text: The Partnership, in the normal course of business, at times experiences cybersecurity threats and incidents affecting its data or systems or systems of third parties relied on by the Partnership, and the Partnership's programs and measures discussed above may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us in the future. The Partnership has not identified any previous cybersecurity incidents that have materially affected or are reasonably likely to have a material effect on its business strategy, reputation, financial condition or results of operations. For information on material risks of potential cybersecurity threats, refer to Part I, Item 1A – Risk Factors – Risks Related to Business Operations – Information Security Incidents and Fraud.


text: Risk Identification and Management The Company has a cybersecurity Risk Management Policy in place that governs the life cycle in which cybersecurity risks, including: • Risk Identification: through various initiatives performed, including, annual assessments, penetration tests, Incident Response tabletop exercises, vulnerability scans, system monitoring activities, and cybersecurity reviews of critical third-party vendor engagements, etc. • Risk Evaluation & Treatment: Identified issues, vulnerabilities, and exposures are captured within the Company's Risk Register, which is updated periodically to reflect the most up to date treatment option selected by the Risk Owners. • Risk Reporting and Ongoing Management: Potentially material risks are shared as part of a monthly Cybersecurity Governance Forum, that's attended by leadership. Risk Mitigations are tracked to completion through various project updates.

companyName: Drilling Tools International Corp

ticker: DTI

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: The foundation of the Company's cybersecurity framework is based on written policies that govern different process areas. Risks are identified through various processes that employees perform through their daily operations and are mitigated, managed and/or governed through these established processes.


text: Leveraging the Company's Cybersecurity Risk Management & Governance process, it has identified cybersecurity risk factors that are inherent to the Company's business and industry. The risk factors discussed in this section should be considered together with information included elsewhere in this Annual Report on Form 10-K and should not be considered the only risks to which the Company is exposed. Additionally, mitigation of these risk factors is tracked by management as part of the Cybersecurity Maturity Roadmap.


text: • Disruptions in the Company's supply chain could result in an adverse impact on results of operations. • Network compromise or equipment sabotage could impact the operations of the manufacturing or distribution sites which could impact the revenue. • Cybersecurity incidents, including breaches of confidential information, sensitive data, personal information, or intellectual property could damage the Company's reputation, disrupt operations, increase costs, and impact revenues. • Nation state attacks due to current geopolitical and economic climate could impact oil and gas industry.


text: Engagement of Third Parties The Company uses an IT Managed Service Provider in conjunction with a Cybersecurity Advisory firm to perform various functions, guiding the Company's cybersecurity posture, and providing ongoing support to the Company's cybersecurity program. The Company has Incident Response retainer services that can be leveraged, when needed. The Company uses a cybersecurity advisory firm to conduct annual risk assessments and penetration tests.

stage1Method: majority


text: Board Oversight of Cybersecurity Matters The cybersecurity dashboard with roadmap progress is shared with the board of directors regularly, which includes actions completed and any topics that need board awareness / sponsorship such as approval of budgets which include cyber security project initiatives.


text: An in-depth update regarding cyber security is discussed during quarterly meetings with the Audit Committee. The Audit Committee is ultimately responsible for overseeing management's execution of the Company's cybersecurity risk management program.


text: The Chief Financial Officer (CFO) and designees are responsible for reviewing and approving the Cybersecurity Risk Management processes, or exceptions to such processes. External Counsel is consulted on legal matters related to Cybersecurity Risk or Incident Management as deemed necessary by leadership.


text: Additionally, the Cybersecurity Risk Committee holds periodic Cybersecurity Governance Forums, in which detailed cybersecurity program updates and metrics are reported.


text: The Company's Chief Financial Officer and VP of Finance are responsible for the oversight and communication of cybersecurity threats and risks to the Company's Board of Directors. They meet regularly with the Board of Directors where a Cybersecurity roadmap progress is shared with the board.


text: Risk Management, Strategy and Governance The Fund is externally managed by the Adviser and has no employees or internal information systems. Thus, the Fund relies on the Adviser as well as its administrator, custodian and other service providers to protect the Fund's information from cybersecurity threats. The Fund's Chief Compliance Officer (the "CCO"), in coordination with the Adviser's Compliance Department and Information Security Working Group (the "ISWG"), which includes the Adviser's Chief Technology Officer – Infrastructure and Cybersecurity (the "CTO"), Chief Compliance Officer, General Counsel and Chief Financial Officer or their respective designees and teams, oversees the Fund's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board of Trustees. The ISWG uses various security tools that help the Adviser identify, escalate, investigate, resolve and recover from cybersecurity incidents in a timely manner.

companyName: Silver Point Specialty Lending Fund


text: The Adviser also reviews the Fund service providers' compliance and risk management policies and procedures related to cybersecurity matters, monitors such service providers' use of information systems which have the potential to subject the Fund to information technology vulnerabilities and receives regular reports from the Fund's service providers regarding cybersecurity threats and incidents. T he CCO provides quarterly reports to the Board of Trustees regarding significant risks to the Fund, including, among others, those relating to cybersecurity. In addition, the CCO informs the Board of Trustees regarding material cybersecurity risks as they arise.

stage1Category: Third-Party Risk


text: The Adviser takes a risk-based approach to cybersecurity and has implemented cybersecurity policies and procedures throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the Adviser deploys specialized security technologies and operational controls including, but not limited to, firewalls, anti-virus systems, passwords, restricted access, and electronic surveillance/monitoring. The Adviser also conducts regular internal penetration testing to assess information technology vulnerabilities, utilizes third-party technology solutions for real-time vulnerability management and engages a third-party consultant to conduct a cybersecurity assessment and preparedness analysis annually. In addition, the ISWG meets quarterly and on an as-needed basis.


text: Material Impact of Cybersecurity Risks The Adviser recognizes that cybersecurity risks have the potential to impact business operations, financial performance, regulatory compliance, and reputation. To mitigate these risks, the cybersecurity program is built on scalable, future-ready solutions designed to address current and evolving threats.

companyName: Antares Strategic Credit Fund

stage1Category: Strategy Integration


text: The ISWG: (i) reviews any material information security incidents and documents the results of any such reviews and any responsive or remedial actions taken in connection therewith; (ii) escalates any significant incidents involving threats to, or breaches of, the cybersecurity protections set forth in the Adviser's Information Security Program and Policies and Procedures (the "Information Security Program") to the Adviser's Compliance Committee or Operating Committee; and (iii) updates the Information Security Program as needed, based on, among other things: (a) results of testing and monitoring pursuant to the Information Security Program; (b) changes to applicable laws, rules, or regulations; (c) new or prospective cyber threats; and (d) material changes to the business and operation of the Adviser and the Fund. In addition, the ISWG is informed by the CTO of: (i) any risks to personal information and the Adviser's information systems; (ii) ways to manage and control such risks; (iii) any concerns regarding third party vendor arrangements that could impact information security; (iv) the results of testing done in connection with the Information Security Program; and (v) any other matters that the CTO believes should be reviewed by the ISWG. The Information Security Program: (i) implements and maintains administrative, technical, and physical safeguards for the protection of personal information; (ii) protects against any anticipated threats or hazards to the security of such information, other Adviser information, and the Adviser's information systems; and (iii) prevents unauthorized access to or use of the Adviser's systems or personal information. In addition, the ISWG maintains an Incident Response Plan designed to define, in advance, the actions to be taken in the event that the Adviser suffers a digital attack or a potential cybersecurity breach.


text: The Adviser partners with third parties to assess the effectiveness of our cybersecurity prevention and response policies and procedures. The Adviser utilizes a third party to perform penetration testing once a year. Penetration testing involves scanning the Adviser's internet points of entry and attempting to detect potential vulnerabilities. Remediation is performed, if needed, and a second scan is conducted. Internal penetration testing is performed by a combination of regularly scheduled vulnerability scans and using a third party service for real-time vulnerability management. To assess the capability to maintain operation of its business in the event of serious failure or disruption of essential services located in its primary data center, the Adviser also performs business continuity testing twice a year. See "Item 1A. Risk Factors—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, financial condition and operating results."


text: The Trust does not have a board of directors; therefore, the Trustee is responsible for oversight of the Trust’s risks from cybersecurity threats. The Trustee has dedicated personnel responsible for assessing and managing the Trust’s cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee’s information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. External partners are a key part of the Trustee’s cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.

companyName: PERMIAN BASIN ROYALTY TRUST

ticker: PBT

stage1Category: Board Governance


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee’s overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third party vendor, of the Trustee’s cyber risk management program.


text: Other non-technical protocols include securing of documents and work areas that could contain personal, non-public information and independent verification of information changes by outside vendors.


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust’s business, financial condition, results of operations, or cash flows. See Item 1A “Risk Factors – Business and Operational Risks – The Trustee may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.”


text: The Sponsor, Fidelity Management & Research LLC, and their respective affiliates operating as a business organization (collectively, "Fidelity") and its Enterprise Cybersecurity organization, on behalf of the Trust, have established a comprehensive risk management program, which includes processes to identify, assess, and manage cybersecurity risks, including material risks from cybersecurity threats, and to put in place appropriate controls to mitigate these risks and reduce the potential impact to the Trust and its Shareholders. The Trust does not have any employees and relies upon Fidelity and its Enterprise Cybersecurity organization for the Trust's day-to-day operations and to establish strategies, policies, and standards for the security of, and operations in, cyberspace.

companyName: Fidelity Ethereum Fund

ticker: FETH


text: The Trust depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. Through its vendor management program, and on behalf of the Trust, Fidelity oversees and identifies risks from cybersecurity threats associated with the use of third-party service providers. This vendor oversight program includes periodic reviews of the cybersecurity controls of third-party service providers. The frequency of such reviews is generally based on the nature of Trust's information processed by the vendor and the vendor's criticality to business operations.


text: On behalf of the Trust, Fidelity engages third-party consultants to assess, identify, and/or manage material risks from cybersecurity threats. For example, Fidelity engages third-party consultants to perform audits of its cybersecurity measures and risk management processes, including those applicable to Trust. Fidelity has also hired qualified independent assessors to review applicable security controls in accordance with the American Institute of Certified Public Accountant's System and Organization Controls assurance programs. Additionally, Fidelity utilizes third-party consultants with specific areas of cybersecurity expertise to review and report on various aspects of its cybersecurity program, including those applicable to the Trust. The results of these consulting engagements are shared with the Sponsor as part of periodic reports.


text: Fidelity's Enterprise Cybersecurity organization has a threat intelligence program which monitors for emerging cyber threats. Taking information gathered from public and private sources, including industry groups such as the U.S. Cybersecurity and Infrastructure Security Agency and the Financial Services Information Sharing and Analysis Center, the organization analyzes such information and incorporates tactics, techniques, and procedures into the program's security monitoring and detection tools and processes.


text: The potential impact of risks from cybersecurity threats on the Trust are assessed on an ongoing basis, and how such risks could materially affect the Trust's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Sponsor did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Trust, including its day-to-day operations, financial condition, and business strategies. In conjunction with Fidelity's Enterprise Cybersecurity, the Sponsor, on behalf of the Trust, participates in regular testing of applicable incident response processes to ensure appropriate escalation, mitigation, communication and reporting processes are in place.


text: The Sponsor provides strategic oversight regarding cybersecurity risks and threats. The Sponsor's Compliance and Risk Management Committee ("CRMC") comprised of various officers of the Sponsor and the broader Fidelity organization receives and reviews periodic reports from senior executives in Fidelity's enterprise cybersecurity organization, including Fidelity's Chief Information Security Officer ("CISO") and members of the CISO's staff. These reports contain information about risks from cybersecurity threats, including the results of recent independent reviews of the cybersecurity program, summaries of recent cybersecurity threat intelligence assessments, progress on key initiatives and strategies, and updates on recent regulatory activities, including new regulations and examinations.


text: The CRMC is responsible for assessing and managing material risks from cybersecurity threats. In connection with the Trust's reliance on Fidelity and its Enterprise Cybersecurity organization, the CRMC relies on the cybersecurity expertise of Fidelity's CISO and members of the CISO's staff to assist in assessing and managing the Trust's material risks from cybersecurity threats. The CISO has over thirty years of experience as a technology and information risk management leader, holding global senior management roles with large, diversified financial services companies. He has served as Fidelity's CISO since May 2024.

stage1Category: Management Role


text: Management of the Sponsor is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Trust, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of Fidelity. The Sponsor is also made aware of material cybersecurity incidents which impact the Trust.


text: Risk management and strategy We prioritize the management of cybersecurity risk and the protection of information across our enterprise by embedding data protection and cybersecurity risk management in our operations. Our processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes.

companyName: Gogo Inc.

ticker: GOGO


text: As a foundation of this approach, we have implemented a layered governance structure to help assess, identify, manage and report cybersecurity risks. Our cybersecurity program leverages the NIST Framework, which outlines the core components and responsibilities necessary to sustain a healthy and well-balanced cybersecurity program. To protect our network and information systems from cybersecurity threats, we use various security tools and policies that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools.


text: We have a number of policies and procedures supporting the cybersecurity program, including a comprehensive enterprise cybersecurity incident response plan which is activated in the event of a cybersecurity incident. The incident response plan is a detailed playbook that specifies how Gogo classifies, responds to, and recovers from cybersecurity incidents and includes notification procedures that vary depending on the significance of the incident. When warranted by the severity of the incident, the Board, the Audit Committee, the Chief Executive Officer and other senior executives are part of the notification chain.


text: As of the date of this Annual Report on Form 10-K, we have not implemented formal processes to oversee and identify risks from cybersecurity threats associated with our use of third parties. We are working toward the implementation of a third-party risk management program. We believe that this program will better enable us to identify and manage material risks from cybersecurity threats related to our third-party service providers.

companyName: Montauk Renewables, Inc.

ticker: MNTK


text: We conduct regular reviews and tests of our cybersecurity program, which includes tabletop exercises, penetration and vulnerability testing, simulations, and other exercises, as well as leverage audits by our internal audit team to evaluate the effectiveness of our cybersecurity program and controls and improve our security measures and planning. We also engage external auditors to review our cybersecurity program and controls, as well as engage third parties to perform penetration testing and vulnerability scanning of our public and private assets.


text: With respect to third-party service providers, we obligate our vendors to adhere to privacy and cybersecurity measures through various contractual provisions to the extent possible, and we perform risk assessments of vendors as appropriate from time to time, which includes a vendor's ability to protect data from unauthorized access. As described in Item 1A "Risk Factors," our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor misconduct and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business, including the loss of customer confidence, reputational harm, our operating results and our financial condition. We have insurance designed to cover certain expenses relating to cybersecurity incidents; however, damage and claims arising from a cybersecurity incident may exceed the amount of any insurance available. While we have experienced cybersecurity incidents, to date, we do not believe that we experienced a material cybersecurity incident during the fiscal year ended December 31, 2024.


text: The sophistication of cybersecurity threats, including through the use of artificial intelligence, continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency such as our contemplated use of artificial intelligence may further expose our computer systems to the risk of cybersecurity incidents.


text: As part of our overall risk management approach, we prioritize the identification and management of cybersecurity risk at several levels, which involves Board and Audit Committee oversight, senior and department executive leadership focus and commitment, and employee training. Our Audit Committee, comprised entirely of independent directors from our Board, oversees the Board's responsibilities relating to the operational (including information technology ("IT") risks, business continuity and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through annual assessments, quarterly reporting and regular updates from members of the Company's executive leadership team, cybersecurity and data privacy leadership team, as well as the Internal Audit team.


text: Our Senior Vice President, Chief Information Security Officer ("CISO"), leads our cybersecurity team and has over 15 years of experience establishing and leading comprehensive cybersecurity programs. Our CISO retired from the United States Navy, where he served in various roles with increasing responsibility, most recently serving as the Director of Operations – Navy Cyber Defense Operations Command. In that role, our CISO led a team of 450 personnel overseeing networks with more than 800,000 endpoints and more than 200 IT, Cloud, Legacy, and Operational Technology networks globally. We believe that our CISO's technical expertise and background assist us with the navigation of the extensive regulatory framework to which we are subject as a federal contractor, including the achievement of the Cybersecurity Maturity Model Certification ("CMMC") program. We believe we are well-positioned to meet the requirements of CMMC and are preparing for certification.


text: We also have management level committees and a cybersecurity incident team who support our processes to assess and manage cybersecurity risk as follows: • The Cybersecurity Cross Functional Team (the "Cybersecurity CFT"), led by our CISO, brings together IT, legal, compliance and other function heads. The Cybersecurity CFT meets at least quarterly (or more frequently as needed) and provides a forum for these cross-functional members of management to: consider emerging technologies, such as artificial intelligence and emerging cybersecurity risks; review cybersecurity and privacy regulations; approve, review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. • The Gogo Executive Cybersecurity Committee (the "GECC") is comprised of executive leadership and members of the cybersecurity, operations, risk, legal, and internal audit teams. The GECC liaises with the Cybersecurity CFT and provides oversight of all aspects of Gogo's cybersecurity program and, at regular intervals through the year, evaluates key cybersecurity metrics as well as planned and ongoing initiatives to reduce cybersecurity risks. • The Incident Response Management Team (the "IRMT"), which includes senior executives and members of our cybersecurity leadership team, was established to support our incident response plan and reports into the GECC. Members of the IRMT are alerted as appropriate to cybersecurity incidents, natural disasters and business outages. The IRMT annually assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss the event and response options. The IRMT also engages with the Company's Board and the Audit Committee depending on the severity of the cybersecurity incident.


text: The output of each of the foregoing committees are collected and analyzed on a regular basis and our CISO briefs the Audit Committee, through quarterly updates as well as on an ad hoc basis between regular updates to the extent needed.


text: At the employee level, we maintain an experienced IT team tasked with implementing our privacy and cybersecurity program and supporting our cybersecurity leader in carrying out reporting, security and mitigation functions. We continuously seek to promote awareness of cybersecurity risk through communication and education of our employee population, and have a mandatory training program which covers privacy and cybersecurity (including phishing tests) and records and information management.


text: With respect to third party service providers, we obligate our vendors to adhere to privacy and cybersecurity measures, and we perform risk assessments of vendors, including their ability to protect data from unauthorized access.


text: Cybersecurity Risk Management and Strategy Cybersecurity is an important part of our overall risk management systems and processes and an area of focus for our Board and management. We have developed and implemented an enterprise-wide information security program designed to identify, protect, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity and privacy threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools, third-party Security Operations Center monitoring and incident response services, proactive patching and risk mitigation, and a third-party penetration testing program to allow security researchers to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors. We also maintain a third-party risk management program to ensure we understand the security posture of the partners we integrate with or build business reliance upon, ensure they can meet our cybersecurity standards and policies, and take precautions and mitigations designed to limit our exposure to supply chain attacks; however, there are circumstances in which the efforts of the third parties upon which we rely to maintain risk management programs have not been successful and we cannot ensure in all circumstances that the efforts of the third parties upon which we rely to maintain risk management programs will be successful in the future.

companyName: Emerald Holding, Inc.

ticker: EEX


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. This data is consolidated in centralized repositories, assessed using industry-standard practice risk quantification models, and prioritized for remediation based on risk and impact to the business. We have in the past used widely adopted risk quantification models, including those described in National Institute of Standards and Technology (NIST) special publications as well as the FAIR Institute's Factor Analysis of Information Risk (FAIR) methodology for Quantifying and Managing Risk to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards, and may continue to use these or other models in the future. We conduct regular reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and continuously improve our security measures and planning. We have a role-based security training program under which all staff undergo mandatory periodic security awareness training, with additional on-the-job security training and coaching provided to our IT and technology personnel by an external third-party cybersecurity firm. We continuously enhance our cybersecurity measures by providing ongoing simulated phishing exercises to our employees to increase their preparedness to address potential threats. The results of these assessments are reported to the Audit Committee as discussed below under "--Cybersecurity Governance."


text: In the last ten years, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect us, including our business, financial condition, cash flows and results of operations. However, we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our business, financial condition, cash flows and results of operations. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents could materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "We face continually evolving cybersecurity and similar risks, which could result in loss, disclosure, theft, destruction or misappropriation of, or access to, our confidential information and cause disruption to our business, damage to our brands and reputation, legal exposure and financial losses," which is incorporated by reference into this Item 1C.


text: Cybersecurity Governance The Board oversees our annual enterprise risk assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats. Specifically, our Audit Committee is responsible for the oversight of risks from cybersecurity threats and receives regular updates from senior management including our Senior Vice President of Information Technology on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. Our cybersecurity protocol requires that the Chair of the Audit Committee and senior management be immediately notified upon any cybersecurity incident.


text: Our Senior Vice President of Information Technology, who has over 20 years of experience in the information technology sector, leads our global information security team responsible for overseeing the Emerald information security program. In addition, the team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies. This team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel, analysis of threat intelligence and review of other information obtained from governmental, public or private sources (including external consultants engaged by us), and alerts and reports produced by security tools deployed in the IT environment. The team provides regular reports to senior management and other relevant teams on various cybersecurity threats, assessments, and findings.


text: The audit committee of our board of directors has primary responsibility for overseeing our risk management process relating to cybersecurity, which includes risks arising from cybersecurity threats.

companyName: Xponential Fitness, Inc.

ticker: XPOF


text: Cyber Risk Management and Strategy The Company, under the oversight of the audit committee of the board of directors, has implemented and maintains an enterprise risk management process, which includes periodic assessments of various risk categories, including cyber risks, across the Company. Our process for assessing, identifying, and managing risks from cybersecurity threats is informed by industry standards and supported by cybersecurity technologies, including third-party security solutions, monitoring, and alerting tools, designed to monitor, identify, and address cybersecurity risks.

companyName: NEKTAR THERAPEUTICS

ticker: NKTR


text: We leverage a managed security service provider and also engage with other third-party providers and consultants to support our cyber risk management efforts, including through periodic security testing. We have a process to assess and review the cybersecurity practices of information technology third-party vendors and service providers, including through review of applicable certifications, security reports, and vendor questionnaires and contractual requirements, as appropriate.


text: Governance Related to Cybersecurity Risks Our cyber risk management program and related operations and processes are directed by the Head of IT in consultation with the legal team and our third-party security advisor. Currently, the Head of IT role is held by an individual who has over 20 years of information technology experience. The Head of IT reports to the Chief Legal Officer.


text: The Head of IT meets with the Chief Legal Officer periodically to discuss and review our cybersecurity risk management processes and to address matters related to potential cybersecurity and information technology risks, with input from the Company's third-party technology providers, as appropriate. In addition, the Head of IT has regular meetings with our managed security service provider to inform our cyber risk management processes and reporting to management. The Head of IT, working with the Chief Legal Officer, provides periodic reports on cybersecurity and information technology matters to the audit committee, which is responsible for reviewing and overseeing the Company's risk management process, including cybersecurity risks.


text: The Chief Legal Officer and the audit committee periodically report on cybersecurity risk management to the full board of directors. The board of directors, as a whole and through its committees, has responsibility for the periodic review and oversight of information technology risks, including cybersecurity risks.


text: Our enterprise risk management program is overseen by a risk management committee comprised of senior managers across key functional areas that cover cybersecurity and information technology matters. This committee provides periodic reports and updates, as needed, to the board of directors or one of its designated committees. In collecting information on enterprise risk, cybersecurity is included as a designated risk category, and the results of our enterprise risk assessment processes, including risks related to cybersecurity, are also discussed with the audit committee and among senior management on a periodic basis.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For more information regarding cybersecurity risks that may affect or Company, see "Item 1A. Risk Factors" included in this Report.


text: Risk management and strategy We have implemented and maintain policies and processes designed to assess, identify, and manage material risk from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data we may collect about trial participants in connection with clinical trials, sensitive third-party data, business plans, transactions, and financial information ("Information Systems and Data"). We have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: biote Corp.

ticker: BTMD


text: Our cybersecurity function, which comprises, in part, our information technology ("IT") security director and other members of our technical staff management, along with our legal advisors, risk management team, and overall information security function, helps identify, assess and manage our cybersecurity threats and risks. Our IT security department, under the direction of our Chief Information Officer ("CIO") and led by our IT security director, identifies and assesses risks from cybersecurity threats by monitoring cybersecurity and operational risks using various security tools designed to protect against, detect, and respond to cybersecurity threats, and has implemented processes and procedures aligned with our information security management system to support and promote resilient programs. This includes automated tools, security assessment and monitoring; restricted physical access to servers and network equipment, system audits and third party assessments, third-party IT vendor risk management process to assess and manage risk presented by our IT vendors, third party threat assessments, evaluating threats reported to us, and annual review of cybersecurity insurance policies and the associated levels of coverage based on current risks.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, an incident response plan, a vendor risk management program, employee training, data encryption, physical security, dedicated cybersecurity staff, systems monitoring, cyber insurance, and asset management, tracking, and disposal.


text: We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, managed cybersecurity service providers, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services.


text: See our risk factors under Part I, Item 1A Risk Factors in this Form 10-K for additional information regarding cyber-security related risks that could materially affect our business strategy, results of operations, or financial condition.


text: Our Board of Directors and Audit Committee are actively engaged in the oversight of our risk management, including cybersecurity risk. The Board of Directors and Audit Committee receive quarterly reports on information security from our CIO. The Audit Committee is responsible for overseeing our risk exposure to information security, cybersecurity, and data protection, as well as the steps management has taken to monitor and control such exposures.


text: Our IT security department, which assesses and manages our risks from cybersecurity threats, is led by our CIO, who reports to our chief executive officer. We have in place an incident response plan to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards. Our CIO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CIO meets with the audit committee periodically to review our information technology systems and discuss key cybersecurity risks. Additionally, we maintain a qualified third-party vendor relationship which is available to the team for on-demand incident response and investigation, as needed.


text: Our IT security director reports to our CIO and has more than 25 years of experience working in information technology-related roles, holds a Masters in Information Systems, with a focus in cybersecurity and a Masters in Business Administration, with an emphasis in business intelligence and analytics management.


text: At Urgently, we understand the paramount importance of cybersecurity in safeguarding our operational integrity, customer information, and proprietary data. Our commitment to cybersecurity excellence involves a comprehensive approach to risk management and the continual enhancement of our cybersecurity protocols to address the dynamic nature of cyber threats.

companyName: Urgent.ly Inc.

ticker: ULY


text: Board Oversight and Cybersecurity Governance Our cybersecurity strategy is firmly anchored in a governance structure that emphasizes board oversight. The Board of Directors work to ensure our cybersecurity posture and cybersecurity risks are adequately evaluated and managed in alignment with our business objectives. To this end, the Board receives regular updates on our critical cybersecurity initiatives, risk management practices, and incident response measures. This oversight ensures that cybersecurity remains a top priority at the executive level and that strategic decisions reflect our commitment to safeguarding our digital assets.


text: The Board is supported by the Cybersecurity Risk Committee, a specialized group that includes senior executives and departmental representatives from IT, legal, human resources, and operations. This committee is charged with the development of cybersecurity policies, evaluation of defense mechanisms, and oversight of the company's response to cyber incidents.


text: Our Cybersecurity Risk Committee, led by our Chief Financial Officer, receives input from third party cybersecurity risk advisors that bring decades of experience in designing, implementing, and managing cyber security risk programs. They are experts in the assessment, identification, and management of cybersecurity risk. Our Cybersecurity Risk Committee members meet and collaborate regularly with our information technology and operations teams, stay abreast of industry trends and relevant regulations, and regularly inform management of various cybersecurity risks, trends, threats, and countermeasure techniques.


text: Cybersecurity Risk Management Program Our Cybersecurity Risk Management Program is designed around the Center for Internet Security (CIS) Controls version 18. The CIS Controls offer a strategic framework that directs our implementation of effective cybersecurity defenses across 18 critical areas, ranging from asset management to data protection and network security.


text: A cornerstone of our cybersecurity governance is the annual performance of comprehensive cybersecurity risk assessments performed by third party cybersecurity advisors. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as monitor and test our safeguards. The insights gained from these assessments inform the continuous refinement of our cybersecurity strategies and defense mechanisms. As a core component of our risk management process, all employees are required to participate in annual information security training.


text: We engage third parties annually to evaluate our information security posture, risks and third-party service provider solutions as part of our overall risk management activities. We maintain an inventory of vendors and third-party service providers and evaluate those service providers for cybersecurity risks annually at a minimum.


text: Cybersecurity Incidents and Responses As of the date of this Annual Report on Form 10-K, we have no t identified any risks from cybersecurity threats that have materially impacted our Company, our business operations, and our financial condition. Recognizing the potential impact of significant disruptions, we remain committed to fortify our systems against evolving threats. Any significant disruption to our ability to transact business could adversely affect our business performance as well as our reputation. For additional detail about the cybersecurity risks facing our Company, and whether they are reasonably likely to affect our Company, please see the discussion in Item 1A, "Risk Factors."


text: Our commitment to cybersecurity resilience includes an ongoing monitoring program and a well-defined incident response plan that provides guidelines for mitigating the impact of cyber threats. These processes are periodically reviewed and updated to address emerging threat intelligence and other matters.


text: Future Directions Looking ahead Urgently is dedicated to maintaining a vigilant stance against cyber threats. We will continue to invest in cutting-edge cybersecurity technologies, enhance our staff training programs, and foster collaborations with leading cybersecurity experts. Our board-driven, proactive approach to cybersecurity risk management is integral to our mission of delivering unparalleled value to our customers, employees, and shareholders, safeguarding our reputation, and ensuring the long-term success of our Company.

stage1Category: None/Other


text: Risk Management and Strategy The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company relies on the cybersecurity strategy and policies implemented by Bain Capital, the parent of the Advisor and Administrator, which apply to the Company and its operations.

companyName: Bain Capital Private Credit


text: Bain Capital has adopted and implemented an Information and Cybersecurity Program ("Cybersecurity Program") that prioritizes detection and analysis of and response to cybersecurity threats, management of security risks and resilience against cyber incidents, including those that may impact the Company. The Cybersecurity Program aligns with National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and is reviewed and adjusted as needed and is approved by the Bain Capital's Chief Information Security Officer ("CISO").


text: Bain Capital's Cybersecurity Program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help prevent and respond to cybersecurity threats and incidents, including threats or incidents that may impact the Company, the Advisor or the Administrator. Bain Capital's cybersecurity risk management processes, which are part of Bain Capital's overall risk management system, seek to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessments of cybersecurity risks, including those which may impact the Company, the Advisor, or the Administrator, are reported to the Bain Capital Credit Risk Oversight Committee ("ROC") for awareness, review or action, as appropriate. In addition, the Company relies on Bain Capital to periodically engage with third-party consultants and key vendors to assist it in assessing, enhancing, implementing and monitoring its cybersecurity risk management processes and responding to incidents.


text: Internal and external networks, including the networks on which the Company relies, are assessed for vulnerabilities. Bain Capital also engages with independent third parties to conduct relevant technical assessments.


text: Bain Capital seeks to remain aware of the evolving global threat landscape through vendor relationships, partnerships with threat intelligence providers and membership of industry forums/groups, as well as research performed by members of the Information Security Team. Bain Capital is currently an active member of the Financial Services Information Sharing and Analysis Center (FS-ISAC) and the Alternative Investment ISAC.


text: Bain Capital provides information security awareness training to employees, and function-specific security training is also provided (where appropriate based on job function). Bain Capital also engages in phishing campaigns.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on Bain Capital's Vendor Risk Management Program in conjunction with a Third Party Risk Management (TPRM) steering committee to assess risks posed when engaging with external vendors and/or third parties, including identifying and overseeing risks from cybersecurity threats associated with the Company's use of such entities.


text: In the event of a cybersecurity incident impacting the Company, the Advisor has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational and risk functions of Bain Capital, which may include coordinating with the relevant employees of the Advisor and management of the Company. The incident response plan includes notification to the applicable members of cybersecurity leadership, including Bain Capital's CISO, and, as appropriate, escalation to other relevant individuals.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with Bain Capital's CISO, as well as other risk management, legal, information technology, and/or compliance personnel of Bain Capital.


text: Material Impact of Cybersecurity Risks During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or that are reasonably likely to materially affect the Company, including our business strategy, operational results, and financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors— General Risk Factors— We are highly dependent on information systems, and systems failures or cyber-attacks could significantly disrupt our business, which may, in turn, negatively affect the value of our Common Shares and our ability to pay distributions."


text: The Company's Board of Trustees ("Board") provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO"), which incorporates updates provided by Bain Capital's CISO regarding the overall state of the Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents potentially impacting the Company.


text: Bain Capital's CISO and Information Security Team are responsible for the Cybersecurity Program applicable to the Company and, along with the Company's CCO, are responsible for assessing and managing material risks from cybersecurity threats that impact the Company. The CCO of the Company oversees the Company's oversight function generally and relies on Bain Capital's CISO to assist with assessing and managing material risks from cybersecurity threats. The Company's CCO has been responsible for this oversight function as CCO to the Company for 10 years and has more than 14 years' experience in information security, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company. Members of Bain Capital's management also possess relevant expertise in various disciplines that are key to effectively managing such risks, such as extensive experience in managing compliance risks in the financial sector, including those related to cybersecurity. Bain Capital's CISO has deep expertise in cybersecurity, holding the CISSP certification and having completed an Executive Master's in Cyber Security from Brown University and having received a Chief Risk Officer Certificate from Carnegie Mellon. Members of Bain Capital's Information Security Team hold various industry certifications and regularly attend trainings and industry conferences


text: The Sponsor, Fidelity Management & Research Company LLC, and their respective affiliates operating as a business organization (collectively, "Fidelity") and its Enterprise Cybersecurity organization, on behalf of the Trust, have established a comprehensive risk management program, which includes processes to identify, assess, and manage cybersecurity risks, including material risks from cybersecurity threats, and to put in place appropriate controls to mitigate these risks and reduce the potential impact to the Trust and its Shareholders. The Trust does not have any employees and relies upon Fidelity and its Enterprise Cybersecurity organization for the Trust's day-to-day operations and to establish strategies, policies, and standards for the security of, and operations in, cyberspace.

companyName: Fidelity Wise Origin Bitcoin Fund

ticker: FBTC


text: The Trust depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. Through its vendor management program, and on behalf of the Trust, Fidelity oversees and identifies risks from cybersecurity threats associated with the use of third-party service providers. This vendor oversight program includes periodic reviews of the cybersecurity controls of third-party service providers. The frequency of such reviews is generally based on the nature of Trust's information processed by the vendor and the vendor's criticality to business operations.


text: On behalf of the Trust, Fidelity engages third-party consultants to assess, identify, and/or manage material risks from cybersecurity threats. For example, Fidelity engages third-party consultants to perform audits of its cybersecurity measures and risk management processes, including those applicable to Trust. Fidelity has also hired qualified independent assessors to review applicable security controls in accordance with the American Institute of Certified Public Accountant's System and Organization Controls assurance programs. Additionally, Fidelity utilizes third-party consultants with specific areas of cybersecurity expertise to review and report on various aspects of its cybersecurity program, including those applicable to the Trust. The results of these consulting engagements are shared with the Sponsor as part of periodic reports.


text: Fidelity's Enterprise Cybersecurity organization has a threat intelligence program which monitors for emerging cyber threats. Taking information gathered from public and private sources, including industry groups such as the U.S. Cybersecurity and Infrastructure Security Agency and the Financial Services Information Sharing and Analysis Center, the organization analyzes such information and incorporates tactics, techniques, and procedures into the program's security monitoring and detection tools and processes.


text: The potential impact of risks from cybersecurity threats on the Trust are assessed on an ongoing basis, and how such risks could materially affect the Trust's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Sponsor did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Trust, including its day-to-day operations, financial condition, and business strategies. In conjunction with Fidelity's Enterprise Cybersecurity, the Sponsor, on behalf of the Trust, participates in regular testing of applicable incident response processes to ensure appropriate escalation, mitigation, communication and reporting processes are in place.


text: The Sponsor provides strategic oversight regarding cybersecurity risks and threats. The Sponsor's Compliance and Risk Management Committee ("CRMC") comprised of various officers of the Sponsor and the broader Fidelity organization receives and reviews periodic reports from senior executives in Fidelity's enterprise cybersecurity organization, including Fidelity's Chief Information Security Officer ("CISO") and members of the CISO's staff. These reports contain information about risks from cybersecurity threats, including the results of recent independent reviews of the cybersecurity program, summaries of recent cybersecurity threat intelligence assessments, progress on key initiatives and strategies, and updates on recent regulatory activities, including new regulations and examinations.


text: The CRMC is responsible for assessing and managing material risks from cybersecurity threats. In connection with the Trust's reliance on Fidelity and its Enterprise Cybersecurity organization, the CRMC relies on the cybersecurity expertise of Fidelity's CISO and members of the CISO's staff to assist in assessing and managing the Trust's material risks from cybersecurity threats. The CISO has over thirty years of experience as a technology and information risk management leader, holding global senior management roles with large, diversified financial services companies. He has served as Fidelity's CISO since May 2024.


text: Management of the Sponsor is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Trust, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of Fidelity. The Sponsor is also made aware of material cybersecurity incidents which impact the Trust.


text: Assessment, Identification and Management of Material Risks from Cybersecurity We rely on the cybersecurity strategy and policies implemented by Inland and the Sub-Advisor. Inland's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Inland's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Inland has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: InPoint Commercial Real Estate Income, Inc.

ticker: ICR-PA


text: Inland's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help our sponsor and Advisor to prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us, our Advisor, and Dealer Manager. Inland's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us, our Advisor, and Dealer Manager, is integrated into Inland's risk management program. In addition, Inland periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs, including performing penetration testing of Inland's networks, and security assessments of the effectiveness of Inland's information technology environment to identify potential vulnerabilities.


text: Inland's cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities as well as regular phishing simulations for all of the employees of the Advisor and its affiliates. Inland undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of our Advisor, and Dealer Manager, and our critical third-party vendors (including the transfer agent) and other partners.


text: Inland has established a Computer Security Incident Response Team ("Inland CSIRT"), which aims to manage and mitigate the impact of cybersecurity breach events, including those arising from or impacting our Advisor, Dealer Manager and service providers (including the transfer agent), tenants, borrowers, and other business contacts. Members of the Inland CSIRT include Inland's VP Director of IT Infrastructure & Information Security, who has more than 20 years of experience in information technology security and leads Inland's cybersecurity program, and its Head of Technology Strategy, as well as members of the firm's legal, risk, and communications groups. Inland has established a notification decision framework to determine when the Inland CSIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including members of our Advisor's management, and our Board and Audit Committee, as appropriate.


text: As part of our Sarbanes-Oxley controls, our Internal Audit department tests our IT policies including those pertaining to passwords, backup and recovery, user access, change control and hardware and software maintenance. These audits assess key information security and cybersecurity risks in the environment that may affect the confidentiality, integrity and availability of financial reporting systems and data. Additionally, key employees complete a survey containing questions about cybersecurity in connection with the quarterly Sarbanes-Oxley certification process. If any control deficiencies that represent material cybersecurity risks are identified in connection with these audits, those would be reported to the Audit Committee and Board of Directors. We also obtain SOC 2 certifications from certain of our third-party service providers.


text: The Sub-Advisor's cybersecurity program provides a structured approach which serves to promote practices, procedures, and methodologies that seek to appropriately mitigate information security risks on behalf of its investment vehicles and its underlying investors. At all times, the Sub-Advisor seeks to proactively identify potential risks to its business and develop policies and procedures to minimize such risks. The Sub-Advisor has implemented data security policies, which include provisions to limit access to sensitive data only to those who require it; to follow a policy of least privilege; and an authorization process for those who otherwise request access to data. The Sub-Advisor has also implemented backup and recovery procedures, with backup occurring on a nightly basis and disaster recovery tests conducted on an annual basis. The Sub-Advisor's internal systems are protected by security measures, including hardening policies, firewalls, and disaster recovery tests. In addition, the Sub-Advisor makes use of encryption standards on its systems and requires multifactor authentication for remote access. The Sub-Advisor ensures company-related data is compartmentalized on its employees' personal mobile devices and ensures that its employees are trained on and subject to appropriate confidentiality obligations. The Sub-Advisor performs security risk assessments on a monthly basis and additionally conducts internal and external penetration tests on an annual basis.


text: The Sub-Advisor has developed a comprehensive incident response plan and established a Cybersecurity Task Force which leads the effort for enhancing data protection practices and is responsible for administering the cybersecurity policy and determining and implementing the appropriate technical and organizational measures within the firm for the safeguarding of sensitive data. The Director of Information Technology at the Sub-Advisor is primarily responsible for assessing cyber risk and bringing risks to the attention of the other members of the Cybersecurity Task Force. The Sub-Advisor has also engaged a third-party to assist with tasks such as planning incident response plans, conducting tabletop exercises, conducting phishing exams, etc.


text: Oversight of Cybersecurity Risks The Board and our Audit Committee oversee our cybersecurity risk exposures and the steps taken by management to identify, monitor and mitigate cybersecurity risks to align our risk exposure with our strategic objectives. With respect to such cybersecurity risk oversight, our Board and/or our Audit Committee receive periodic reports and/or updates from management on the primary cybersecurity risks facing us and the Advisor, the Sub-Advisor, and the Dealer Manager and the measures we, the Advisor, the Sub-Advisor and the Dealer Manager are taking to mitigate such risks. In addition to such reports and updates, our Board and/or our Audit Committee receive updates from management as to changes to our and the Advisor's, the Sub-Advisor's and the Dealer Manager's cybersecurity risk profile or certain newly identified risks. In the event of an incident, we intend to follow Inland's incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel, senior leadership and the Board or Audit Committee, as appropriate.


text: Impact of Cybersecurity Risks As of the date of this filing, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Part I, Item 1A, Risk Factors, Risks Related to an Investment in Our Company" for more information regarding cybersecurity risks.


text: We have processes in place for identifying, assessing and managing material risks associated with cybersecurity threats. For a discussion of how risks from cybersecurity threats affect our business, please see our Risk Factors discussion under the heading, "Cybersecurity and Information Technology Risks" in this Form 10-K.


text: Risk Management and Strategy Enterprise risk management is the responsibility of our executive management team consisting of our chief executive officer, chief financial officer, chief legal officer and our vice presidents of operations, business development and environmental, health and safety. Our executive management team meets on a weekly basis and discusses cybersecurity on an ad hoc basis when it is relevant. Our director of Information Technology, who reports directly to our chief executive officer, and our director of Internal Audit are primarily responsible for management of cybersecurity risk. Our director of Information Technology is an active ISC2 accredited member with 15 years of information technology experience, namely in developing solutions focused on private and hybrid cloud computing systems for small scale organizations. In accordance with our overall enterprise risk management process, our executive management team supervises our director of Information Technology to assess, identify, report and manage material risks from cybersecurity threats and relies on our director of Internal Audit to assess, identify and report those risks. As part of this process, we rely significantly on third-party providers to assist us with our cybersecurity risk management and strategy. These providers supply ongoing services including consulting services, access to a virtual CISO, threat monitoring and detection, threat response and mitigation strategies, updates on emerging trends and developments with policy and procedure guidance. Other service providers offer targeted assistance such as security and forensic expertise on an as needed basis. We also maintain cybersecurity insurance.


text: With respect to our employees, we run a multi-faceted security awareness program that includes regular, mandatory trainings for our personnel on data protection and malware detection, policy and process awareness, periodic phishing simulations and other kinds of preparedness testing.


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected us, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, "Cybersecurity and Information Technology Risks" in this Form 10-K.


text: The Audit Committee is tasked with overseeing our risks related to cybersecurity, including reviewing the state of our cybersecurity, emerging cybersecurity developments and threats, and our strategy to mitigate cybersecurity risks. From time to time, members of our executive management team and our directors of Information Technology and Internal Audit provide updates to the Audit Committee and the Board of Directors regarding cybersecurity incidents and cybersecurity planning.


text: We are committed to protecting our information systems against cybersecurity threats. Any cybersecurity incident can adversely affect our business and disrupt our operations as described in greater detail in our Risk Factors relevant to cybersecurity risks. Our senior leadership, in consultation with our board of directors, has assigned responsibilities for ensuring and overseeing the operation of our information security program to the Marchex Information Security Committee ("ISC") comprised of senior representatives of departments across our organization.

companyName: MARCHEX INC

ticker: MCHX


text: Effective risk management is a critical component of our operations. The ISC conducts a formal cybersecurity risk assessment annually. The assessment methodology is designed to identify cybersecurity threats to our information systems and considers a range of relevant risk factors that include both intentional and unintentional human acts by our or our vendors' personnel, or malicious third-party actors, risks inherent to technology/equipment we and our service providers use, as well as natural and environmental risks. The ISC discusses and documents mitigation strategies based on the risks identified. Results of assessments are reported to senior leadership and our board of directors. To the extent that any control deficiencies or material changes in the threat environment are identified, the ISC may make recommendations for new or improved controls and threat mitigation strategies.


text: The ISC also oversees day-to-day cybersecurity risk mitigation efforts, which include, but are not limited to monitoring systems for availability, performance, and security issues, periodic vulnerability scans, penetration testing performed at least annually by independent, reputable, third-party vendors, as well as evaluating any risks associated with prospective third-party service providers who require access to sensitive customer data and implementing any additional controls to address significant risks identified. Furthermore, the ISC meets quarterly to discuss and analyze any relevant developments within the organization and industry relative to cybersecurity, reviews our internal policies and operational procedures relevant to cybersecurity at least annually, and promulgates updates when deemed necessary or advisable.


text: Risk Management and Strategy We continue to develop and implement a framework designed to safeguard our organization's digital assets from threats and vulnerabilities as part of our overall risk management system. It involves a systematic approach of identifying, assessing, and mitigating risks associated with our technology systems, data, and operations.


text: Key components of this include: • Vulnerability assessments - initiating regular evaluations to identify potential weaknesses in our systems. • Security controls and policies - establishing robust security measures and formal company-wide policies. • Employee training - training programs to ensure all employees are equipped to prevent and respond to cyber threats effectively. • Incident response plan - designing and implementing a well-defined plan for addressing cybersecurity incidents. • Continuous monitoring - establishing mechanisms for proactive monitoring of our environment to detect and respond to anomalies.


text: To ensure alignment with industry best practices we engage consultants or other third parties in conducting periodic assessments and testing of our policies, standards, processes, and practices.


text: Material risks are those that have the potential to cause substantial harm or financial loss. Our approach involves a targeted strategy to protect critical data, systems, and infrastructure against cybersecurity challenges including cyber threats, data breaches, or regulatory compliance issues.


text: Third-party risk mitigation in cybersecurity is a crucial aspect of safeguarding our digital assets and ensuring data integrity and privacy. We monitor and manage the potential vulnerabilities and security gaps that can arise when working with external vendors, partners, or suppliers who have access to sensitive information or systems. We assess the cybersecurity practices of our third parties by evaluating their compliance with security standards. Evaluating third-party compliance helps us mitigate the risks of data breaches or security incidents originating from external sources, ultimately safeguarding our reputation, legal compliance, and overall cybersecurity posture.


text: We believe that the risks from cybersecurity threats, including as a result of any previous cybersecurity events, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business, results of operations, cash flows and financial condition.


text: The Chief Technology Officer works together with our board of directors, audit committee, and members of executive management ("Cybersecurity Team") to set the strategic digital landscape. The Cybersecurity Team provides strategic guidance and oversight to ensure our cybersecurity posture is robust and aligned with our overall objectives. The Cybersecurity Team does this by establishing cybersecurity policies and setting risk tolerance levels, approving budgets for security initiatives, and ensuring compliance with relevant regulations and standards. The Cybersecurity Team engages in regular and ad hoc discussions regarding incident response strategies to assess the preparedness for cyber threats and continually evaluates our incident response plans. The Incident Response Team ("IRT") is led by the Senior Vice President of Information Technology, who is the overall incident response coordinator. The IRT, under the guidance of the Chief Technology Officer, assesses risk and materiality of an incident and engages members of Cybersecurity Team as needed.


text: Through ongoing communications with these teams, the Chief Technology Officer and the Cybersecurity Team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the board of directors and the audit committee when appropriate.


text: Our Chief Technology Officer's experience includes various roles in information technology, data analytics, and information security at both public and private companies. Members of the Cybersecurity Team each hold undergraduate and, in some cases, graduate degrees in their respective fields, and each have experience managing risk at the Company or at similar companies, and assessing cybersecurity threats.


text: The Company recognizes that the security of our operations is critical to protecting our customers and maintaining the reputation of the Company. Management is committed to managing Information Security ("IS") risk, which includes cybersecurity, that may impact the Company. The Enterprise Risk Committee ("ERC") of the Board of Directors provides oversight of the Company's written Information Security Management and Information Technology Governance Programs (the "Programs"). Through the Programs, the Company has established polices, processes, controls, and systems designed to identify, assess, measure, manage, monitor, and report risks related to cybersecurity and help prevent or limit the effect of possible cybersecurity threats and attacks. As cybersecurity threats continue to evolve, the Company expects to continue to monitor and enhance the current controls and systems in place to detect and prevent cybersecurity attacks and to remediate discovered vulnerabilities.

companyName: LAKE SHORE BANCORP, INC.


text: The Company's Information Security Officer ("ISO") is responsible for the design and execution of the Information Security Management Program and the information and cyber security aspects of the Information Technology Governance Program. The ISO works in concert with members of the Information Technology ("IT") Department, including the Bank's Chief Information Officer ("CIO"), to ensure the execution of the Programs. The aforementioned individuals meet with management on a monthly basis through an IT Steering Committee in which management assesses IS and IT risk.


text: Additionally, the ISO provides the ERC with regular reports on the status and effectiveness of the Programs and risk management activities, as well as cyber and IS issues that may affect the Company.


text: The ISO has served various roles involving anti-money laundering, law enforcement, security, and information technology for over 7 years. The ISO holds an undergraduate degree in Legal Studies and master's degree in Criminal Justice and Criminology. The ISO reports to the Chief Financial Officer ("CFO") as well as the Chairperson of the ERC. The CIO has served various roles in audit, information risk, information technology, and information security in multiple industries for over 12 years. The CIO holds an undergraduate degree in Management Information Systems and has attained the ISACA Certification in Certified Information Systems Auditor ("CISA"). The CIO reports to the Chief Executive Officer ("CEO").


text: The Company utilizes the following guidelines and frameworks to develop and maintain the Information Security Management Program: Federal Financial Institutions Examination Council ("FFIEC") Information IT Examination Handbooks, FFIEC Cybersecurity Assessment Tool ("CAT"), Center for Internet Security Critical Security Controls, National Institute of Standards and Technology Special Publication 800 Series, National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), 12 CFR Appendix B to Part 30 - Interagency Guidelines Establishing Standards for Safety and Soundness Gramm-Leach-Bliley Act ("GLBA") 501(b).


text: The Information Security Management Program features layered controls of network and endpoint intrusion detection and prevention, enterprise malware protection, threat-monitoring, and a Security Operations Center that provides full time support and additional operational measures to monitor and respond to data breaches and cyberattacks. The Company leverages regular assessments to identify current and potential threats and vulnerabilities within the Company's environment. Technical vulnerabilities are identified through regular automated vulnerability scans and periodic vulnerability and penetration testing performed by independent third parties. Non-technical vulnerabilities are identified through the IT and IS Assurance Program by conducting regular process and procedural reviews as well as risk assessments. The Company uses the FFIEC CAT and NIST CSF to help identify cybersecurity risks and determine our cybersecurity preparedness. The Company's information security and cybersecurity risk appetite statements define the levels of risk the Company is willing to accept and guide the risk management decisions of the Company. The risk appetite statements are approved by the Board of Directors annually.


text: The Company also recognizes the risks associated with the use of third party providers and maintains a Third Party Management Program that is responsible for the oversight of outsourced services. This enables the Company to identify risks related to third parties through an inherent risk assessment and a due diligence review process designed to ensure third parties are in compliance with the Company's risk and information security expectations.


text: The Company's Security Awareness Program provides annual, mandatory training for personnel on information security to prepare personnel with the knowledge of how to properly use and protect Company resources from internal and external threats. The Program also conducts regular phishing assessments and targets new hires and other groups with specific training related to their job activities or risk levels. The Program also communicates information security policies, standards, and practices to personnel and requires annual review and acknowledgement of the policies.


text: For the year ended December 31, 2024, the Company has not identified any specific risk from a cybersecurity threat that has materially affected, or is reasonable likely to affect, the Company's business strategy, results of operation, or financial condition, other than those described in Item 1A. Risk Factors - Risks Related to Operations.


text: The Company is externally managed by the Adviser and has no employees or internal information systems. As such, the Company relies on the Adviser's risk management program and process, which include cyber risk assessments, as well as other third-party service providers to protect the Company's information from cybersecurity threats.

companyName: First Eagle Private Credit Fund


text: Cybersecurity Risk Management and Strategy The Adviser has implemented policies and associated controls and procedures to safeguard both firm and client data and assets (the "Cybersecurity Program"), and the Cybersecurity Program continues to evolve in an effort to keep pace with industry best practices and ever-changing cyber threat environment. The Cybersecurity Program is designed to protect the confidentiality, integrity, and availability of client and consumer information systems, and the Adviser's proprietary information in compliance with SEC Guidance 2015-02 regarding Cybersecurity, and FINRA's guidance regarding Customer Information Protection, and interagency guidance on safeguarding information. Periodic updates on the Cybersecurity Program are provided to the Adviser's Head of Risk, along with the Adviser's Risk Committee, and the Board.


text: The Cybersecurity Program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, as amended. These NIST functions are used as high-level categories to organize and report on the status of the Cybersecurity Program and are tailored to the Adviser's business objectives. There are areas within the NIST framework that the Adviser might not find applicable to its business and not necessary to fulfill the objectives of the Cybersecurity Program. The Adviser utilizes an aggregated approach to cybersecurity and considers the acceptance, avoidance, transfer, and mitigation of risks in attaining long term business objectives and minimizing financial loss. In terms of security incident and event management, the Adviser implements multiple technologies (including, but not limited to, enterprise grade next generation firewalls, well-known anti-malware protection, application whitelisting, and end detection and response software) in different layers of the Adviser's network, including utilizing a third-party vendor that provides monitoring of the Adviser's systems on a 24 hour/day, seven days/week basis. In addition, the Adviser has developed customized firm-wide cybersecurity training sessions for employees with the assistance of an outside vendor. Cybersecurity training is provided to all new employees upon hire and annually for all employees. In addition, the Adviser conducts phishing training on a monthly basis and sends out periodic newsletters on pertinent cybersecurity-related topics and events. In 2022, the Adviser engaged a consultant to conduct an independent cybersecurity risk assessment, and the Adviser has since then implemented all priority recommendations from this engagement. Other non-priority recommendations have been considered for implementation over time.


text: Cybersecurity Governance Management's Role in Cybersecurity Risk Management The Company's chief compliance officer (the "CCO"), in partnership with the Adviser's Chief Information Security Officer (the "CISO"), oversees the Company's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board. Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company.


text: Additionally, as part of the Adviser's vendor management program, members of the Adviser's information security teams will conduct periodic due diligence on the cybersecurity/data security programs of the Company's third-party service providers (this review is conducted annually with respect to the Company's custodian, sub-administrator and transfer agent). As part of their oversight of third-party service providers to the Company, the Company's CCO and the Adviser's CISO review key Company service providers' compliance and risk management policies and procedures related to cybersecurity matters and evaluate the service providers' use of information systems which may give rise to information technology vulnerabilities. Potential cybersecurity risks are identified and implications of such risks, if any, to the Company are assessed and monitored. In addition, the CCO receives regular reports from the third-party service providers regarding any cybersecurity threats and incidents at such service provider.


text: We have no t identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors have experienced threats relating to our and our third-party vendors' information systems. For more information, please see "Item 1A, Risk Factors."

companyName: Metagenomi Therapeutics, Inc.

ticker: MGX


text: The Adviser's CISO has over 9 years of experience managing risks from cybersecurity threats and developing and implementing cybersecurity policies and procedures. The responsibility of the CISO is to maintain confidentiality, availability, and integrity of the Adviser's data and that of its clients and shareholders. The CISO also reports to the Adviser's Enterprise Operations Committee on a semiannual basis. The committee is charged with determining the security posture of the Adviser. It is responsible for accepting, deferring, or mitigating the risks presented by the CISO. The CISO is also responsible for maintaining all policies and controls pertaining to cybersecurity and conducting annual risk assessments. The Company's CCO has over 15 years of experience advising on and managing compliance risks, including those related to cybersecurity, and developing and implementing policies and procedures to address such risks. The CCO reports to the general counsel of the Sub-Adviser and Administrator of the Company and to the Board on all compliance risk related matters, including those related to cybersecurity.


text: The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO and CISO regarding the overall state of the Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company. Additionally, the CCO provides updates to the Board on any reported incidences of the Company's service providers. The CCO informs the Board of material cybersecurity matters as they arise.


text: Assessment of Cybersecurity Risk The Company assesses the potential impact of risks from cybersecurity threats on an ongoing basis, and how such risks could materially affect the Company's investment strategy, operations and financial condition. As of the date of this Annual Report, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company. However, future incidents could have a material impact on our business strategy, results of investment activities and operations, or financial condition. For additional information about these risks, see "Item 1A. Risk Factors".


text: Cybersecurity Risk Management and Strategy As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of our Manager, a subsidiary of ACRES Capital Corp. ("ACRES"). As such, our Manager participates in ACRES' processes for assessing, identifying, and managing risks from cybersecurity threats, as detailed below.

companyName: ACRES Commercial Realty Corp.

ticker: ACR


text: ACRES upholds a robust cybersecurity initiative, encompassing policies and protocols aimed at safeguarding its systems, operations, and entrusted data, including ours, from potential threats or risks. ACRES employs a range of protective measures within its cybersecurity framework including physical and digital access controls, identity verification, mobile device management software, employee training programs emphasizing cybersecurity awareness and best practices, tools for identifying abnormal activities, and vigilant monitoring of data usage, hardware, and software.


text: At least annually, ACRES' third-party cybersecurity compliance consultant conducts a cybersecurity risk assessment. We periodically review reporting on these risks and our cybersecurity threats, the status of our security infrastructure, our risk management activities and the status of, and our responses to, any cybersecurity incidents. We also periodically perform simulations and tabletop exercises. All employees are required to complete training that includes various topics on cybersecurity risk management best practices. Additionally, employees are regularly tested with phishing campaigns reinforcing their awareness of email threats.


text: Cybersecurity threat risks have not materially affected our company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Operations—Our business is highly dependent on communications and information systems, and systems failures or cybersecurity incidents could significantly disrupt our business, which may, in turn, negatively affect the market price of our common stock and our ability to operate our business" in this report.


text: Cybersecurity Governance As described above, ACRES has engaged a third-party IT firm and cybersecurity compliance consultant to whom we have outsourced primary responsibility to oversee, implement and manage our processes and controls to assess, identify, and manage material risks from cybersecurity threats. ACRES management team oversees the work of the third-party IT and cybersecurity compliance consultant and regularly communicates with members of the team. Through the policies and controls described above, including an incident response policy, representatives of the third-party IT firm as well as members of ACRES management team are informed about cybersecurity threats and incidents affecting our information systems and direct our efforts to prevent, detect, mitigate and remediate cybersecurity threats and incidents.


text: The representatives of our third-party IT firm and cybersecurity compliance consultant who lead our cybersecurity risk management and risk assessment process have experience in managing information systems, developing cybersecurity strategy, implementing information security and cybersecurity programs, identifying and assessing cybersecurity risks and establishing incident response plans.


text: Additionally, we have implemented an enterprise risk management process, which addresses cybersecurity risks. This process is led by our General Counsel and includes participation by the board of directors, as appropriate. Our General Counsel reports regularly on the enterprise risk management process to executive leadership and the audit committee.

companyName: Korro Bio, Inc.

ticker: KRRO