text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, results of operation, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any material risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operation, and financial condition.


text: In the ordinary course of our business, we may process proprietary, confidential, and sensitive data, including personal data (such as health-related patient data), intellectual property, and trade secrets (collectively, "sensitive information"). We rely upon third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, employee email, CROs, and other functions. The secure maintenance of this sensitive information and our information technology systems is important to our operations. To this end, we have processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by our third-party information technology consultants and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment.

companyName: PALISADE BIO, INC.

ticker: PALI

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: We are planning to establish an appropriate confidentiality framework and document management system in order to safeguard sensitive information in addition to the safeguards provided by our third-party service providers. Such confidentiality framework may include the use of third-party information technology experts to manage and oversee our sensitive information and to work directly with our management in overseeing cybersecurity risks and appropriate responses thereto. In addition, we plan to consult with outside advisors and experts, when appropriate, to assist with assessing and identifying cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.


text: In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks faced by us are discussed in Part I, Item 1A, "Risk Factors," under the headings "If our information systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences" and "Our business and operations would suffer in the event of system failures, cyber-attacks or a deficiency in our cybersecurity."

stage1Category: Strategy Integration


text: Our Board, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives updates, as needed, on cybersecurity and information technology matters and related risk exposures.

stage1Category: Board Governance


text: Risk management and strategy We have implemented a risk-based approach designed to identify, assess and manage cybersecurity threats that could materially affect our business and information systems. We attempt to identify and assess risks from cybersecurity threats by evaluating our threat environment using various methods including, for example: maintaining manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating threats reported to us, and completing third-party cybersecurity threat assessments.

companyName: Annexon, Inc.

ticker: ANNX


text: We use cybersecurity consultants and penetration testing firms in an effort to identify, assess, and manage material risks from cybersecurity threats. We use third-party service providers in various elements to our business operations such as data hosting providers. To help manage cybersecurity risks associated with our use of third-party service providers, we primarily engage with industry-preferred service providers, and we also contractually require service providers with access to personal, confidential, or proprietary information to maintain data security controls and practices.

stage1Category: Third-Party Risk

stage1Method: majority


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Cybersecurity risks and the failure to maintain the security, confidentiality, integrity, or availability of our information technology systems or data, and those maintained on our behalf, could lead to adverse consequences that materially adversely affect our business, including, without limitation, regulatory investigations or actions, a material interruption to our operations, including clinical trials, damage to our reputation and/or subject us to costs, loss of customers or sales, fines and penalties or lawsuits."

stage1Category: None/Other


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee is responsible for advising on the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and risk management processes are managed by certain Company management, including our CFO (who has prior experience in strategic business operations). Our CFO has supervisory responsibility over IT and cybersecurity functions. Our Company management is responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, helping prepare for and respond to cybersecurity incidents, and reviewing security assessments and other security-related reports. Our incident response team is responsible for remediating cybersecurity incidents of which they are notified.

stage1Category: Management Role


text: We maintain a cybersecurity policy, reviewed with our audit committee, which is designed to address cybersecurity risks to the Company (including by escalating certain cybersecurity incidents to members of management and the board of the audit committee, in each case depending on the circumstances). We also maintain incident response procedures designed to assist the Company in responding to cybersecurity incidents.


text: Cyber Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management program in accordance with our risk profile, which is informed by and incorporates elements of recognized industry standards. Our cybersecurity risk management strategy is guided by both internal cybersecurity risk assessments and third-party information security audits.

companyName: ALLURION TECHNOLOGIES, INC.

ticker: ALUR


text: We leverage the support of third-party information technology and security providers as part of our cybersecurity risk management program, including for penetration testing. Further, we have adopted written information security policies and procedures, including an incident response plan, which is designed to establish our processes for identifying, responding to, and recovering from cybersecurity incidents.


text: We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, including through the use of vendor security questionnaires. Additionally, the Company's employees go through cybersecurity awareness training covering topics such as general cybersecurity best practices, phishing, data protection, password protection, and network security.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could effect our information or systems. For more information, please see Item 1A - Risk Factors.


text: Incident Response and Recovery Planning We have an information security incident response process to prevent, detect, mitigate, and remediate cybersecurity incidents and threats. This process includes controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management in a timely manner, with appropriate involvement by our board of directors.

companyName: Alpha Teknova, Inc.

ticker: TKNO


text: Governance Related to Cybersecurity Risks Our cybersecurity risk management program is managed by our Information Security Management Committee (the "InfoSec Committee"). The InfoSec Committee is currently made up of a cross-disciplinary team, including the Company's acting Chief Information Security Officer (CISO), Chief Financial Officer, Chief Legal Officer, VP of People, IT director, VP of Software Engineering, Senior Director of R&D, and VP of Global Marketing. The InfoSec Committee meets on a regular basis to review and discuss the direction of the Company's cybersecurity program. Our acting CISO is responsible for the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who is currently in this role has approximately 25 years of experience in information technology.


text: The Board engages in oversight of cybersecurity risks. With the input of the InfoSec Committee, our CISO may provide periodic updates to the Board on matters related to cybersecurity as needed.


text: Cyber Risk Management and Strategy We, under the oversight of the Audit Committee of our board of directors, have implemented and maintain an enterprise risk management process, which includes periodic assessments of various risk categories, including cyber risks, across our Company. Our process for assessing, identifying, and managing risks from cybersecurity threats is informed by industry standards and supported by cybersecurity technologies, including third-party security solutions, monitoring, and alerting tools, designed to monitor, identify, and address cybersecurity risks.

companyName: Kyverna Therapeutics, Inc.

ticker: KYTX


text: We leverage a managed security service provider and also engage with other third-party providers and consultants to support our cyber risk management efforts, including through periodic security testing. We have a process to assess and review the cybersecurity practices of information technology third-party vendors and service providers, including through review of applicable certifications, security reports, and vendor questionnaires and contractual requirements, as appropriate.


text: Governance Related to Cybersecurity Risks Our cyber risk management program and related operations and processes are directed by our Head of IT in consultation with the legal team and our third-party security advisor. Currently, our Head of IT role is held by an individual who has over 20 years of information technology experience. The Head of IT reports to our Chief Financial Officer.


text: Our Head of IT meets with our Chief Financial Officer periodically to discuss and review our cybersecurity risk management processes and to address matters related to potential cybersecurity and information technology risks, with input from our third-party technology providers, as appropriate. In addition, our Head of IT has regular meetings with our managed security service provider to inform our cyber risk management processes and reporting to management. Our Head of IT, working with our Chief Financial Officer, provides periodic reports on cybersecurity and information technology matters to our Audit Committee, which assists our board of directors in reviewing and overseeing our risk management process, including cybersecurity risks.


text: Our Chief Financial Officer and our Audit Committee periodically report on cybersecurity risk management to the full board of directors. Our board of directors, as a whole and through its committees, has responsibility for the periodic review and oversight of information technology risks, including cybersecurity risks.


text: Our enterprise risk management program is overseen by a risk management committee comprised of senior management across key functional areas inclusive of cybersecurity and information technology matters. This committee, working with our Chief Financial Officer, provides periodic reports and updates, as needed, to our board of directors or our Audit Committee. In collecting information on enterprise risk, cybersecurity is included as a designated risk category, and the results of our enterprise risk assessment processes, including risks related to cybersecurity, are also discussed with the Audit Committee and among senior management on a periodic basis.


text: Material Affects of Cybersecurity Incidents Except as disclosed in Part I, Item 1A, “Risk Factors” of this Annual Report on Form 10-K, including, without limitation, the risk factor under the heading “If our internal information technology systems, or those used by our CROs, CMOs, clinical sites or other contractors or consultants upon which we rely, are or were compromised, become unavailable or suffer security breaches, loss or leakage of data or other disruptions, we could suffer material adverse consequences resulting from such compromise, including, but not limited to, operational or service interruption, harm to our reputation, litigation, fines, penalties and liability, compromise of sensitive information related to our business, and other adverse consequences”, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.


text: External Assessments We obtain periodic assessments by third party experts of our vulnerability management and security controls and to assist us in identifying and mitigating security risks.


text: Education and Awareness We provide periodic cybersecurity training for all officers and employees as well as periodic additional training for senior management through our cyber insurance carrier.


text: Risk Management and Strategy We have certain processes for assessing, identifying and managing cybersecurity risks, which are included in our overall risk management program and designed to protect employee and patient information from unauthorized access or attack, as well as secure our networks and systems. Cybersecurity risks are also periodically reevaluated in additional detail based on our experience and on external information regarding emerging risks. To protect our information systems from cybersecurity threats, we use various security tools, tracking procedures and investigational procedures to identify, investigate, resolve potential security incidents in a timely manner. We also engage third-party vendors to assist with security management, incident detection and response.

companyName: Mural Oncology plc


text: We have adopted guidelines and processes, led by our information technology ("IT") department, for preventing cybersecurity incidents and for assessing and responding to such incidents should they occur. These guidelines and processes, as well as our overall cybersecurity risk management, include consideration of cybersecurity threats associated with our use of third-party service providers. We also consider the internal risk oversight programs of our third-party service providers before engaging them in order to help protect us from any related vulnerabilities.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our company.


text: In an effort to deter and detect cybersecurity threats, we periodically provide all employees with a cybersecurity training and compliance program, which covers timely and relevant topics and educates employees on the importance of reporting immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster employee-based cybersecurity programs.


text: Our management is responsible for day-to-day risk management, while the audit committee of our Board of Directors has responsibility for the oversight of risk management, including overseeing the management of our risks from cybersecurity threats.


text: Our Vice President, Information Technology ("VP IT") is responsible for developing, implementing, and maintaining our processes and procedures for cybersecurity risk management and response. Our current VP IT has over thirty years of experience, which includes cybersecurity, information security, data protection, privacy, regulatory compliance and risk management within pharmaceutical and biotechnology companies. Any cybersecurity incidents are evaluated for potential impact and are reported, as appropriate to the severity, to our management, our Information Security Committee, our executive leadership and/or our board of directors. Our Information Security Committee, which is led by our VP IT and includes representatives from our IT, finance, and legal departments, meets regularly to review the incidence, impact assessment, and resolution of cybersecurity incidents, if any, and to assess evolving risks. Our Information Security Committee provides updates on cybersecurity incidents and responses and on cybersecurity risk management as needed and provides updates to executive leadership and to our Board of Directors.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks.

companyName: BioAtla, Inc.

ticker: BCAB


text: We also maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • conducting regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K • regular cybersecurity training programs for employees and management; and annual cybersecurity management training for employees involved in our systems and processes that handle sensitive data; • leveraging the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; • operating threat intelligence processes designed to research our adversaries; • closely monitoring emerging data protection laws and implementing changes to our processes designed to comply; • conducting regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice, and contract (as applicable) requiring employees, as well as third-parties who provide services on our behalf, to treat sensitive information with care; • carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and • maintaining a risk management program for suppliers, vendors, and other third parties, which includes conducting pre-engagement risk-based diligence, implementing contractual security and notification provisions, and ongoing monitoring as needed. These approaches vary in maturity across the business, and we work to continually improve them.


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigation.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We depend on our information technology systems and those of our CROs, manufacturers, contractors and consultants. Our internal computer systems, or those of any of our CROs, manufacturers, other contractors, consultants, existing or future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use or acquisition of or destruction of our proprietary and confidential data, employee data or personal data, which could result in additional costs, loss of revenue significant liabilities, harm to our reputation and material disruption of our operations" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, and under the heading "Risks related to employee matters, managing our growth and other risks related to our business."


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. The Audit Committee semi-annually receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives materials indicating current and emerging cybersecurity threat risks, and describing the company's ability to mitigate those risks. Members of the Board and the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks may also be considered during separate Board meeting discussions.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Senior Vice President of IP and Contracts and other members of the management team. Our team has over ten years in information technology, cybersecurity, risk management, and compliance and includes individuals with BS degrees in Information Technology and several information technology and security certifications.


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such a material cybersecurity incident.


text: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Audit Committee along with our board of directors is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Marpai, Inc.

ticker: MRAI


text: Risk Management and Strategy As part of the critical elements of our overall risk management approach, our cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Governance," The board of directors oversight of cybersecurity risk management is supported by the Audit Committee of the board of directors (the "Audit Committee"), which interacts with our Enterprise Risk Management function, our Chief Information Security Officer ("CISO"), other members of management and relevant management committees and councils, including management's Cybersecurity Council. • Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, and controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: We have established and maintains comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party information technology service providers and vendors have from time to time experienced threats that could affect our information or systems. For more information, see, "Risk Factors," in this Annual Report on Form 10-K.

companyName: Aura Biosciences, Inc.

ticker: AURA


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The board of directors, in coordination with the Audit Committee, oversees our risk management process, including the management of risks arising from cybersecurity threats. The board of directors and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The board of directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the board of directors and the Audit Committee discuss our approach to cybersecurity risk management with our CISO.


text: The CISO works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including our business strategy, results of operations or financial condition.


text: Our board of directors and management exercise oversight over the Company's cybersecurity program, which represents an important component of the Company's overall approach to enterprise risk management.


text: Teknova's Vice President of Information Systems and Architecture (VP of IT) manages a team responsible for leading enterprise-wide strategy, policy, standards, architecture, processes, and risk assessment related to information security and data protection, including data privacy and network security (our Cybersecurity Program). The VP of IT has served in various roles in information technology and information security, along with other members of the IT department, and holds relevant and applicable certifications. The VP of IT reports directly to the Company's Chief Executive Officer and provides periodic reporting on our Cybersecurity Program to our senior management team, our board of directors, and the audit committee of our board of directors.


text: Our board of directors, in coordination with our audit committee, oversees our management of cybersecurity risk, with the audit committee reviewing and discussing with management matters related to our Cybersecurity Program, including as it relates to financial reporting. The board of directors and audit committee receive periodic reports about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Additionally, risks associated with the Cybersecurity Program are integrated into the Company's enterprise risk management assessment and reported to our Board as needed. We also share the key results of third-party assessments with our board of directors and audit committee.


text: Technical Safeguards As part of our Cybersecurity Program, the Company deploys technical safeguards that are designed to protect our information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Our Cybersecurity Program also includes a periodic risk assessment, which is based generally on frameworks established by the National Institute of Standards and Technology (NIST).


text: Third-Party Risk Management We also maintain procedures designed to identify and mitigate cybersecurity threats related to our use of material third-party vendors. This includes reviewing the internal controls of certain third-party service providers to assess their procedures to mitigate material cybersecurity risks, among other risks.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with Bain Capital's CISO, as well as other risk management, legal, information technology, and/or compliance personnel of Bain Capital.

companyName: Bain Capital Private Credit


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected the Company, including our business strategy, results of operations, or financial condition. For information regarding cybersecurity risks that may materially affect our Company, see the risk factor titled "Our internal computer systems, or those of our suppliers, customers, or contractors, have been and may in the future be subject to cyberattacks or security breaches, which could result in a material disruption of our business or otherwise adversely affect our business, financial condition, results of operations, cash flows, and prospects." under "Risk Factors" in Part I, Item 1A. to this Annual Report on Form 10-K.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and sensitive personal data, including of our employees, consultants and clinical trial participants (Information Systems and Data).

companyName: Vera Therapeutics, Inc.

ticker: VERA


text: The Chief Financial Officer, Chief Business Officer, Chief Accounting Officer, and Head of Legal form our Cybersecurity Risk Management Committee and help identify, assess and manage the Company's cybersecurity threats and risks. This Cybersecurity Risk Management Committee, which reports to our overall risk management committee, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example: manual and automated tools in certain environments and systems, subscribing to reports and services that identify certain cybersecurity threats, conducting scans of certain threat environments, analyzing reports of certain threats and actors, evaluating certain cybersecurity threats reported to us, and conducting internal and external audits of certain environments and systems.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plan; incident detection and response tools; risk assessments of certain environments and systems; encryption of certain data; network security for certain environments and systems; access controls for certain environments and systems; data segregation of certain data; access controls; physical security; asset management; third-party systems monitoring; employee cybersecurity training; and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our Cyber Security Risk Management Committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms, such as legal counsel, threat intelligence service providers, and cybersecurity software providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as software application providers, hosting companies, contract research organizations, and contract manufacturing organizations. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including the section titled "Risk Factors—General risk factors—If our information technology systems or data, or those of any of our third-party partners (such as contract research organizations and clinical trial sites), or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; additional costs; loss of revenue or profits; and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Business Officer, Chief Accounting Officer, and Head of Legal, working closely with our third-party information technology team; the senior staff members of our third-party information technology team have been in business providing services to similarly situated companies in our industry for more than 27 years, including extensive experience addressing complex information technology and cybersecurity matters.


text: In particular, the Chief Business Officer is responsible for hiring appropriate personnel and third-party vendors, communicating key priorities to relevant personnel, and, in concert with members of the Cybersecurity Risk Management Committee, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy. Our Chief Business Officer, Chief Accounting Officer, and Head of Legal, in consultation with our third-party information technology team, is responsible for maintaining cybersecurity-related budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Cybersecurity Risk Management Committee. This group works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives regular reports concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them, including during audit committee meetings and other periodic updates. These reports are provided by members of the Company's management team responsible for such reporting, including the Cybersecurity Risk Management Committee. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee, customer and patient information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, response plans, regular vulnerability testing on our systems, incident simulations and routine review of our policies and procedures to identify risks and adapt our practices. We engage certain external parties, including a managed security service provider, independent privacy assessors, computer security firms and risk management, peer companies, industry groups and governance experts, to ensure our cybersecurity oversight.

companyName: Syros Pharmaceuticals, Inc.

ticker: SYRS


text: Our board of directors does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition.


text: The Audit Committee of the board of directors provides direct oversight over cybersecurity risk and provides updates to the board of directors regarding such oversight. The Audit Committee receives quarterly updates from management regarding cybersecurity matters.


text: Our Senior Director of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to maintain awareness of cybersecurity risks, including email, web, and data security. The Senior Director of Information Technology has over 25 years of experience designing, implementing, and running information technology and cybersecurity programs and processes using the National Institute of Standards and Technology, or NIST, Framework.


text: To deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. To mitigate cybersecurity risks and bolster our employee-based cybersecurity programs, we monitor all user traffic and restrict access by country. In addition, access to web sites is filtered and monitored, and credentials for systems and services require multi-factor authentication whenever possible.


text: Cybersecurity Risk Management and Strategy We have implemented cybersecurity risk management procedures, in accordance with our risk profile and business size, that are designed to identify, assess, and mitigate risks from current and emerging cybersecurity threats. Our cybersecurity procedures, which are informed by the National Institute of Standards and Technology cybersecurity framework, are supported by a third-party managed services provider that assists us in managing our information technology systems.


text: Our cybersecurity procedures are comprised of a variety of tools designed to protect our data and information technology systems, including but not limited to endpoint protection and network security measures, that are supported by our third-party service providers. We also have a process to require our employees to undergo cybersecurity awareness training. Further, we have a process to review risks to our company in connection with certain third-party providers and vendors, which we assess through vendor questionnaires, as appropriate.


text: Cybersecurity Governance Our cybersecurity program is managed and directed by our Head of Information Technology, or IT, who has nearly thirty years of experience in information technology and information systems management. Our Head of IT reports to our Chief Financial Officer. Our Cybersecurity Governance Team, which is made up of representatives from across the organization, is responsible for oversight of cybersecurity risks and addressing potential cybersecurity risks to business programs, employees, clients, vendors and partners.


text: Our Board has delegated oversight of our cybersecurity risk management program to our Audit Committee, per the Audit Committee charter. Our Head of IT provides periodic updates to the Audit Committee regarding our cybersecurity risk management program, including information about cybersecurity risk management governance, as well as status updates on plans intended to enhance the overall cybersecurity posture of our company, as applicable. In the event of a cybersecurity incident, we have established a process for escalation to the Audit Committee as well as our Board, as appropriate.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: PRECISION BIOSCIENCES INC

ticker: DTIL


text: We designed and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: We are utilizing our cybersecurity risk management program as the basis for developing our overall enterprise risk management program, and our current cybersecurity risk management program involves a range of policies, procedures, and controls designed to safeguard our information assets. Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. In addition, we have secured cyber insurance coverage, and we plan to regularly review our coverage to align with the evolving nature of cyber threats and industry standards. For more information, see the section titled "Risk Factors— Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our security, which could materially affect our results." in Part I, Item 1A. of this Annual Report on Form 10-K.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk part of its risk oversight function and has delegated to the audit committee of our board of directors (the "Audit Committee") oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Audit Committee receives quarterly reports from the Vice President of Operation & Information Technology, and Head of Information Technology on our cybersecurity risks.


text: Our management team, including our Vice President of Operations & Information Technology and Head of Information Technology, has 18+ years of experience in enterprise risk management, governance, and technical operations, information technology enterprise architecture, and information technology management, and oversees our information security program. In addition, management regularly updates the Audit Committee with respect to cybersecurity risk, also on an ad hoc basis as necessary, regarding any material cybersecurity incidents and any incidents with lesser impact potential. The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity.


text: Cybersecurity Risk Management and Strategy We have implemented a cybersecurity program in accordance with our risk profile and business size that is informed by recognized industry standards, including elements of the National Institute of Standards and Technology Cybersecurity Framework. We leverage the cybersecurity services of third-party vendors, including virtual chief information security officer services, to support out cybersecurity risk management program.

companyName: Metagenomi Therapeutics, Inc.

ticker: MGX


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Operating Officer as part of the Board's continuing education on topics that impact public companies.

companyName: Erasca, Inc.

ticker: ERAS


text: Our cybersecurity risk management program is comprised of a number of components, including but not limited to a risk assessment incorporating elements of industry standard frameworks, penetration testing, endpoint detection and response, and system monitoring. We have an employee training program that includes annual cybersecurity awareness training that is reinforced by approximately monthly phishing campaigns. We also maintain an incident response plan and related processes to help guide our response to cybersecurity incidents.


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the vendor’s programs. Our current vendor evaluation procedures include, as appropriate, a review of certain vendors’ security standards.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors have experienced threats relating to our and our third-party vendors’ information systems. For more information, please see “Item 1A, Risk Factors.”


text: Governance Related to Cybersecurity Risks Our Head of Information Technology (“Head of IT”) is responsible for the strategic leadership and direction of the Company’s information technology organization. Our current Head of IT has over thirty years of experience leading information technology teams in the life sciences industry. The Head of IT reviews threat intelligence, and receives updates from the Company’s third-party providers, to help identify risks from cybersecurity threats.


text: The Head of IT reports to the Chief Financial Officer (CFO), and attends regular meetings with the CFO to discuss updates relating to the Company’s cybersecurity program. The Head of IT also provides cybersecurity updates on a quarterly basis to the Company’s executive team.


text: The Board of Directors has delegated oversight of cybersecurity risk management to the Audit Committee. The Audit Committee reviews the Company’s major cybersecurity risk exposures and the steps that the Company’s management has taken to monitor and control such exposures. Specifically, the Audit Committee reviews reports on data management, security initiatives, and significant existing and emerging cybersecurity risks, including material cybersecurity incidents, the impact on the Company and its stakeholders of any significant cybersecurity incident, and any disclosure obligations arising from any such incidents.


text: Cybersecurity is one of our most critical risks. For many activities important to our business, we depend on the confidentiality, integrity and availability of information systems and data, some of which are provided or managed by third parties. We have strategically integrated cybersecurity risk management into our broader enterprise risk management function to promote a company-wide culture of cybersecurity risk management.

companyName: GENESCO INC

ticker: GCO


text: Management is responsible for the day-to-day handling of risks facing the Company, while the Board of Directors, as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated certain risk management responsibilities with respect to cybersecurity to the Audit Committee.


text: On behalf of the Board, the Audit Committee provides oversight of our management of cybersecurity risk. The Audit Committee regularly reviews our cybersecurity risks, incidents, audits, assessments, crisis readiness, awareness activities and compliance with cybersecurity and privacy laws and regulations. Our Vice President, Information Security and Privacy jointly with our Senior Vice President, Chief Strategy and Digital Officer brief the Audit Committee quarterly, and more often, if necessary, on active and emerging cybersecurity threats and efforts to strengthen our defenses against these threats.


text: Our Information Security and Privacy teams reduce first and third-party risk by maintaining a proactive security posture aligned with current threats, detecting cybersecurity events and responding quickly, and building procedures to rapidly recover. These teams are managed by the Vice President, Information Security and Privacy, who reports to the Senior Vice President, Chief Strategy and Digital Officer. Our cybersecurity leaders collectively have more than 25 years of relevant experience and multiple professional certifications.


text: Internal and third-party risks are reviewed, monitored, and managed by our Cybersecurity and Privacy teams, audited by an Internal Audit team and various external experts, and tracked within an Enterprise Risk Management framework. We regularly engage third-party experts to assess the effectiveness of our cybersecurity programs. Biennially, an external independent consultancy team conducts an assessment of our cybersecurity program using the inputs from accepted Cybersecurity Frameworks. Targeted assessments are conducted regularly by internal and third-party experts to ensure compliance with specific federal and state laws and regulations. We continue to participate in the VISA TIP program and AMEX STEP program around our PCI DSS compliance.


text: Our processes for identifying and managing first and third-party risks from cybersecurity threats include: • Continuous monitoring of our systems and network for cybersecurity events; • Regular testing of our Security Incident Response Plan, Business Continuity plans, and Disaster Recovery plans; • Required annual security training for our employees with access to email, as well as tailored training for employees in more sensitive roles. Periodic testing to ensure the security training is effective.


text: External managed security services providers and industry-leading security tools continuously monitor our systems and network for cybersecurity threats. Our cybersecurity teams evaluate the escalated threats, and if necessary, take steps to contain and recover from pervasive threats in accordance with our Security Incident Response Plan. The plan includes reporting and escalation procedures to inform the Executive Committee, Audit Committee, and full Board, as appropriate to enable them to carry out their oversight responsibilities, and to ensure timely compliance with applicable reporting rules. Our Business Continuity Management and Disaster Recovery plans include procedures for business recovery and are tested regularly.


text: No risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.


text: Risk Management and Strategy The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company relies on the cybersecurity strategy and policies implemented by Bain Capital, the parent of the Advisor and Administrator, which apply to the Company and its operations.


text: Bain Capital has adopted and implemented an Information and Cybersecurity Program ("Cybersecurity Program") that prioritizes detection and analysis of and response to cybersecurity threats, management of security risks and resilience against cyber incidents, including those that may impact the Company. The Cybersecurity Program aligns with National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and is reviewed and adjusted as needed and is approved by the Bain Capital's Chief Information Security Officer ("CISO").


text: Bain Capital's Cybersecurity Program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help prevent and respond to cybersecurity threats and incidents, including threats or incidents that may impact the Company, the Advisor or the Administrator. Bain Capital's cybersecurity risk management processes, which are part of Bain Capital's overall risk management system, seek to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessments of cybersecurity risks, including those which may impact the Company, the Advisor, or the Administrator, are reported to the Bain Capital Credit Risk Oversight Committee ("ROC") for awareness, review or action, as appropriate. In addition, the Company relies on Bain Capital to periodically engage with third-party consultants and key vendors to assist it in assessing, enhancing, implementing and monitoring its cybersecurity risk management processes and responding to incidents.


text: Internal and external networks, including the networks on which the Company relies, are assessed for vulnerabilities. Bain Capital also engages with independent third parties to conduct relevant technical assessments.


text: Bain Capital seeks to remain aware of the evolving global threat landscape through vendor relationships, partnerships with threat intelligence providers and membership of industry forums/groups, as well as research performed by members of the Information Security Team. Bain Capital is currently an active member of the Financial Services Information Sharing and Analysis Center (FS-ISAC) and the Alternative Investment ISAC.


text: Bain Capital provides information security awareness training to employees, and function-specific security training is also provided (where appropriate based on job function). Bain Capital also engages in phishing campaigns.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on Bain Capital's Vendor Risk Management Program in conjunction with a Third Party Risk Management (TPRM) steering committee to assess risks posed when engaging with external vendors and/or third parties, including identifying and overseeing risks from cybersecurity threats associated with the Company's use of such entities.


text: In the event of a cybersecurity incident impacting the Company, the Advisor has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational and risk functions of Bain Capital, which may include coordinating with the relevant employees of the Advisor and management of the Company. The incident response plan includes notification to the applicable members of cybersecurity leadership, including Bain Capital's CISO, and, as appropriate, escalation to other relevant individuals.


text: Material Impact of Cybersecurity Risks During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or that are reasonably likely to materially affect the Company, including our business strategy, operational results, and financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors— General Risk Factors— We are highly dependent on information systems, and systems failures or cyber-attacks could significantly disrupt our business, which may, in turn, negatively affect the value of our Common Shares and our ability to pay distributions."


text: The Company's Board of Trustees ("Board") provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO"), which incorporates updates provided by Bain Capital's CISO regarding the overall state of the Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents potentially impacting the Company.


text: Bain Capital's CISO and Information Security Team are responsible for the Cybersecurity Program applicable to the Company and, along with the Company's CCO, are responsible for assessing and managing material risks from cybersecurity threats that impact the Company. The CCO of the Company oversees the Company's oversight function generally and relies on Bain Capital's CISO to assist with assessing and managing material risks from cybersecurity threats. The Company's CCO has been responsible for this oversight function as CCO to the Company for 9 years and has more than 13 years' experience in information security, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company. Members of Bain Capital's management also possess relevant expertise in various disciplines that are key to effectively managing such risks, such as extensive experience in managing compliance risks in the financial sector, including those related to cybersecurity. Bain Capital's CISO has deep expertise in cybersecurity, holding the CISSP certification and having completed an Executive Master's in Cyber Security from Brown University and having received a Chief Risk Officer Certificate from Carnegie Mellon. Members of Bain Capital's Information Security Team hold various industry certifications and regularly attend trainings and industry conferences


text: Risk Management and Strategy We recognize the importance of developing, implementing and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of data. We have integrated cybersecurity risk management into our broader risk management framework. Our digital and technology organization outside the Company continually addresses cybersecurity risk in alignment with our business objectives and operational needs.

companyName: Inhibikase Therapeutics, Inc.

ticker: IKT


text: Our cybersecurity program is focused on the following areas: • Governance: We leverage multiple cybersecurity frameworks (e.g., ISO 27001 and NIST CSF) and regulatory requirements to inform our externally managed information technology ("IT") infrastructure. Policies for IT use and management for each employee are part of the employee onboarding process and those policies are refreshed periodically as threats emerge that could be relevant to our IT infrastructure. • Technical Safeguards: The Company does not use a centralized server where all information is stored and therefore where all information is placed at risk. Instead, we deploy technical and procedural measures using a distributed model so that no one location or machine could cripple the company's IT infrastructure. Protection measures include network firewalls, network intrusion detection and prevention, penetration testing, vulnerability assessments and monthly risk assessments and management, threat intelligence, anti-malware and access controls, plus data loss prevention and monitoring. • Security Awareness / Training: All employees are required to adhere to our Standards of Business Conduct, which identifies an employee's responsibility for information security. We also disseminate security awareness information periodically throughout the year. • Third-Party Suppliers and Service Providers: We manage our IT infrastructure with an external vendor who maintains and evaluates risk exposure in real-time and conducts monthly risk assessments and adjustments to preclude cyberattacks. Vendor security reviews evaluate numerous key security controls and the outputs of these reviews are used as part of business decisions regarding storage and dissemination of virtual data and to assess a vendor's overall security posture.


text: Risks from Cybersecurity Threats While we are subject to ongoing cybersecurity threats, the risks from these threats have not materially affected, or are reasonably likely to materially affect the company, including our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, see "Item 1A. Risk Factors-Risks Related to Our Operations" in this Annual Report.


text: Board Oversight of Cybersecurity Risks Our Board of Directors (Board) is responsible for the oversight of our risk management program and regularly reviews information regarding our most significant strategic, operational, financial, legal and compliance risks, including cybersecurity risks. The Board reviews mitigation plans through discussions with management, which includes regular Board reports and findings from management's monthly discussions with our outside IT group. Our Board of Directors also reviews and approves our cybersecurity policies, strategies, and budgets on an annual basis.


text: Management's Role in Assessing and Managing Cybersecurity Risks Our CEO in conjunction with our external IT team are responsible for setting the strategy and communicating cybersecurity risks. With the Company's distributed model of data storage, risks have been limited and the Company has not experienced a cybersecurity breach. The Company's security measures and monthly system audits to identify potential vulnerabilities and remediate deficiencies in real time.


text: Chemours recognizes the critical importance of maintaining a cybersecurity program to provide a secure and reliable computing environment protecting the Company's information, systems and assets and to enable our digital transformation goals. Our cyber and information security program (the "Program") is based upon standards published by the National Institute of Standards and Technology ("NIST") in their Cybersecurity Framework. The goals of our Program are: • identifying, preventing, and mitigating cybersecurity threats to the Company; • preserving the confidentiality, security, and availability of the information that we collect and store to use in our business; • protecting the Company's intellectual property; • maintaining the confidence of our customers, business partners and other stakeholders; and • providing appropriate public disclosure of cybersecurity risks and incidents, when required.

companyName: Chemours Co

ticker: CC


text: The Chief Information Security Officer ("CISO") is the Chemours executive principally responsible for managing and maintaining the Program, is accountable for managing risk, ensuring that the organization's security posture is aligned with its business objectives, and providing timely updates to senior management on such efforts. The CISO reports to the Interim Enterprise Transformation Leader. The current CISO has more than six years with Chemours and over 25 years of total cyber and information security experience with multiple companies across both the private and public sector in CISO and other information security roles.


text: The CISO manages and is supported by a global team of risk managers, cyber defenders, architects, and engineers with the knowledge and experience to carry out day-to-day cybersecurity operations. They are also supported by third parties who provide threat intelligence, global infrastructure monitoring, and threat detection and response to cyber events. In addition, our Corporate Security team, a part of the Legal organization, has open lines of communication with various Federal, State and International law enforcement agencies to gain access to the latest cyber situational awareness.


text: We assess third-party cybersecurity controls through a cybersecurity questionnaire and include information security and privacy addendums to our contracts, where applicable. We also require that our vendors and other third parties report cybersecurity incidents to us so that we can assess the impact of the incident on us.


text: Chemours educates its employees and contractors annually on cyber risks and prevention, monthly using online situational awareness training, active employee engagement, and ongoing phishing simulations.


text: The CISO has an incident response plan designed to address potential cybersecurity incidents and notify appropriate leadership while determining the material impact through a cyber sub-committee of management's Disclosure Committee. The plan also includes implementing long-term strategies for recovery and prevention of future incidents.


text: We manage the cybersecurity risk under our Enterprise Risk Management ("ERM") program, where we assess key risks within the Company. The board of directors is responsible for oversight of the Company's enterprise risk management and is informed of the risks associated with cybersecurity through periodic ERM updates. A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises, threat modeling, and other exercises focused on evaluating the effectiveness of the Program.


text: The Chemours Company The Audit Committee is central to the board of directors' oversight of cybersecurity and regularly meets with the CISO to review and discuss cybersecurity risks, the status of ongoing cyber initiatives and strategies, incident reports and learnings, as well as key performance indicators. The results of any cyber risk assessments, audits, and reviews are reported to the Audit Committee and the board of directors, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: Although our Risk Factors include further details about the cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program, and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Adviser's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and are fully integrated into the Adviser's overall risk management processes. In general, the Adviser seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Adviser's information systems or the information that the Adviser collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: TCW Direct Lending VIII LLC


text: Cybersecurity Risk Management and Strategy The Adviser's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Adviser has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Adviser's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: The Adviser implements technical safeguards that are designed to protect the Adviser's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as assistance from third party experts where necessary. • Incident Response and Recovery Planning: The Adviser has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Adviser's response to a cybersecurity incident. The Adviser conducts occasional tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Adviser maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Adviser's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside consultants who advise on the Adviser's cybersecurity systems. • Education and Awareness: The Adviser provides regular, mandatory training for all levels of personnel regarding cybersecurity threats as a means to equip the Adviser's personnel with effective tools to address cybersecurity threats, and to communicate the Adviser's evolving information security policies, standards, processes, and practices.


text: The Adviser conducts periodic assessment and testing of its policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. This includes penetration testing of network infrastructure and phishing tests targeting the Adviser's employees. The results of such assessments and reviews are evaluated by management and reported to the Board, and the Adviser adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments and reviews.


text: The Board, in coordination with the Adviser, oversees the Company's risk management program, including the management of cybersecurity threats. The Board receives regular updates and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by the Company'. The Board also receives prompt and timely information regarding any material cybersecurity risk, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Adviser discuss the Company's approach to overseeing cybersecurity threats.


text: The Adviser has established an internal working group that includes relevant representation from senior management including the CCO, COO and CISO who work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through ongoing communication with these teams, the CISO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate.


text: The CISO has served in various roles in information technology and information security for many years and holds relevant professional certifications. The Adviser's COO and CCO each hold educational and professional degrees in their respective fields, and each has numerous years of experience managing risk at the Company and at similar companies, including assessing cybersecurity threats.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


companyName: TCW Star Direct Lending LLC


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: Our program is developed and informed by industry best practices such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and input from expert third-party consultants. It's important to note that our adoption of the NIST CSF serves as a blueprint to aid in the identification, assessment, and mitigation of cybersecurity risks pertinent to our operations, rather than as a certification of compliance with specific technical standards or requirements.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise IT environment; an IT security team (including Chief Operating Officer (COO)) principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: In the near-term our cybersecurity risk management program will include a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives reports from management on our cybersecurity risks no less than twice per calendar year. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team, including our Chief Operating Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Collectively, the IT security team that is responsible for managing our cybersecurity risks has over 50 years of experience in mitigating cybersecurity risks.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal IT personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by cybersecurity tools deployed in the IT environment.


text: We strive to safeguard our important data, hardware, and internal network from digital attacks, theft and damage. In the ordinary course of our business, we collect, use, store, and digitally transmit confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. At Gyre Therapeutics, these processes are managed and monitored by a third-party information technology ("IT") consulting company (the "Managed Service Provider") and are overseen by our Chief Financial Officer. At Gyre Pharmaceuticals, these processes are managed and monitored by a dedicated IT team, which is led by the General Manager. Gyre Therapeutics' and Gyre Pharmaceuticals' processes include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data. For example, Gyre Therapeutics and Gyre Pharmaceuticals maintain software and hardware inventories, perform security monitoring and alerting, and complete ongoing risk assessments. Gyre Therapeutics and Gyre Pharmaceuticals also conduct regular employee trainings on cyber and information security, among other topics. In addition, both companies consult with outside advisors and experts on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: GYRE THERAPEUTICS, INC.

ticker: GYRE


text: Our Chief Financial Officer, who reports directly to our Chief Executive Officer, is responsible for assessing and managing Gyre Therapeutics' cybersecurity risks with support from the Managed Service Provider, which employs IT consultants with over 20 years of experience managing information technology and cybersecurity matters and are certified as Microsoft Certified Systems Engineers. Our Gyre Pharmaceuticals IT department senior supervisor, who reports directly to our General Manager at Gyre Pharmaceuticals and has over 20 years of experience managing information technology and cyber security matters, is responsible for assessing and managing Gyre Pharmaceuticals' cybersecurity risks. Our General Manager at Gyre Pharmaceuticals reports the Board of Directors. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Breach, failure or disruption in or to our information system could compromise sensitive information related to our business and expose us to liability or reputational harm, and our ability to effectively manage our business operations could be adversely affected."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our management team. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Risk Management and Strategy The Trust's cybersecurity risk management is established and governed by the Sponsor. The Sponsor determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for the Trust and the Trust relies on the Sponsor for assessing, identifying and managing material risks to the Trust's business from cybersecurity threats. The Sponsor's cybersecurity policies and practices are set out in the Sponsor's compliance manual and are reviewed on an annual basis. In addition, all officers of the Sponsor and all employees of Bitwise receive annual compliance training and annual cybersecurity training. Attendance at the annual cybersecurity training and the annual compliance training is tracked and recorded.

companyName: Bitwise Bitcoin ETF

ticker: BITB


text: The Sponsor engages a selection of third-party experts ("Experts") to assist its internal legal, compliance and engineering personnel in developing, implementing and testing its cybersecurity policies and procedures. The Experts assist in performing assessments, penetration tests and reviewed areas of potential vulnerability. In addition, the Experts work with the Sponsor to conduct cybersecurity training, exercises and quarterly internal phishing tests. The Sponsor uses the findings of such exercises and campaigns to improve its practices, procedures, and technologies. The Sponsor also engages the Experts to support its cybersecurity threat and incident response management and maintains information security risk insurance coverage.


text: Material cybersecurity risks are identified by members of our team. Our Head of IT is primarily responsible for managing our cybersecurity risk assessment processes, including those described in "Cybersecurity Risk Management and Strategy" above, our security controls and our response to cybersecurity incidents, with assistance from third party service providers.

companyName: Mereo BioPharma Group plc

ticker: MREO


text: The Sponsor conducts due diligence on the Experts and all third-party service providers both at the beginning of any contractual relationship and on an ongoing, periodic basis. The Sponsor reviews a selection of all of its service providers on an annual basis, with specific emphasis on any service providers deemed to be high risk and utilizes external compliance partners to assist with this review. As part of this review, the Sponsor tracks any identified deficiencies and requires that its third-party service providers have in place appropriate technical and organizational security measures and security-control principles based on recognized cybersecurity standards. The Sponsor also obtains contractual assurances from third-party service providers relating to their security responsibilities, controls, reporting, and roles and responsibilities as it pertains to cybersecurity incident response policies and notification requirements.


text: While neither the Sponsor nor the Trust has experienced a material cybersecurity incident, cybersecurity threat risks may materially affect either the Sponsor or the Trust, including the Trust's business strategy, results of operations or financial condition.


text: The Trust does not have any directors, officers or employees. Under the Trust Agreement, all management functions of the Trust have been delegated to and are conducted by the Sponsor, its agents and its affiliates. Hong Kim, the Chief Technology Officer of Bitwise is responsible for assessing and overseeing the Sponsor's and the Trust's cybersecurity risks and providing direction and oversight for risk mitigation action in conjunction with Katherine Dowling, the General Counsel, Chief Compliance Officer and Vice President of the Sponsor. Mr. Kim graduated from the University of Pennsylvania with a Bachelor of Science in Computer Science, and, prior to Bitwise, worked on Google's backend infrastructure for Google Drive and worked in software security for the South Korean military. Ms. Dowling has served as a Chief Compliance Officer at various companies since 2015 and has more than ten years of experience as an Assistant U.S. Attorney, most recently in the Economic Crimes Unit of the U.S. Attorney's Office for the Northern District of California. Mr. Kim and Ms. Dowling receive periodic reports from the Experts and members of the Sponsor's Legal and Compliance team who take part in cybersecurity review, implementation, training and testing.


text: Bitwise, the parent of the Sponsor, has a board of directors that is ultimately responsible for managing and directing the affairs of the Sponsor, including maintaining oversight of risks from cybersecurity threats. Mr. Kim serves on the Bitwise board of directors. Ms. Dowling serves as the General Counsel and Chief Compliance Officer and is on the Executive Management Team of Bitwise and therefore is able to report directly to Bitwise's board of directors regarding cybersecurity risks to the Trust and the Sponsor.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: We design and assess our program based on the U.K. Cyber Essentials and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • Identification and Reporting: We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents to our critical systems, information and our enterprise information technology environment. Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Third Party Risk Management: We use external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls. We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third party systems, including any service providers, suppliers, and vendors that have access to our critical systems and information. • Education and Training: We provide annual cybersecurity awareness training and on-going phishing simulation testing for our employees, incident response personnel and senior management in order to communicate evolving information security policies, standards, processes and practices and to provide them with the tools to make them aware of processes on addressing cybersecurity threats. • Incident Response and Recovery Planning: We maintain incident response, business continuity, and disaster recovery plans designed to address our response to a cybersecurity incident.


text: We have not identified any specific risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section "Item 1A. Risk Factor—Risks Related to Healthcare Laws and Other Legal Compliance Matters—Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."