the ISO coordinates tabletop testing events where senior management participate in a coordinated response exercise to disastrous scenarios that could happen to the Company. Cybersecurity metrics are reported to the IT/IS Committee on a monthly basis.


text: The Board of Directors recognizes the importance of the Interagency Guidelines Establishing Standards for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program.


text: Risk Assessment. On a periodic basis, but not less than annually, the CIO and ISO, in conjunction with the IT/IS Committee, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Company's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The IT/IS Committee reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.


text: Response to Security Vulnerabilities. In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: • Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches. • Ensuring that changes to security configurations are documented, approved, and tested. • Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. • Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. • Conducting subsequent penetration testing and vulnerability assessments, as warranted. • Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Company.


text: Internal Controls, Audit, and Testing. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing to test the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.


text: Service Providers. Like many companies, the Company relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Third-Party Risk Management Program, which is implemented through a Third-Party Risk Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Third-Party Risk Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Third-Party Relationships: Risk Management. The Third-Party Risk Management Program is audited as part of the Company's annual Internal Audit Risk Assessment.


text: Employees and Training. Employees are the first line of defense against cybersecurity measures. Each employee is responsible for protecting Company and customer information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to monthly simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.


text: Board Reporting. At least annually, the CIO and ISO report to the Board, directly, the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: Program Adjustments. The CIO and ISO monitor, evaluate, and adjust the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.


text: Incident Response Plan. To ensure that information security incidents can be recovered from quickly and with the least impact to the Company and its customers, the Company maintains a structured and systematic incident response plan (the "IRP") for all information security incidents that affect any of the IT systems, network, or data of the Company, including the Company's data held, or IT services provided by third-party vendors or other service providers. The CIO and ISO are responsible for implementing and maintaining the IRP, which includes: a) Identifying the incident response team ("IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents.


text: b) Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents.


text: c) Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures. d) Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP.


text: e) Reviewing the IRP at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures.


text: For a description of the risks from cybersecurity threats that may materially affect the company and how they may do so, please see "Risk Factors – Risks Related to Employees, Managing Our Growth and Other Legal Matters."

companyName: Equillium, Inc.

ticker: EQ


text: We rely on the digital technology of the Investment Manager to conduct our business operations and engage with our clients and business partners. The technology that our Investment Manager, clients, and business partners rely upon becomes more complex over time as do threats to our business operations from cyber intrusions, denial of service attacks, manipulation and other cyber misconduct. Information Security is an ongoing process of exercising due care that is designed to protect corporate, client and employee information and systems from unauthorized access, destruction, disclosure, disruption and modification of use.

stage1Category: None/Other


text: Through a combination of security, risk and compliance resources, the Investment Manager implements information security through a dedicated ISP that is intended to identify, assess and manage material risks from cybersecurity threats applicable to the Company, and which includes a focus on safeguarding information and assets from cyber threats, engaging in cyber threat monitoring and responding to actual or potential cyber incidents. Our ISP is led by the Investment Manager's Chief Information Security Officer ("CISO") who actively partners with the Investment Manager's Chief Compliance Officer and Chief Risk Officer and, in turn, the Company's Board and Secretary. Ultimately, we rely on the Investment Manager's full enterprise risk framework, which includes the ISP, information technology, business continuity, resiliency and cybersecurity risk, in combination with a broader risk management team, including the Investment Manager's Chief Security Officer.


text: The Investment Manager's CISO, with assistance from internal and external resources, is responsible for implementing and providing oversight of the ISP that applies to the Company. The ISP employs a defense-in-depth strategy: an information assurance concept in which multiple layers of security controls are distributed throughout an operating environment. The concept manages risk with diverse defensive strategies, so that if one layer of defense fails, another layer of defense will attempt to compensate. The ISP features cybersecurity policies, standards and guidelines, committee governance, training, access controls and data controls.


text: The ISP, together with related risk and compliance resources, is designed to proactively manage the risk of threat from cybersecurity incidents through (i) implementing protocols to take cybersecurity considerations into account in adopting and onboarding our technology resources, (ii) monitoring IT controls to better ensure compliance with cybersecurity and other related legal and regulatory requirements, (iii) assessing adherence by critical and material third parties we partner with to ensure that the appropriate risk management standards are met, (iv) ensuring essential business functions remain available during a business disruption, and (v) regularly developing and updating response plans to address potential IT or cyber incidents should they occur. The Investment Manager's security, risk and compliance resources are designed to prioritize IT and cybersecurity risk areas, identify solutions that minimize such risks, pursue optimal outcomes and maintain compliance standards. We also rely on the Investment Manager's ISP to maintain an operation security function that has a real time response capability that triages potential incidents and triggers impact mitigation protocols.


text: Additionally, we rely on the Investment Manager to utilize third parties to conduct periodic cybersecurity assessments, including assessments impacting the Company, and the Investment Manager's internal audit function includes certain cyber risk audits as part of any overall risk audit. We rely on the Investment Manager to review the recommendations and findings from those assessments and audits and implement corrective and other measures as appropriate and as may be relevant to the Company. The Investment Manager's cybersecurity processes rely predominantly on internal resources, but also include important third party resources for certain matters, including the aforementioned assessments as well as our continuous cybersecurity threat monitoring and initial incident reporting system.


text: As part of the ISP that is applicable to the Company, the Investment Manager also performs cyber risk assessments on the Company's critical and material third party vendors during onboarding and periodically thereafter.


text: During the reporting period, we have not had a cybersecurity incident that has materially affected, or was reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition, including as discussed in "Item 1A. Risk factors – A failure in cyber security systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning could impair our ability to conduct business effectively," although we do not currently believe that such a result is reasonably likely.


text: Cyber Risk Governance The Board provides strategic oversight over the Company generally, including oversight of risks associated with cybersecurity threats. The Investment Manager's CISO and the Company's Secretary periodically report to the Board on the status of the Investment Manager's ISP, cybersecurity risks, risk management policies and risk assessment initiatives. Such reports particularly emphasize any material risks concerning the Company.


text: Our board of directors addresses the company's cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for reviewing the company's guidelines and policies with respect to risk assessment and risk management, including those related to assessment and mitigation of risks from cybersecurity threats.


text: The Secretary of the Company relies on the Investment Manager's Chief Compliance Officer to assist with assessing and managing material risks from cybersecurity threats. The Investment Manager's Chief Compliance Officer has 13 years of experience in the financial services industry, and during such time has acquired relevant experience overseeing and actively managing cybersecurity and information security programs for financial services companies with complex information systems. The Company's Secretary has been responsible for the general oversight function as Secretary to the Company since its inception and has worked in the financial services industry for 11 years.


text: Management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with ISP personnel of the Investment Manager.


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program, and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Adviser's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and are fully integrated into the Adviser's overall risk management processes. In general, the Adviser seeks to address material cybersecurity threats through a entity-wide approach that addresses the confidentiality, integrity, and availability of the Adviser's information systems or the information that the Adviser collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: TCW Direct Lending VII LLC


text: Cybersecurity Risk Management and Strategy The Adviser's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Adviser has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Adviser's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: The Adviser implements technical safeguards that are designed to protect the Adviser's information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as assistance from third party experts where necessary. • Incident Response and Recovery Planning: The Adviser has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Adviser's response to a cybersecurity incident. The Adviser conducts occasional tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Adviser maintains a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Adviser's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside consultants who advise on the Adviser's cybersecurity systems. • Education and Awareness: The Adviser provides regular, mandatory training for all levels of personnel regarding cybersecurity threats as a means to equip the Adviser's personnel with effective tools to address cybersecurity threats, and to communicate the Adviser's evolving information security policies, standards, processes, and practices.


text: The Adviser conducts periodic assessment and testing of its policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. This includes penetration testing of network infrastructure and phishing tests targeting the Adviser's employees. The results of such assessments and reviews are evaluated by management, and the Adviser adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments and reviews.


text: The Board receives annual updates and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by the Company'. The Board also receives prompt and timely information regarding any material cybersecurity risk, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Adviser discuss the Company's approach to overseeing cybersecurity threats.


text: The Adviser has established an internal working group that includes relevant representation from senior management including the CCO, COO and CISO who work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans.


text: The CISO has served in various roles in information technology and information security for many years and holds relevant professional certifications. The Adviser's COO and CCO each hold educational and professional degrees in their respective fields, and each has numerous years of experience managing risk at the Company and at similar companies, including assessing cybersecurity threats.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain company management, including our Head of IT, who holds a Microsoft Certification, and our Chief Operating Officer, who earned a Cybersecurity for Directors certificate from the Corporate Governance Institute.


companyName: TCW Direct Lending VIII LLC


companyName: TCW Star Direct Lending LLC


text: Management is also responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the company's overall risk management strategy, and communicating key priorities to relevant personnel. The Head of IT and Chief Operating Officer are responsible for helping prepare the company for cybersecurity incidents, training personnel, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: An Incident Response Team that includes representatives from key areas of the Corporation meets in the event of cybersecurity incidents. This Team receives special training, including an annual tabletop exercise. The Team ensures the proper notifications are made to comply with all relevant laws, rules, regulations, and policies.

companyName: ENB Financial Corp

ticker: ENBP


text: Risk Management Strategy We have developed our cybersecurity risk management program, including a cybersecurity incident response plan, based on the National Institute of Standards and Technology Cybersecurity Framework's (NIST CSF) principles: Identify, Protect, Detect, Respond, and Recover. This does not, however, imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Boundless Bio, Inc.

ticker: BOLD


text: Our cybersecurity risk management program, which is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas, is intended to address current vulnerabilities and anticipate future cybersecurity threats and risks to our cyber ecosystem. Our cybersecurity risk management program includes: (a) assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; (b) a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; (c) the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; (d) cybersecurity awareness training of our employees, including our senior management, and incident response personnel; (e) a cybersecurity incident response process that includes procedures for responding to cybersecurity incidents; and (f) a risk evaluation of the service providers, suppliers, and vendors of critical systems during contracting.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances and designated risk level, including the Chief Financial Officer, Chief Executive Officer and/or full Executive Leadership Team, who participates in our disclosure controls and procedures. The Head of IT and Chief Operating Officer work with the company's incident response team to help the company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the company's incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: During the year ended December 31, 2024, there were no cybersecurity incidents that materially affected or are reasonably likely to materially affect the Corporation.


text: As of the filing date of this report, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance, however, that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. For more information, see the section titled "Risk Factors—Risks Related to Our Business Operations and Industry— Our information technology systems, or those of any of our service providers, may fail or suffer security incidents and other disruptions, which could result in a material disruption of our ecDTx development programs, compromise sensitive information related to our business, or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to our audit committee oversight of cybersecurity and other information technology risks. Our audit committee oversees our management team's implementation of our cybersecurity risk management program, receives periodic reports from our management team on our cybersecurity risks, and receives reports from our management team, as necessary, regarding material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our audit committee reports to our board of directors regarding its activities, including those related to cybersecurity. Our board of directors also receives briefings from our management team on our cyber risk management program.


text: O ur management team is responsible for assessing and managing our material risks from cybersecurity threats, and has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, lab equipment, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical studies and employees, or Information Systems and Data.


text: We engage an external Head of Information Technology, or IT, consultant to work with the company, including the Chief Operating Officer, Chief Financial Officer, and Executive Leadership Team, to help identify, assess and manage the company's cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, and evaluating threats reported to us.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plan and/or incident response policy, data and information protection plans, network security and access controls for certain systems, encryption of data, systems monitoring, cyber insurance and employee training.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the company's overall risk management processes. For example, the Head of IT works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We may use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms (including legal counsel) and threat intelligence service providers.


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as outsourced business critical functions, clinical research, professional services, Software-as-a-Service, or SaaS, platforms, managed services, cloud-based infrastructure, encryption and authentication technology, corporate productivity services, and other functions. We have certain vendor management processes to help manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, requiring their completion of written questionnaires regarding their services and data handling practices and conducting periodic re-assessments during their engagement.


text: The audit committee receives periodic reports from the Head of IT and Chief Operating Officer concerning the company's significant cybersecurity threats and risk and the processes the company has implemented to address them. The audit committee also receives summaries or presentations related to the company's information systems and data and cybersecurity threats, risk and mitigation.


text: Cyber Risk Management and Strategy As part of our enterprise risk management program, we have implemented and maintain policies and processes to identify and mitigate risks posed by cybersecurity threats. Our policies and processes are based upon the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and we utilize technologies to help identify and manage potential cyber threats. We have also secured cyber-specific insurance coverage as part of our overall insurance portfolio.

companyName: Savara Inc

ticker: SVRA


text: We have engaged an independent, third-party services provider to assist in monitoring our information technology systems, as well as identifying, assessing, and mitigating the associated cyber risk. With that provider, we conduct periodic assessments of our information security program to evaluate the effectiveness of applicable security controls, which include penetration testing, vulnerability scanning, and red teaming. Our Chief Financial and Administrative Officer ("CF&AO") reviews the results of those assessments with our third-party provider to reasonably address any identified potential gaps. We also utilize a range of tools and services to help ensure material threats are prevented or the risks of such threats are mitigated, which include, network and endpoint monitoring, system patching, user and server backups, annual awareness training, and periodic vulnerability evaluation. Management reviews monthly monitoring reports and meets with our third-party provider on a regular basis to review activities and debrief on any key IT-related issues.


text: We have an employee education program that includes annual training designed to raise awareness of cybersecurity threats, and we require employees to review and acknowledge our IT Security Policy on an annual basis. Additionally, we have adopted an IT Incident Response Plan that outlines the procedures to be followed in response to a data breach, whether internal or through a third-party, that are designed to help contain, assess, and respond to the incident and mitigate potential harm.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our operations as well as loss, misuse, or theft of information and other data, confidential information, or intellectual property. However, to date, these incidents have not had a material impact on our operations. Any significant disruption to our service or access to our systems could adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of information could subject us to business, regulatory, litigation, and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See Risk Factors – Risks Related to Information Technology and Data Privacy.


text: Governance Related to Cybersecurity Risks The Audit Committee of our Board of Directors is responsible for the general oversight of risks related to data privacy and cybersecurity. The Audit Committee periodically reviews the Company's cybersecurity program with management, including (i) the adequacy of controls and security for the Company's information technology systems and (ii) the Company's response plan in the event of a security breach impacting those systems. Our CF&AO has primary responsibility for overseeing the day-to-day management of cybersecurity risks and has served in that role for three years. Our CF&AO oversees the policies and processes described above and provides the periodic management briefings to the Audit Committee, including any cybersecurity incidents and related responses. Further, at least annually, the Board of Directors receives updates of potential cybersecurity incidents, as well as the data privacy and compliance programs, and its members actively participate in discussions with management regarding cybersecurity risks.


text: The Board's Roles and Responsibilities The Board of Directors, as a whole and at the subcommittee level, oversees and monitors our cybersecurity risk, receiving regular updates from management on the status of our current cybersecurity risks, a prioritization of key risk areas to be mitigated, and any significant cyber incidents that have occurred or are reasonably likely to occur.

companyName: Third Harmonic Bio, Inc.


text: Since 2023, we have engaged in periodic formal cybersecurity risk assessments conducted by an expert third party. The findings from that formal assessment have informed our ongoing cybersecurity roadmap which is updated at least annually. The Audit Committee plays a key role by ensuring that the prioritization of the roadmap supports our business objectives, and by making decisions, when called upon, of whether specific cybersecurity risks should be mitigated or if that risk is acceptable to the business.


text: Risk Management and Strategy Information technology and the digital transformation of our assets and business processes are critical to our growth strategy. Inherent to information technology and digital transformation is the commensurate cybersecurity risk, which we manage by maintaining a cybersecurity program that is integrated into our overall risk management process.


text: Our cybersecurity program is overseen by our Director, IT Infrastructure & Cybersecurity and utilizes a risk-based methodology to support the confidentiality, integrity and availability of our digital assets. The cybersecurity program is supported at the highest level within the Company, formally reporting to the Audit Committee twice annually and more often if required.


text: As a part of the cybersecurity program, we conduct assessments, both internally and by independent third parties, to identify and prioritize the mitigation of cybersecurity risks. We also maintain a formal and mandatory cybersecurity awareness training program for all employees that includes annual training on information security best practices in high risk areas such as phishing and authentication. Additional role-based training is provided to finance team members, due to the elevated privilege and risk associated with their duties. All employees are also tested periodically for their cybersecurity awareness.


text: We rely on information technology systems and infrastructure for many of our business and internal processes. Some of these systems and infrastructure are managed by third-party service providers who are not under our direct control. In order to mitigate material risks from our critical finance-related third-party service providers, we annually review their SOC1 reports for any noted material incidents and risks.


text: For our non-finance service providers, we are currently implementing cybersecurity controls, including but not limited to requiring all critical vendors to notify us should the vendor fall victim to, and become aware of a material cybersecurity incident, and reviewing any available SOC2 or similar compliance reports should they be available. Our vendor selection and management processes include the assessment of vendors' cybersecurity controls.


text: While tools and processes are in place to mitigate cybersecurity risks, we are continuing to establish an Incident Response Plan, or IRP, to analyze, contain, and remediate any cybersecurity incidents which may occur despite these mitigations. The IRP, based on the National Institute of Standards and Technology framework, defines a timely, consistent, and compliant response to cybersecurity incidents and includes notifications to the Audit Committee and any relevant governing bodies such as the SEC in the event that the cybersecurity incident is deemed to be material.


text: Although we have implemented a cybersecurity program designed to protect and preserve the confidentiality, integrity and availability of our information systems and assets, we also maintain cybersecurity insurance to manage potential liabilities resulting from specific cyber incidents. However, it is important to note that although we maintain cybersecurity insurance, there can be no guarantee that the insurance will cover us, wholly or partially, from potential liabilities, or that such insurance proceeds will be paid to us in a timely manner.


text: While we are not aware of any significant cybersecurity incidents that have occurred to date, we are exposed to, and may in future be adversely impacted by cyberattacks and interruptions to our information technology systems and infrastructure. Despite the security measures we have implemented, certain cyber incidents could materially disrupt our operational systems, and/or result in the loss of trade secrets, proprietary information, or competitively sensitive data.


text: We seek to maintain a robust and continuously improving cybersecurity program however the impact of certain cybersecurity incidents could have a materially adverse impact on our competitive position, reputation, operations and/or financial position. We remain vigilant in continuously improving our cybersecurity program and its controls.


text: Governance and Management's Responsibilities IT management is responsible for the cybersecurity program that assesses and manages cybersecurity risk. Specifically, our Director, IT Infrastructure & Cybersecurity is responsible for the prevention, mitigation, detection, and remediation of cybersecurity incidents while at the executive level, the Chief Administrative Officer oversees the program and is the executive sponsor.


text: Our Director, IT Infrastructure & Cybersecurity monitors cybersecurity incidents and does so by working closely with expert technology and security partners. We and our partners deploy a variety of technologies and processes, including but not limited to intrusion monitoring, detection and response, patch management, threat hunting, identity and access management, assessments, audits and tests.


text: Our Director, IT Infrastructure & Cybersecurity has relevant expertise in cybersecurity having spent the previous two years prior to joining the Company building a SOX compliant IT controls framework for a biotechnology company in preparation for its initial public offering. Prior to that, our Director, IT Infrastructure & Cybersecurity spent five years at a publicly traded pharmaceuticals company, where he was responsible for the SOX cybersecurity and compliance of systems, processes, and policies. In addition to SOX compliance, our Director, IT Infrastructure & Cybersecurity has extensive experience with other compliance frameworks, including National Institute of Standards and Technology (NIST), HIPAA, Clinical Laboratory Improvement Amendments (CLIA), and GxP security models.


text: Cybersecurity threats, including any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect us, including its business strategy, results of operations or financial condition.


text: Cybersecurity Risk Management and Strategy We have implemented a cybersecurity risk management program in accordance with our risk profile and business size that is informed by recognized industry standards, including elements of the National Institute of Standards and Technology Cybersecurity Framework and International Organization for Standardization 27001 Framework.

companyName: Septerna, Inc.

ticker: SEPN


text: Our cybersecurity risk management program is comprised of a number of components, including but not limited to written information security policies, external cybersecurity risk assessments, and system monitoring. We also have an employee privacy and data security training awareness program that includes cybersecurity risk awareness trainings and phishing campaigns. We maintain an incident response plan to help guide our response to cybersecurity incidents.


text: We leverage the cybersecurity services of third-party vendors, including a third-party managed services provider and IT consultants, to support our cybersecurity risk management program and assist us in conducting external cybersecurity risk assessments. As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors. As part of our vendor diligence process we require vendors with access to our information technology systems and infrastructure to complete information security program questionnaires.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats relating to our and our third-party vendors' information systems and infrastructure. For more information, please see "Item 1A, Risk Factors."


text: Governance Related to Cybersecurity Risks Our board of directors has delegated cybersecurity risk management to our Audit Committee as part of the Audit Committee's general risk oversight function. The Audit Committee, through the oversight of the General Administrative Leadership team, is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our General Administrative Leadership team, which consists of our CEO, CFO, COO, CPO, Vice President of Finance and Business, Vice President of Technology and our Head of Information Technology ("IT"), and is responsible for the strategic leadership of our cybersecurity risk management program. Our Head of IT, who also serves as our Information Security Officer, is responsible for the day-to-day management of our cybersecurity risk management program. The individual who is currently in this role has over thirty years of experience in information technology and cybersecurity risk management. Our Head of IT relies on both internal and external cybersecurity resources to manage and remain appraised of overall cybersecurity risks to our business and our industry.


text: The General Administrative Leadership team provides regular briefings regarding cybersecurity risk and related matters to our Audit Committee. Such briefings may include a discussion of cybersecurity risks and applicable risk assessments, key updates regarding our cyber strategy and related initiatives, and the emerging cybersecurity threats that may impact our business. We also provided the full board of directors with updates on matters relating to cybersecurity risk management, as necessary.


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. The Company has designed and implemented a cybersecurity incident response plan and related processes, which is overseen by an internal information technology specialist. Cybersecurity threats are identified and escalated to a member of management pursuant to criteria set forth in these processes.

companyName: Sow Good Inc.

ticker: SOWG


text: The audit committee of the board of directors (the "Audit Committee") is responsible for establishing and monitoring the integrity and effectiveness of controls and other procedures, which are designed to ensure that (1) all information required to be disclosed is recorded, processed, summarized, and reported accurately and on a timely basis, and (2) all such information is accumulated and communicated to management and the Company's board of directors, as appropriate, to allow for timely decisions regarding such disclosures. The controls and procedures subject to the Audit Committee's oversight include processes related to managing material risks from cybersecurity threats. Accordingly, the Company's cybersecurity processes have been integrated into the Company's overall processes.


text: The Audit Committee operates under a written charter adopted by the Company's board of directors. The Audit Committee oversees, among other things, a system of internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is also responsible for the adequacy and effectiveness of the Company's internal controls, including those internal controls that are designed to assess, identify, and manage material risks from cybersecurity threats.


text: The Audit Committee is informed of material risks, if any, from cybersecurity threats pursuant to escalation criteria set forth in the Company's disclosure controls and procedures. Further, at least once per quarter, a member of the Company's Audit Committee reports material risks, if any, from cybersecurity threats to the Company's board of directors. The Company's management team also assesses and manages material risks, if any, from cybersecurity threats.


text: We use third-party service providers, including cybersecurity consultants, to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats.

companyName: CalciMedica, Inc.

ticker: CALC


text: The Audit Committee is responsible for establishing and monitoring the integrity and effectiveness of controls and other procedures, including controls and procedures related to managing material risks from cybersecurity threats, which are designed to ensure that (1) all information required to be disclosed is recorded, processed, summarized, and reported accurately and on a timely basis, and (2) all such information is accumulated and communicated to management and the Company's board of directors, as appropriate, to allow for timely decisions regarding such disclosures.


text: The Company's Information Technology Manager oversees the Company's incident response plan and related processes designed to assess and manage material risks, if any, from cybersecurity threats. The Information Technology Manager also coordinates with any consultants, auditors and other third parties to assess and manage material risks, if any, from cybersecurity threats.


text: The Company's Information Technology Manager is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes. The Company's Information Technology Manager is also informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to notification criteria set forth in the Company's contracts with third-party service providers. Further, the Company's Information Technology Manager is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to reports prepared by consultants, auditors, and other third parties retained by the Company, if necessary, to investigate cybersecurity incidents.


text: The Company's Information Technology Manager informs the Audit Committee of cybersecurity incidents that may be material pursuant to escalation criteria set forth in the Company's incident response plan and related processes.


text: The Company's Information Technology Manager or a delegate thereof also prepares a report for the Audit Committee and the Company's board of directors concerning material risks, if any, from cybersecurity threats at least once per quarter, and more often to the extent necessary pursuant to the escalation criteria set forth in the Company's processes described herein.


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information concerning risks related to cybersecurity, see Item 1A. Risk Factors.


text: The Trust does not have a board of directors; therefore, the Trustee is responsible for oversight of the Trust’s risks from cybersecurity threats. The Trustee has dedicated personnel that are responsible for assessing and managing the Trust’s cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee’s information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. External partners are a key part of the Trustee’s cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.

companyName: CROSS TIMBERS ROYALTY TRUST

ticker: CRT


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee’s overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third-party vendor, of the Trustee’s cyber risk management program.


text: Other, non-technical protocols include securing of documents and work areas that could contain personal, non-public information and independent verification of information changes by outside vendors.


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust’s business, financial condition, results of operations, or cash flows. See Item 1A. Risk Factors – The Trust may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.


text: Cybersecurity risk is assessed at the enterprise level as part of our overall enterprise risk management program. We maintain a dedicated cybersecurity function and program that is led by the Chief Information Security Officer ("CISO").

companyName: FIVE BELOW, INC

ticker: FIVE


text: Cybersecurity Risk, Management, and Strategy Cybersecurity is a significant and integrated component of the Company's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Bank's information services. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident disrupting business operations, compromising sensitive data or both. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company, including its business strategy, results of operation or financial condition.

companyName: BV Financial, Inc.

ticker: BVFL


text: To prepare and respond to incidents, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. This includes advanced employee training, innovative technologies, and policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third Party Risk Management, and Incident Response.


text: Core activities supporting our strategy include cybersecurity training, technology optimization, threat intelligence, vulnerability and patch management and the testing of incident response, business continuity and disaster recovery capabilities.


text: Employees are the first line of defense against cybersecurity measures. Every employee is responsible for protecting Bank and client information. Accordingly, employees complete formal training and acknowledge security policies annually. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities.


text: Our employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, vulnerability scanning, third-party monitoring, and threat intelligence.


text: Like many companies, the Company relies on third-party vendor solutions to support its operations. Many of these vendors have access to sensitive and proprietary information. Third-party vendors continue to be a notable source of operational and informational risk. Accordingly, the Company has implemented a Third-Party Risk Management program, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data.


text: As indicated above, supporting our operations are incident response, business continuity, and disaster recovery programs. These programs identify and assess threats and evaluate risk. Further, these programs support a coordinated response when responding to incidents. Periodic exercises and tests verify these programs' effectiveness.


text: Validating solution and program effectiveness in relation to regulatory compliance and industry standards is important. Accordingly, the Company engages third-party consultants and independent auditors to conduct penetration tests, external audits, program enhancement where applicable and review of cybersecurity risk assessments.


text: Cybersecurity Governance The Company has established an Information Technology Steering Committee consisting of department leaders. The committee focuses on strategic and tactical delivery as well as policy oversight. All such policies are approved by the board of directors. All Information Security activity is led by the Information Security Officer.


text: Risk management and strategy We have implemented and maintain information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our clinical trial data ("Information Systems and Data").


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response and disaster recovery plan, disaster recovery testing, data encryption for certain data, asset management, system monitoring and multi-factor authentication for certain systems, employee training and cybersecurity insurance.


text: We use a third-party information technology consultant to help identify, assess and manage the Company's cybersecurity threats and risks. This consultant reports to and works with our management team, including our Chief Scientific Officer and President and Chief Operating Officer to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods and tools including for example by subscribing to reports and services that identify cybersecurity threats, leveraging certain system monitoring tools, and leveraging tools provided through Microsoft Office 365.


text: Our assessment and management of material risks from cybersecurity threats are taken into account as part of the Company's risk management processes. For example, our senior management works with our information technology consultant to evaluate material risks from cybersecurity threats against our overall business objectives.


text: We use third-party service providers to perform a variety of critical functions throughout our business, such as hosting providers, application providers, contract research organizations, contract manufacturing organizations, and other third-party service providers. We review the cybersecurity risks associated with the use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment and due diligence designed to help identify cybersecurity risks associated with a vendor, as well as the imposition of security related contractual obligations on the vendor.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including " Our information technology systems, or those of our CROs, contractors, consultants, or other third parties with whom we work, may fail or suffer security breaches, loss or leakage of data, and other disruptions, which could result in a material disruption of our product candidates' development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business. "


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee of the Board of Directors is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Scientific Officer, President and Chief Operating Officer, Chief Financial Officer, Vice President Finance and General Counsel who also serves as our compliance officer. These members of management have prior work experience in various roles involving managing information security programs and are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents.


text: Our Chief Scientific Officer and our President and Chief Operating Officer are responsible for engaging appropriate personnel and companies, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant employees and personnel. Our President and Chief Operating Officer is also responsible for managing budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: We have adopted a Cybersecurity Incident Response Policy which is designed to escalate certain cybersecurity incidents to a Cybersecurity Incident Management Team consisting of our Chief Scientific Officer, President and Chief Operating Officer, General Counsel and our information technology consultant. Depending on the circumstances, cybersecurity incidents are reported to our Chief Executive Officer and Chief Financial Officer. Senior management works to help the Company mitigate and remediate cybersecurity incidents of which they are notified in addition to notifying the Audit Committee of the Board of Directors, as appropriate.


text: The Audit Committee of the Board of Directors receives periodic reports as needed from management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a written data security incident response policy and a security incident response plan, which were first developed in 2017 and are periodically reviewed and updated.

companyName: LANDS' END, INC.

ticker: LE


text: We have designed and assessed our program using the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to our legal, compliance, strategic, operational, and financial risk areas.


text: We are subject to cybersecurity threat risks associated with our use of third-party service providers, including independent clinical investigators, contracted laboratories and contract research organizations. Cybersecurity considerations affect the selection and oversight of these third-party service providers.

companyName: Acrivon Therapeutics, Inc.

ticker: ACRV


text: We engage certain external parties, including cybersecurity and privacy firms and consultants, to provide IT support and cybersecurity oversight, and enhance our risk reduction abilities, including the engagement of a third-party to review our cybersecurity program to help identify areas for continued focus and improvement. We also use automated tools designed to monitor, identify, and address cybersecurity risks.


text: Our cybersecurity risk management program includes: • a written data security incident response policy and a security incident response plan that include detailed procedures for responding to cybersecurity incidents, determining severity of cybersecurity incidents and notifying appropriate internal and external parties; • third-party and internal risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team consisting of members of our information technology department, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • periodic tabletop exercises involving the security team, the data security incident management team, and members of management, with special sessions for the Board of Directors; • annual audit by a Payment Card Industry ("PCI") qualified security risk assessor to validate our PCI-Data Security Standard ("PCI-DSS") compliance; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • regular cybersecurity awareness training, including social engineering and phishing testing of our employees, incident response personnel, and senior management; • deployment of external tools designed to detect and protect against spam, malware and other cybersecurity threats and train personnel; and • third-party security event monitoring.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be adequate, fully complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – RISKS RELATED TO INFORMATION TECHNOLOGY, CYBERSECURITY AND DATA PRIVACY."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of data protection and cybersecurity risks as part of the Audit Committee's oversight of the Company's enterprise risk management framework. The Audit Committee regularly reports to the full Board regarding its activities, including those related to cybersecurity.


text: The Audit Committee receives regular reports from management on our cybersecurity risks, which include updates on trends and threats, the Company's backup and restore systems, internal and external risk assessments, results of PCI and other security audits, and planned updates and upgrades. The Audit Committee also receives regular enterprise risk management updates, which include management of cybersecurity risks.


text: In accordance with our data security incident response plan, management is required to promptly update and discuss with the Audit Committee any material or potentially material cybersecurity incidents and provide an update to the Board upon determination that an incident is material. Management regularly updates the Audit Committee regarding incidents with lesser impact potential.


text: Our management team, including our Chief Financial Officer, Chief Technology Officer and General Counsel (the cybersecurity disclosure committee), is responsible for assessing material risks from cybersecurity threats and our General Counsel oversees any required reporting obligations and notifications. Our Chief Technology Officer has primary responsibility for overseeing our security incident response plan, including identification and initial assessment of threat levels and escalations.


text: Critical incidents are escalated to a cross functional data security incident management team for review, which then escalates potentially material incidents and threats to the cybersecurity disclosure committee for determinations of materiality and Audit Committee and Board communications. Our Chief Technology Officer has over 20 years of experience with cybersecurity management response, and multiple direct reports who have 10 or more years of experience leading technology infrastructure and security incident response. Our General Counsel has over eight years of experience leading our incident response management team.