text: Our CISO, in coordination with our Chief Information Officer ("CIO") to whom the CISO reports, leads our approach to assessing and managing cybersecurity-related risks. Our CISO has over thirty years of experience in IT, with twenty years in information security, as well as a background in software engineering and in leading security engineering teams, technical services and support teams, and sales engineering teams. Our CIO has over 20 years of experience with information technology and cyber security and a background in software engineering. Our CIO has served in lead cyber security roles at global public companies and holds a CISA certification from the Information Systems Audit and Control Association.


text: We have a written cybersecurity incident escalation process overseen by senior leadership, and when senior leadership deems appropriate, a materiality committee is convened comprised of certain members of management who assess whether incidents must be reported to the SEC and/or the appropriate authorities.

companyName: Fluence Energy, Inc.

ticker: FLNC

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: While Fluence's board of directors oversees all enterprise risks, the Audit Committee of our board of directors has primary responsibility for overseeing cybersecurity risks and management's implementation of our cybersecurity risk management program. The Audit Committee receives quarterly updates from the CISO and CIO. These updates typically cover topics such as: overview of material cybersecurity incidents that have occurred since the last update, overview of residual cybersecurity risks to our critical business assets, recent investments in our cybersecurity program, and relevant cybersecurity operational metrics. The Audit Committee will report material updates regarding cybersecurity to the Board.

stage1Category: Board Governance


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Cybersecurity Risk Management We manage our cybersecurity risks through an information security management system (ISMS) that falls under our overarching integrated management system (IMS) for quality and safety. Our cybersecurity risk management program and supporting ISMS focus our efforts on reducing residual risks to our critical corporate assets. The materiality of these risks drives the selection of appropriate controls and the prioritization of the projects and operational tasks of our cybersecurity teams.


text: Our approach to controlling these risks is designed and assessed based on our selection and implementation of certain controls from the National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. These controls are implemented to help us identify our critical assets and systems, protect them through preventative measures, detect attempts to compromise their confidentiality, integrity, and availability, respond to attacks by containing their progression and notifying relevant parties, and recover effectively if successfully compromised.


text: Key elements of our cybersecurity risk management program include but are not limited to: authentication and authorization procedures, employee security awareness training, logging and monitoring procedures, network segmentation requirements, in transit and at rest encryption of certain data we deem sensitive, periodic vulnerability scanning, periodic control validation through penetration testing, periodic phishing attack simulations, production change control requirements, periodic tabletop exercises, and written incident response plans. We also use external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes. We maintain a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: To date, we are not aware of any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Fluence. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information on potential cybersecurity risks, please see Part I, Item 1A "Risk Factors" for the risk factor entitled "Our business depends on our ability to implement improvements to and properly maintain and protect the continuous operation and data integrity of our information technology infrastructure, data, and other business systems and the inability to do so may have a material adverse effect on our reputation and harm our business prospects, financial conditions, and operating results."

stage1Category: Strategy Integration


text: Cybersecurity Governance Our cybersecurity program and supporting ISMS are governed by our Cybersecurity Steering Committee, which is includes our Chief Information Officer ("CIO") and is comprised of other members of our management team, including individuals from our finance, supply chain, product, information technology ("IT"), and legal departments. The Cybersecurity Steering Committee convenes quarterly to review the ISMS, identify new material risks and potential treatment plans that are recorded in our cybersecurity risk register, and review the overall health of security key risk indicators, technical key performance indicators, and roadmaps for the expected delivery of new and updated controls.

stage1Method: majority


text: Cybersecurity oversight and related risk-management activities are currently led by the CIO, who has more than 20 years of experience in information technology, cybersecurity governance, and enterprise-risk management. The CIO has implemented defense-in-depth cybersecurity frameworks and controls aligned with industry standards such as COBIT and ITIL and has regularly reported on cybersecurity risks and mitigation activities to boards of directors and audit committees throughout his career. Management is informed about cybersecurity risks through ongoing monitoring and reporting processes, including real-time incident dashboards, periodic risk assessments, and collaboration with internal and external cybersecurity experts. The CIO provides updates on cybersecurity risks, incident response readiness, and mitigation efforts to executive leadership and Fluence's board of directors through the Audit Committee as part of the Company's enterprise-risk-management program.

stage1Category: Management Role


text: While Fluence's board of directors oversees all enterprise risks, the Audit Committee of our board of directors has primary responsibility for overseeing cybersecurity risks and management's implementation of our cybersecurity risk management program. The Audit Committee receives quarterly updates from CIO. These updates typically cover topics such as: overview of material cybersecurity incidents that have occurred since the last update, overview of residual cybersecurity risks to our critical business assets, recent investments in our cybersecurity program, and relevant cybersecurity operational metrics. The Audit Committee will report updates regarding cybersecurity to the Board, as it deems appropriate.


text: The operation, integrity and security of our systems and the security of our data and the data of our members, guests and employees is critical to us. We have therefore developed and maintain a cybersecurity program designed to safeguard our systems from unauthorized access and to protect the confidentiality, integrity and availability of our data and the data of our members, guests and employees from external and internal threats.

companyName: Life Time Group Holdings, Inc.

ticker: LTH


text: Risk Management and Strategy We take a risk-based approach with our cybersecurity program that has been designed in accordance with the National Institute of Standards and Technology ("NIST") cybersecurity framework. Our program focuses on a variety of potential material risks including operational (including unauthorized access), financial, reputational and compliance-related. We analyze these risks based on numerous factors and also weigh their likelihood and potential impact. This analysis is led by our Chief Digital Officer and Chief Information Security Officer as detailed below under "—Governance." Additionally, we have identified cybersecurity as a credible technology-related risk under our enterprise risk management ("ERM") program. Our Chief Digital Officer is the owner of our technology risks and is therefore charged with executing controls to monitor and mitigate cybersecurity risks through people, processes and technology. Our ERM Committee is comprised of Company leaders and meets at least quarterly to consider, among other matters, the effectiveness of the risk monitoring and mitigating and the expected frequency, severity and trend of our credible risks including cybersecurity.


text: We seek to continuously improve our program within the NIST framework based on our risk assessment as well as our business needs and industry trends. We also apply administrative, operational and technical security controls to handle and process our data and the data of our members, guests and employees in a responsible and secure manner, including through various internal policies and standards governing information security. We leverage the expertise and advice of third parties to conduct audits, assessments, tabletop exercises, penetration testing and other reviews to assist us in identifying and implementing improvements to our cybersecurity program and aligning it with the NIST framework and our overall ERM program.


text: Our Board of Directors has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.

companyName: Blue Owl Technology Income Corp.


text: Our cybersecurity program includes ongoing vulnerability and risk management processes along with a managed security service provider that utilizes a detection and response solution to provide us with 24/7/365 monitoring and alerting. We have developed an incident response plan that is designed in accordance with the NIST framework to facilitate (1) identification and containment of any cybersecurity incidents; (2) remediation of identified vulnerabilities; (3) mitigation of disruption to critical information systems; and (4) assessment of what occurred, notification of affected individuals as necessary and mitigation of consequences that may arise from any unauthorized access. This plan also identifies and describes the roles and responsibilities of our incident response team, including investigation and escalation as appropriate up to and including our Audit Committee or Board of Directors.


text: Our cybersecurity program also addresses risks associated with third-party service providers who may access or integrate with our systems and data. Our processes include having such third parties complete a cybersecurity questionnaire, agree to appropriate contractual obligations and provide annual evidence of their compliance where applicable.

stage1Category: Third-Party Risk


text: While we experience cybersecurity threats during the normal course of business, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us and we do not believe are reasonably likely to materially affect us, including with respect to our business strategy, results of operations and financial condition.


text: Our Board of Directors oversees risk management of our business and accomplishes this oversight primarily through the Audit Committee. Our Audit Committee discusses the Company's policies with respect to risk assessment and risk management, including guidelines and policies to govern the process by which the Company's exposure to risk is handled. As part of this process, our Audit Committee oversees our ERM program including risks related to privacy, data and information security, including cybersecurity. Management presents to the Audit Committee at least annually on our cybersecurity program and risks related thereto, and then the Audit Committee reports on that presentation to our Board of Directors. The presentations may address (1) the current cybersecurity landscape and emerging threats; (2) the status of ongoing cybersecurity initiatives and strategies; (3) incident reports and learnings from any cybersecurity incidents; and/or (4) compliance with regulatory requirements and industry standards. In addition, our executive team may report specific cybersecurity incidents to the Audit Committee or Board of Directors outside of a regularly scheduled meeting based on the impact of the incident. Our internal escalation process is set forth in our incident response plan.


text: Our Executive Vice President and Chief Digital Officer is our executive team member responsible for our cybersecurity program and our Chief Information Security Officer ("CISO") leads the program. Together they provide updates to the ERM Committee and present to our Audit Committee at least annually. In addition, we have established an incident response team comprised of a cross-functional group of team members who manage our response to any cybersecurity incident pursuant to our incident response plan.


text: Our CISO has an undergraduate degree in Management Information Systems, decades of cybersecurity and technology experience and broad industry-wide experience, including in hospitality, retail, medical, energy and government. Members of our cybersecurity team have over 100 years of combined cybersecurity experience and hold professional certifications from security organization such as ISC2 and SANS Institute that include Certified Information Systems Security Professional (CISSP), GIAC Web Application Penetration Tester (GWAPT), GIAC Penetration Tester (GPEN), GIAC Certified Intrusion Analyst (GCIA) and GIAC Certified Forensic Analyst (GCFA). Our cybersecurity team also stays informed on the latest developments in cybersecurity, including trends, risks, threat vectors and attack mechanisms, through security and compliance-related seminars, conferences, continuing education training, news feeds and forums and our CISO sits on various CISO committees and roundtables. Our CISO's knowledge and experience, coupled with the expertise and advice we receive from third parties, are instrumental in assessing and managing our cybersecurity program, including our strategy, security engineering, security operations, cybersecurity awareness and training, information technology governance and compliance, and cyber threat identification, assessment, management, mitigation and response.


text: Impact of Cybersecurity Risks In 2023, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Internal and external cybersecurity threats and risks, as well as other disasters, may adversely affect our business or the business or our portfolio companies by impairing the ability to conduct business effectively." and "Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business."


text: Risk Management and Strategy We take a risk-based approach with our cybersecurity program that has been designed in accordance with the National Institute of Standards and Technology ("NIST") cybersecurity framework. Our program focuses on a variety of potential material risks including operational (including unauthorized access), financial, reputational and compliance-related. We analyze these risks based on numerous factors and also weigh their likelihood and potential impact. This analysis is led by our Chief Digital Officer and Chief Information Security Officer as detailed below under "—Governance." Additionally, we have identified cybersecurity as a credible technology-related risk under our enterprise risk management ("ERM") program. Our Chief Digital Officer is the owner of our technology risks and is therefore charged with executing controls to monitor and mitigate cybersecurity risks through people, processes and technology. Our ERM Committee is comprised of Company leaders who meet to consider, among other matters, the effectiveness of the risk monitoring and mitigating and the expected frequency, severity and trend of our credible risks including cybersecurity.


text: Cybersecurity Processes and Risk Assessment We rely on the cybersecurity program implemented by Blue Owl, the indirect affiliate of our Adviser. Blue Owl has implemented a cybersecurity program, which is focused on (i) protecting confidential business, client, investor and employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.


text: In 2023, we did not identify any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: Perimeter Solutions, Inc.

ticker: PRM


text: Cybersecurity Processes and Risk Assessment We rely on the cybersecurity program implemented by Blue Owl, the indirect affiliate of our Adviser. Blue Owl has implemented a cybersecurity program, which is focused on (i) protecting the confidentiality of business, client, investors in its funds and its employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").


text: Blue Owl's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed by Blue Owl IT Management for remediation. When Blue Owl engages vendors and other third party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.


text: Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate.


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess and manage cybersecurity events. The framework is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by an internal team that is responsible for enterprise-wide cybersecurity strategy, policies, engineering and processes. The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing Blue Owl's proactive and reactive measures, including monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. Blue Owl's cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks. Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").


text: Blue Owl's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed and addressed by Blue Owl IT Management. When Blue Owl engages vendors and other third party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.


text: Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate. Blue Owl has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess, manage and report cybersecurity events, which is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The incident response framework determines when the C-ROC should provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including senior members of Blue Owl's management, Blue Owl's Audit Committee or Blue Owl's Board of Directors. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by IT Management as part of its responsibility for enterprise-wide cybersecurity strategy, policies, implementing Blue Owl's monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes and various other technological and administrative safeguards. The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.


text: The Audit Committee is primarily responsible for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: Impact of Cybersecurity Risks In 2024, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "ITEM 1A. Risk Factors - Internal and external cybersecurity threats and risks, as well as other disasters, may adversely affect our business or the business or our portfolio companies by impairing the ability to conduct business effectively." and "Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business."


text: As part of its overall enterprise risk management framework, the Company maintains both an Information Security Committee ("ISC") and an Incident Response Plan ("IRP"). The Company's ISC is managed by its Chief Information Officer (the "CIO") whose team (the Incident Response Team, or "IRT") is responsible for leading company-wide cybersecurity strategy, policy, standards, architecture, and processes. The purpose of the IRP is to define procedures for reporting and responding to cybersecurity incidents. It creates objectives for actionable procedures that can be measured, evaluated, scaled and revised as necessary for each specific cybersecurity incident. These objectives are designed to maximize the effectiveness of the Company's response through an established plan of action and assigning responsibilities to appropriate personnel and/or third-party contractors.

companyName: Solo Brands, Inc.

ticker: SBDS


text: If a cybersecurity threat or incident is identified, the IRT will communicate the cybersecurity threat or incident and any damages to the CIO and other members of senior management of the Company. The Company will assess the materiality of the cybersecurity threat or incident to determine if any public disclosures are required under the SEC's cybersecurity disclosure rule. If deemed necessary, third-party consultants, legal counsel, and assessors will be engaged to evaluate the materiality assessment.


text: The cybersecurity program of the Company interfaces with other functional areas within the Company, including but not limited to the Company's brands and information technology, accounting, finance, legal and human resources, as well as external third-party partners, where appropriate, to assess, identify and manage potential cybersecurity threats. The Company regularly assesses and updates its processes, procedures and management techniques in light of ongoing cybersecurity developments.


text: Recognizing the complexity and evolving nature of cybersecurity threats, the Company also engages with a range of external experts, including cybersecurity assessors and consultants in evaluating and testing its cybersecurity management systems and IRP. These partnerships enable the Company to leverage specialized knowledge and insights, to assist in updating its cybersecurity strategies and processes to align with industry best practices. The Company's collaboration with these third parties includes consultation and review of security enhancements.


text: To date, we have not identified risks from cybersecurity threats or incidents, including as a result of any previous cybersecurity incidents, that have materially affected the Company or are reasonably likely to materially affect our operations, business strategy, results of operations, of financial condition. However, the sophistication of and risks from cybersecurity threats and incidents continues to increase, and there can be no assurance that our cybersecurity risk management program and processes, including our IRP, and other preventative actions the Company has taken and continues to take to reduce the risk of cybersecurity threats and incidents and protect its systems and information, will be fully implemented, complied with or successful in protecting against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect the Company's business strategy, results of operations, or financial condition, please refer to "Item 1A Risk Factors—Risks Related to our Business and Industry—We rely significantly on the use of information technology, as well as those of our third-party service providers. Any significant failure, inadequacy, interruption or data security incident of our information technology systems, or those of our third-party service providers, could disrupt our business operations, which could have a material adverse effect on our business, prospects, results of operations, financial condition and/or cash flows."


text: Our Board considers cybersecurity risk as part of its risk oversight function. The Board oversees management's implementation of our cybersecurity risk management program. The Board receives regular reports from the ISC on our cybersecurity risks. In addition, ISC updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Board also receives briefings from ISC on our cyber risk management program. Board members receive presentations on cybersecurity topics from our CIO, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: The ISC, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our ISC's expertise includes a combined 20 plus years of experience in managing security technologies; designing and implementing security strategies; and risk management and incident response across various industries. Our ISC supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy The Company recognizes the importance of being able to assess, effectively respond to and manage material cybersecurity threats and incidents that may compromise the confidentiality, integrity or availability of its information systems, data or network resources.


text: Risk Management Philosophy and Strategy As part of our overall risk management strategy, we have increased our attention to cybersecurity. Responsibility for cybersecurity risk management is a team effort, with day-to-day oversight and management from our executive and information technology ("IT") teams, the Audit Committee taking a more active role in setting both proactive and reactive strategies and our Board overseeing our efforts and helping to guide our strategy.

companyName: Portillo's Inc.

ticker: PTLO


text: As part of its overall risk management framework, the Company maintains an Information Security Oversight Committee ("ISOC") which is responsible for overseeing company-wide cybersecurity strategy, architecture and policies. The Company's ISOC is chaired by its Chief Information Security Officer (the "CISO"), who reports to our Chief Information Officer, who is also a member of ISOC. The Company has also established an Incident Response Team ("IRT"), which is a subset of the ISOC, and maintains an Incident Response Plan ("IRP"), the purpose of which is to respond to cybersecurity incidents. The IRT assesses the risks and impacts of cybersecurity incidents and creates and manages action plans for each specific cybersecurity incident. The IRP is designed to maximize the effectiveness of the Company's response through an established plan of action and assigning responsibilities to appropriate personnel and/or third-party contractors.


text: The IRP contemplates that if a cybersecurity threat or incident is identified, the IRT would communicate the cybersecurity threat or incident and any damages to the CISO and other members of senior management of the Company. The Company then would assess the materiality of the cybersecurity threat or incident to determine if any public disclosures are required under the SEC's cybersecurity disclosure rule. If deemed necessary, third-party consultants, legal counsel and assessors would be engaged to evaluate the materiality assessment.


text: The cybersecurity program of the Company interfaces with other functional areas within the Company, including but not limited to the Company's brands and information technology, accounting, finance, legal and human resources, as well as external third-party partners, where appropriate, to assess, identify and manage potential cybersecurity threats. The Company aims to regularly assess and update its processes, procedures and management techniques in light of ongoing cybersecurity developments.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal IRT personnel; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in our internal IT environment Recognizing the complexity and evolving nature of cybersecurity threats, the Company also engages with a range of external experts, including cybersecurity assessors and consultants in evaluating and testing its cybersecurity management systems and IRP, including its use of third-party service providers. These partnerships enable the Company to leverage specialized knowledge and insights and to assist in updating its cybersecurity strategies and processes to align with industry best practices. The Company's collaboration with these third parties includes consultation and review of security enhancements.


text: To date, we have not identified risks from cybersecurity threats or incidents, including as a result of any previous cybersecurity incidents, that have materially affected the Company or are reasonably likely to materially affect our operations, business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information on how cybersecurity risk could materially affect the Company's business strategy, results of operations, or financial condition, please refer to "Item 1A Risk Factors—Risks Related to our Business and Industry—We rely significantly on the use of information technology, as well as those of our third-party service providers. Any significant failure, inadequacy, interruption or data security incident of our information technology systems, or those of our third-party service providers, could disrupt our business operations, which could have a material adverse effect on our business, prospects, results of operations, financial condition and/or cash flows."


text: Our Board considers cybersecurity risk as part of its risk oversight function. The Board oversees management's implementation of our cybersecurity risk management program. The Board receives periodic reports from the CISO on our cybersecurity risks. In addition, the CISO and ISOC members update the Board, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant. The Board also receives briefings from the CISO and ISOC members on our cyber risk management program. Board members receive presentations on cybersecurity topics from our CISO, internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.


text: The ISOC, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our ISOC's expertise includes a combined 20 plus years of experience in managing security technologies; designing and implementing security strategies; and risk management and incident response across various industries. Our ISOC takes steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment Mike Murray has served as our Chief Information Officer since April 2024. Mr. Murray brings with him a wealth of experience in technology leadership, including in the area of cybersecurity. Before joining the Company, Mr. Murray championed technology initiatives at The Container Store, overseeing critical areas such as IT governance, infrastructure, PMO, operations and support. Prior to The Container Store, he worked at Pier 1 Imports, Inc., which saw him in diverse senior leadership positions, notably as VP of Technology with a strategic focus on IT, Ecommerce, and Business Development.


text: Our primary source of cybersecurity risk relates to security of our third-party service providers, whose activities and scale may present more desirable targets. However, we do maintain certain systems ourselves and appreciate the need to focus internally as well. We manage cybersecurity risk through a variety of tactics, including (i) the structure of our systems and platforms, (ii) the contractual terms with our third-party vendors, (iii) the proactive vulnerability assessments we conduct (or require our vendors to conduct), (iv) compliance with applicable regulations and continuous improvement around best practices, (v) mitigating user error and human vulnerabilities through training and guidance and (vi) the placement of cybersecurity insurance policies.


text: We employ a "Defense in Depth" strategy to protect the Company, segmenting our systems and networks so that an attack on one segment does not allow for easier compromise of other systems and networks. Within the Company, administrative access to various systems is limited so that there is no universal access if an administrator-level account is compromised.


text: We involve our IT team when negotiating contracts that could increase our cybersecurity risk exposure, so that the team is aware of the specific risks related to a given vendor and can provide feedback and advice on the contractual provisions necessary to prevent a cybersecurity incident, or in the event an incident does occur, to ensure that the Company has the necessary rights to act quickly to protect team members, guests, and our business and mitigate potential damage. We are continuously improving our processes and contract positions to reflect evolving risks and market practices.


text: We appreciate the need to monitor and test our systems to make sure that they are working the way that they should. We negotiate with our vendors about a variety of monitoring, testing, and reporting provisions so that we can work with them to better address vulnerabilities. This may include sharing SOC 1 or 2 Type 2 audit reports, conducting periodic penetration and vulnerability testing and confirmation that vendors are adhering to applicable laws. We also deploy the same approach internally, and we are currently expanding our testing efforts across our servers and networks, continually monitoring access (including more formal quarterly access reviews for any systems that are subject to SOX oversight), and documenting changes via a ticketing system. In addition to tracking logins, our monitoring system is equipped to respond automatically to certain triggers, taking a range of actions, from notifying administrators to locking out an account. Some of this testing and monitoring is conducted in-house and some is conducted by third-party vendors.


text: As a restaurant and public company, we are subject to Payment Card Industry Data Security Standards ("PCI-DSS") and SOX requirements and we take steps to make sure that we are compliant with those regulations. We also continue to monitor evolving laws and regulations related to security and privacy and look for opportunities to improve our systems based on evolving best practices in the IT industry.


text: We know that people are often the most vulnerable element in an IT ecosystem. We work with team members at all levels to educate them about evolving risks, from well-known tactics and scams (e.g., phishing) to their more sophisticated descendants (e.g., vphishing, spear phishing and smishing). Team members receive training on data security and privacy practices and are included in periodic awareness campaigns to test real-world responses. We are on the lookout for additional training opportunities and have recently begun scheduling "tabletop" exercises to test our PCI-related responses and creating new business interruption plans. The Company also employs and enforces a number of policies to guide team member behavior and help protect against threats, covering everything from regular password updates to obtaining permission to install third-party programs and use personal devices. Team member training reinforces the Company's risk management policies and procedures and the expectation that all team members will adhere to them.


text: The Company also maintains a cybersecurity insurance policy that we believe is appropriate for a company of our size and risk profile, but it is possible that it may not fully cover the costs associated with a cybersecurity incident.


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected our business strategy, results of operations or financial condition. However, there is no guarantee that a future cybersecurity incident would not materially affect our future strategy, results or financial condition. For a more in-depth discussion of risks associated with cybersecurity and cybersecurity insurance risks, see Item 1A, "Risk Factors."


text: Oversight and Execution of Our Cybersecurity Risk Strategy Both the Board and the Audit Committee play an important role in the Board's oversight of cybersecurity threats. The Audit Committee receives periodic updates on the Company's risk profile and mitigation strategies and conducts forward-looking discussions about major IT changes that are planned, the risks involved and the Company's potential mitigation strategies. The Audit Committee shares updates with the broader Board. We presently have three Directors, Ann Bordelon, Chair of the Audit Committee, Paulette Dodson, and Noah Glass who have cybersecurity risk management experience and we continue to monitor whether supplemental experience may be useful as cybersecurity threats continue to evolve.


text: Day to day management of cybersecurity risk sits with our Vice President of Information Technology ("ITVP") and his team. As noted above, the team conducts risk assessment activities on a regular basis. The team also liaises with cross-functional partners and outside experts, including legal counsel and consultants, and reviews applicable security frameworks (e.g., National Institute of Standards and Technology ("NIST")) to identify the legal requirements and industry practices and expectations that the Company's security measures should satisfy. The Company regularly updates its practices to incorporate new best practices and strengthen compliance with SOX, PCI-DSS and the Health Insurance Portability and Accountability Act requirements. These activities are used to develop and update the Company's cybersecurity risk profile.


text: The team then identifies the potential mitigation measures to address these risks, and may bring in consultants as appropriate based on their expertise and knowledge of the Company to develop strategies that are tailored to the Company's needs and profile. These measures include business continuity plans (which are developed in connection with our risk management team and the users of a given platform), improving system redundancy to limit disruptions and eliminating single points of failure where possible. In addition to our ITVP, the cybersecurity portion of our IT team includes one dedicated team member and four additional team members who handle cybersecurity risks in addition to other job responsibilities. To address any gaps in the Company's collective expertise and to account for the ever-evolving nature of cybersecurity risks, the Company retains various consultants as noted above. The internal and external headcount, and the expertise of the employees and consultants, will change from time to time as we adapt to the changing cybersecurity environment.


text: Our ITVP has over twelve years of experience in IT at Portillo's, including managing cybersecurity risks. He reports to our Chief Financial Officer and updates her on a weekly basis. Our Chief Financial Officer discusses IT matters, including security, during weekly executive leadership meetings and may call upon the ITVP periodically to report directly to the team. Following these meetings, the ITVP works with his team to address any feedback received. Cybersecurity and privacy objectives are built into the ITVP's annual objectives and those of his team and his short-term incentive compensation reflects how successful he, the team and the Company are at accomplishing those objectives.


text: Detecting and Responding to a Cybersecurity Incident As noted previously, both we and our vendors (to the extent contractually required) monitor systems for potential incidents. We are working with our vendors to determine the applicable warning flags and thresholds and appropriate notification processes based on the services provided and type of data processed.


text: In the event of a cybersecurity incident, whether the attack is on the Company or on a third-party service provider, the IT team conducts an initial assessment to estimate the scope and potential impact of the attack. The team also identifies critical information yet to be determined. A cross-functional team meets about the results of the initial assessment, including the nature and scope of the attack, which Company functions are affected, the response from the service provider (if a third-party incident), both financial and non-financial measures of materiality, the expected duration of the incident, any open or unknown information, and the status of the Company's response.


text: Following the initial briefing, depending on the seriousness of the incident, a cadence for updates and escalation is established and the cross-functional team continues to investigate, mitigate and resolve the incident, retaining outside counsel, forensic investigators and other consultants as needed. Priority is given to critical business functions/tasks/processes. Progress and developments are reported to more senior leadership based on the severity of the incident, up to and including the Board.


text: Risk Management Strategy Responsibility for cybersecurity risk management comes from a collective effort, with day-to-day oversight and management from our executive and information technology ("IT") teams. Additionally, the Audit Committee continues to take a more active role in setting both proactive and reactive strategies, with the overall Board overseeing our efforts and helping to guide our strategy.


text: From a framework standpoint, we primarily utilize the National Institute of Standards and Technology ("NIST") framework to assess and mitigate cybersecurity risks. This framework guides our efforts to identify, analyze and contain any security threats, and advises as to potential actions to consider if a need arose to recover from a security incident.


text: Our primary source of cybersecurity risk relates to security of our third-party service providers, whose activities and scale may present more desirable targets. However, we do maintain certain systems ourselves and appreciate the need to focus internally as well. We manage cybersecurity risk through a variety of tactics, including (i) the structure of our systems and platforms, (ii) the contractual terms with our third-party vendors, (iii) the proactive vulnerability assessments we conduct (or require our vendors to conduct), (iv) compliance with applicable regulations and continuous improvement around best practices, (v) mitigating user error and human vulnerabilities through training and guidance, (vi) attending security conferences and operationalizing new learnings and/or planning for environment changes in response to these learnings, and (vii) the placement of cybersecurity insurance policies. We also work with cross-functional partners and outside experts, including legal counsel and consultants to identify the legal requirements and industry practices and expectations that the Company's security measures should satisfy.


text: We appreciate the need to monitor and test our systems to make sure that they are working the way that they should. We negotiate with our vendors about a variety of monitoring, testing, and reporting provisions so that we can work with them to better address vulnerabilities. This may include sharing SOC 1 or 2 Type 2 audit reports, conducting periodic penetration and vulnerability testing, both internally and externally, and confirmation that vendors are adhering to applicable laws. Some of this testing and monitoring is conducted in-house and some is conducted by third-party vendors.


text: We routinely conduct penetration testing across our various environments and networks, including our Restaurant Support Center, our restaurants and our cloud-based architecture and systems. We review penetration testing outcomes and take steps to address any meaningful findings, while documenting resolution steps these efforts.


text: We work with team members at all levels to educate them about evolving risks, from well-known tactics and scams (e.g., phishing) to their more sophisticated descendants (e.g., spear phishing and smishing). Team members receive training on data security and privacy practices and are included in periodic awareness campaigns to test real-world responses. We continue to add further training opportunities as they become available and have incorporated "tabletop" exercises for our Board, our management team, and our team members into our risk mitigation efforts to help us refine our business interruption and response plans. The Company also employs and enforces policies to guide team member behavior and help protect against threats, which includes steps such as regular password updates, and obtaining permission to install third-party programs. Team member training reinforces the Company's risk management policies and procedures and the expectation that all team members will adhere to them.


text: Cybersecurity Governance Both the Board and the Audit Committee play an important role in the Board's oversight of cybersecurity threats. The Audit Committee receives periodic updates on the Company's risk profile and mitigation strategies and conducts forward-looking discussions about major IT changes that are planned, the risks involved and the Company's potential mitigation strategies. The Audit Committee shares updates with the broader Board. We presently have three Directors, Ann Bordelon, Chair of the Audit Committee, Paulette Dodson, and Noah Glass, who have cybersecurity risk management experience and we continue to monitor whether supplemental experience may be useful as cybersecurity threats continue to evolve.


text: The IT Team manages day-to-day cybersecurity risks under the oversight of our Chief Information Officer ("CIO"), who is actively engaged in strategic planning, security assessments, and mitigation efforts. Our CIO has 10+ years of experience overseeing security practices at various multi-national restaurant concepts. Our CIO and Chief Financial Officer discuss IT matters on a routine basis, and as noted above, periodic reviews are conducted with the executive management team and the Audit Committee.


text: We have an incident response process that is activated in the event of a direct or third-party attack. The plan is designed to help us detect, respond to and recover from cybersecurity incidents. Criteria are in place to determine the scope and severity of an incident, in relation to: incident reporting to the Audit Committee and/or the Board; disclosure or other external reporting; compliance with applicable legal obligations and mitigation of the impact to our brand, its reputation and any impacted parties.


text: To address any gaps in the Company's collective expertise and to account for the ever-evolving nature of cybersecurity risks, the Company retains various consultants as noted above. The internal and external headcount, and the expertise of the employees and consultants, will change from time to time as we adapt to the changing cybersecurity environment.


text: Internal Cybersecurity Team and Governance The Board maintains responsibility for oversight of risks that may affect the Company. Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee reviews the Company's policies with respect to risk assessment and enterprise risk management, including with respect to cybersecurity risks. Certain members of our Audit Committee have experience with respect to cybersecurity risk management.

companyName: ESAB Corp

ticker: ESAB


text: We rely on the cybersecurity strategy and policies implemented by Oaktree. Oaktree maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated into Oaktree's overall risk management processes and focuses on the corporate information technology environment. The audit committee of the board of directors of Brookfield Oaktree Holdings, LLC oversees Oaktree's cybersecurity program. The cybersecurity team briefs the audit committee of Brookfield Oaktree Holdings, LLC on the effectiveness of Oaktree's cyber risk management program. The Internal Audit team also shares the results of its annual cybersecurity audits with the audit committee of Brookfield Oaktree Holdings, LLC.

companyName: Oaktree Strategic Credit Fund


text: The underlying controls of the cyber risk management program are designed to meet Oaktree's business requirements, security risks and organization profile, and leverages many elements of the National Institute of Standards and Technology Cybersecurity Framework and the International Organization Standardization 27001 Information Security Management System Requirements. The Internal Audit team conducts an annual internal audit of the Company's cyber risk management program utilizing the services of a third-party provider. Additionally, Oaktree hires a third party provider to conduct an annual penetration test of Oaktree's systems. Oaktree has developed and implemented controls and processes to oversee and manage its engagements with third-party vendors. These procedures encompass pre-engagement due diligence efforts and the ongoing monitoring of the third-party vendors that are considered to be high-risk. Although these controls and processes are designed to mitigate risks associated with third-party engagements, they do not guarantee the elimination of all potential risks. The effectiveness of these controls and processes is dependent on a variety of factors, some of which are outside Oaktree's and our control.


text: A third party Managed Security Service Provider manages Oaktree's Security Operations Center to provide 24/7 monitoring of its global systems and to coordinate the investigation of alerts of potential security incidents. Alerts are then escalated to the Oaktree Cybersecurity team for investigation and remediation, if necessary. Cyber partners are a key part of Oaktree's cybersecurity infrastructure. Oaktree partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. Oaktree engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in Oaktree's environment. A Managing Director in Oaktree's information technology department heads Oaktree's cybersecurity team. This individual reports to Oaktree's Chief Information Officer and is responsible for assessing and managing Oaktree's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of collective experience selecting, deploying and operating cybersecurity technologies, initiatives and processes and relies on threat intelligence as well as other information obtained from governmental, public and private sources, including external consultants engaged by Oaktree.


text: The head of Oaktree's cybersecurity team has substantial information technology and cybersecurity experience, with a career spanning over 30 years in managing global IT operations in a wide range of areas, including cybersecurity, IT governance, controls, compliance, data center operations, network engineering and cloud computing.


text: Our board of directors oversees our cybersecurity program and receives quarterly updates from the cybersecurity team on matters including Oaktree's cyber risk management program (and risks to us related to cybersecurity) and updates to the cybersecurity program, including active and recently completed initiatives.


text: We and Oaktree face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition or results of operations. We and Oaktree have experienced, and will continue to experience, cyber incidents in the normal course of its business. However, we are not currently aware of any current or past cyberattacks or other incidents that, individually or in the aggregate, have materially affected, or are reasonably likely to materially affect, our business, financial condition or results of operations. See "Risk Factors - Risks Relating to Our Business and Structure - We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information."


text: We rely on the cybersecurity strategy and policies implemented by Oaktree. Oaktree maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated into Oaktree's overall risk management processes and focuses on the corporate information technology environment. The audit committee of the board of directors of BOH oversees Oaktree's cybersecurity program. The cybersecurity team briefs the audit committee of BOH on the effectiveness of Oaktree's cyber risk management program. The Internal Audit team also shares the results of its annual cybersecurity audits with the audit committee of BOH.


text: The Company has developed policies and procedures with regard to cyber incident responses which policies and procedures are based on key components of the National Institute of Standards and Technology Cybersecurity Framework, together with other best practices. Since completion of the Separation and Distribution, the Company has not had any risks of cybersecurity threats or cybersecurity incidents that have materially affected or, to the Company's knowledge, are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, if such a material cybersecurity incident is identified or were to occur, Company management would report it to the board of directors immediately.

companyName: Orion Properties Inc.

ticker: ONL


text: The head of Oaktree's cybersecurity team has substantial information technology and cybersecurity experience, with a career spanning over 25 years in managing global IT operations in a wide range of areas, including cybersecurity, IT governance, controls, compliance, data center operations, network engineering and cloud computing.


text: Cybersecurity Risk Management and Strategy We rely on industry-standard software applications, IT systems, computing infrastructure, and cloud service providers (collectively referred to as "Information Systems") to perform essential operations. Many of these systems are managed, hosted, provided, or utilized by third parties, including BD, to support our business activities.

companyName: Embecta Corp.

ticker: EMBC


text: We have implemented administrative, physical, and technical safeguards and processes to assess, identify, and manage material risks from known cybersecurity threats to our Information Systems and operations. However, our Information Systems could be disrupted, degraded, destroyed, or manipulated intentionally or accidentally by our employees, third parties with authorized access, or cyber threat actors, which could negatively and adversely impact key business processes. The size and complexity of our Information Systems, as well as those of our third-party providers, make them potentially vulnerable to such service interruptions. Additionally, we and our third-party providers have experienced and expect to continue experiencing phishing attempts, network scanning attempts, and other unauthorized access attempts to our computers, Information Systems, networks, and devices. These increasingly sophisticated attacks are carried out by groups and individuals with various motives and expertise, including state and quasi-state actors, criminal groups, hackers, and others. Such attacks could result in the loss of confidentiality, integrity, and/or availability of our data and Information Systems.


text: The Company has a formal process in place for identifying, handling and disclosing of material cybersecurity incidents. The Company's Security Oversight Committee ("SOC") includes our Chief Financial Officer, General Counsel, Vice President of Information Security, and representatives from our Internal Audit, Legal, Compliance and Information Systems departments. The purpose of the SOC is to develop and review the Information Security policies, standards and guidelines for the Company that manage Cyber Risk. Furthermore, the Company's Code of Ethics and Conduct explicitly prohibits officers, directors, team members, or other insiders who are subject to the Code from transacting in the Company's stock during a time when such individuals have knowledge of any material undisclosed cybersecurity incident or breach.

companyName: PROASSURANCE CORP

ticker: PRA


text: Security risks to both the Company and its customers data and information are continuously evaluated and monitored. We actively monitor security 24 hours a day and seven days a week through our global Security Operations Center. We have implemented a multi-layered defense-in-depth approach using technologies that meet or exceed industry standards. Additionally, we expect our vendors to adhere to our data privacy and security standards and we evaluate their ability to comply as part of our vendor assessment process. This includes assessing internal and external threats to the security, confidentiality, integrity, and availability of Embecta and third party provider data and systems, as well as other risks to our operations. Embecta utilizes the ISO 27001 framework, which incorporates the National Institute of Standards and Technology and Center for Internet Security frameworks, and various risk management frameworks to proactively evaluate its cybersecurity controls, risks, and overall program effectiveness. As part of our risk management process, we engage external providers to conduct periodic internal and external penetration testing and security assessments. Additionally, under our third-party risk management program, we assess vendor cybersecurity risks, including those associated with our cloud vendors and other third-parties. We maintain security and privacy policies and procedures that align with industry-standard control frameworks and comply with applicable regulatory requirements, laws, and standards. Enterprise cybersecurity policies undergo an annual review and approval by our Information Security Risk Committee ("ISRC").


text: Embecta has established a Cyber Security Incident Response Team, a cross-functional team composed of representatives from our Information Technology, Information Security, Product Security, Privacy, Legal, and Human Resources groups. This team is responsible for the response to security threats by implementing our detailed incident response plan. Our incident response plan includes processes, procedures, and playbooks for assessing potential internal and external threats, developing remediation plans, and facilitating post-incident recovery; all designed to safeguard the confidentiality, integrity and availability of both Company and customer data.


text: Cybersecurity risk management is integrated into our broader Enterprise Risk Management ("ERM") framework to promote a Company-wide culture of awareness and proactive risk management. Our ERM framework is overseen by the Audit Committee and Board of Directors. Our Chief Information Officer ("CIO") and Vice President of IT Infrastructure and Security ("VP IT") are responsible for updating the Audit Committee and Board of Directors on Embecta's cyber risk. The CIO and VP IT have oversight of cybersecurity strategy, policy, standards, architecture, and processes that protect Embecta's enterprise network, Information Systems and information assets, and product technologies. The ISRC oversees our cybersecurity governance and manages various controls, ensuring accountability at all levels of the organization, including senior management and the executive leadership team. The ISRC meets quarterly, oversees enterprise and cybersecurity risk management and reports to the ERM team and the Audit Committee. These committees receive updates on cybersecurity-related topics throughout the year including any major cybersecurity incidents. Additionally, the Board of Directors receives periodic updates on information security and cybersecurity matters from our CIO and VP IT.


text: Our information security organization is led by our VP IT, who has over fifteen years of relevant experience, serving in various IT leadership roles within the medical device and medical technology industry. The VP IT is responsible for all aspects of our cybersecurity program, including cybersecurity engineering and architecture, cybersecurity operations, monitoring, incident response, threat intelligence, identity and access management, cybersecurity risk and compliance, and vulnerability management. Our VP IT reports to our CIO, who has over twenty years of experience in information technology and process leadership, including leading teams with global cybersecurity responsibilities. Our CIO reports to the Chief Financial Officer.


text: Cybersecurity Risk Management and Strategy We rely on industry-standard software applications, IT systems, computing infrastructure, enterprise resource planning systems, and cloud service providers (collectively referred to as "Information Systems") to perform essential operations. Many of these systems are managed, hosted, provided, or utilized by third parties, to support our business activities.


text: We have implemented administrative, physical, and technical safeguards and processes to assess, identify, and manage material risks from known cybersecurity, information, or data security risks and threats to our Information Systems and operations. However, our Information Systems could be disrupted, degraded, destroyed, or manipulated intentionally or accidentally by our employees, third parties with authorized access, or cyber threat actors, which could negatively and adversely impact key business processes. The size and complexity of our Information Systems, as well as those of our third-party providers, make them potentially vulnerable to such service interruptions. Additionally, we and our third-party providers have experienced and expect to continue experiencing phishing attempts, network scanning attempts, and other unauthorized access attempts to our computers, Information Systems, networks, and devices. These increasingly sophisticated attacks are carried out by groups and individuals with various motives and expertise, including, but not limited to, state and quasi-state actors, criminal groups, hackers, and others. Such attacks could result in the loss of confidentiality, integrity, and/or availability of our data and Information Systems.


text: Effective July 26, 2023, the SEC finalized rules requiring registrants to disclose material cybersecurity incidents. Per the ruling, any cybersecurity incident deemed to be material shall be disclosed within four business days of materiality determination. The determination of materiality related to cybersecurity incidents is subjective, however, the Company has implemented materiality consideration in its formal process.


text: Security risks to both the Company and its customers' data and information are continuously evaluated and monitored. We actively monitor security 24 hours a day and seven days a week through our global Security Operations Center. We have implemented a multi-layered defense-in-depth approach using technologies that meet or exceed industry standards. Additionally, we expect our vendors to adhere to our data privacy and security standards and we evaluate their ability to comply as part of our vendor assessment process. This includes assessing internal and external threats to the security, confidentiality, integrity, and availability of Embecta and third party provider data and systems, as well as other risks to our operations. Embecta utilizes the ISO 27001 and 42001 frameworks, which incorporates the National Institute of Standards and Technology and Center for Internet Security frameworks, and various risk management frameworks to proactively evaluate its cybersecurity controls, risks, and overall program effectiveness against emerging risks including AI. As part of our risk management process, we engage external providers to conduct periodic internal and external penetration testing and security assessments. Additionally, under our third-party risk management program, we assess vendor cybersecurity risks, including those associated with our cloud vendors and other third-parties. We maintain security and privacy policies and procedures that align with industry-standard control frameworks and comply with applicable regulatory requirements, laws, and standards. Enterprise cybersecurity policies undergo an annual review and approval by our Information Security Risk Committee ("ISRC").


text: Embecta has established a Cyber Security Incident Response Team, a cross-functional team composed of representatives from our Information Technology, Information Security, Research and Development, Privacy, Legal, and Human Resources groups. This team is responsible for the response to security threats by implementing our detailed incident response plan. Our incident response plan includes processes, procedures, and playbooks for assessing potential internal and external threats, developing remediation plans, and facilitating post-incident recovery; all designed to safeguard the confidentiality, integrity and availability of both Company and customer data.


text: Cybersecurity risk management is integrated into our broader Enterprise Risk Management ("ERM") framework to promote a Company-wide culture of awareness and proactive risk management. Our ERM framework is overseen by the Audit Committee and Board of Directors. Our Chief Information Officer ("CIO") and Vice President, CISO & IT Infrastructure and Security ("VP IT") are responsible for updating the Audit Committee and Board of Directors on Embecta's cyber risk. The CIO and VP IT have oversight of cybersecurity strategy, policy, standards, architecture, and processes that protect Embecta's enterprise network, Information Systems and information assets, and product technologies. The ISRC oversees our cybersecurity governance and manages various controls, ensuring accountability at all levels of the organization, including senior management and the executive leadership team. The ISRC meets quarterly, oversees enterprise and cybersecurity risk management and reports to the ERM team and the Audit Committee. These committees receive updates on cybersecurity-related topics throughout the year including any major cybersecurity incidents. Additionally, the Board of Directors receives periodic updates on information security and cybersecurity matters from our CIO and VP IT.


text: Our information security organization is led by our VP IT, who has over fifteen years of relevant experience, serving in various IT leadership roles within the medical device and medical technology industry. The VP IT is responsible for all aspects of our cybersecurity program, including cybersecurity engineering and architecture, cybersecurity operations, monitoring, incident response, threat intelligence, identity and access management, cybersecurity risk and compliance, and vulnerability management. Our VP IT reports to our CIO, who brings over 30 years of diverse strategic and operational experience in IT management, process leadership, digital, and technology modernization. Our CIO reports to the Chief Financial Officer.


text: The Company's board of directors is responsible for the Company's cyber risk oversight. The Company has established a risk committee (the "Risk Committee") comprised of members of senior management whose responsibilities include identifying, assessing, and managing enterprise-level and material risks to the Company, including strategic, financial, credit, market, liquidity, security, property, information technology ("IT"), cyber, legal, regulatory, and reputational risks. As described in greater detail below, the Risk Committee also assesses and makes the final determination as to whether a cybersecurity incident is material.


text: The Risk Committee is comprised of members of the Company's senior management, who have managed and overseen cybersecurity risk at numerous public companies. The Company's head of IT has overseen cybersecurity strategy, cybersecurity risk management, engineering of security technology, managed security service providers, processes and governance at other publicly traded companies and holds industry-standard certifications with respect to cybersecurity risk management.


text: Company management, including members of the Risk Committee, provides regular updates to the board of directors regarding material matters with respect to the Company, including cyber matters. These updates include quarterly updates to the board with respect to material cyber events and an annual cybersecurity program overview covering cybersecurity strategy, assessment, risks, notable events and governance. The Company also conducts an annual enterprise risk assessment through which it identifies and assesses material risks to the Company, including both cyber and non-cyber risks. This assessment is reviewed and discussed with the board of directors.


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company. Please refer to Item 1A, Risk Factors under the heading "Technology, Data Security and Privacy" for additional information on our cybersecurity threats.


text: The Company's IT department is responsible for day-to-day management of potential cybersecurity risks. As part of its management of cybersecurity risks, the IT department conducts regular cybersecurity training of the Company's employees, which includes an annual training given to all employees and internal contractors, targeted trainings for employees and internal contractors with specific roles within the Company and simulated cyber threats, including phishing exercises that spoof common and novel tactics used by threat actors. The IT department, through the Company's head of IT, provides regular updates and reports to the Company's executive officers and the Risk Committee regarding cybersecurity threats, risks from such threats, strategies and recommendations to mitigate risk from such threats, cybersecurity incidents that have occurred, industry updates, and policy and process recommendations. The Company's executive officers and the Risk Committee provide guidance and approval of such items to ensure that such risks are mitigated and in line with the Company's overall risk management systems and processes.


text: If the Company's IT department identifies a cybersecurity incident, the IT department assesses such incident and its materiality. If the IT department makes a preliminary determination that a cybersecurity incident may be material, the IT department brings the incident to the attention of the Risk Committee. The Risk Committee then continues its assessment and makes the final determination whether the cybersecurity incident is material. The IT department, the Risk Committee, and any necessary third parties, including managed security service providers, forensic investigators, and internal and external auditors, collaborate in the response and management with respect to cyber incidents.


text: The Company utilizes an independent external firm that provides services to detect cybersecurity risks and makes recommendations to the Company regarding ways the Company can better protect itself from threats and improve internal processes based on cyber threats and risks that are impacting other companies. Additionally, as part of its processes for assessing, identifying and managing risks from cybersecurity threats, the Company intends to periodically conduct maturity and other external cybersecurity assessments to evaluate its cybersecurity maturity and enhance its cybersecurity capabilities. The Company's auditors also perform annual inquiries and risk assessments into cybersecurity practices and potential incidents.


text: The Company has processes to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers. Such processes include evaluating service providers to ensure coverage of key cybersecurity risks have appropriate mitigations. The Company also monitors for threats impacting key service providers and assesses identified threats for potential impacts to services, data, and systems.


text: Our Board of Directors is responsible for the Company's cyber risk oversight. We have established a risk committee (the "Risk Committee") comprised of members of senior management whose responsibilities include identifying, assessing, and managing enterprise-level and material risks to the Company, including strategic, financial, credit, market, liquidity, security, property, information technology ("IT"), cyber, legal, regulatory, and reputational risks. As described in greater detail below, the Risk Committee also assesses and makes the final determination as to whether a cybersecurity incident is material.


text: The Risk Committee is comprised of members of our senior management, who have managed and overseen cybersecurity risk at numerous public companies. Our Vice President and Head of IT leads our operational oversight of cybersecurity and IT strategy, policy, standards and processes. He has served in this role since our inception in November 2021 and has more than 16 years of experience overseeing cybersecurity strategy, cybersecurity and technology risk management, engineering of security technology, overseeing managed security service providers and IT governance at other publicly traded companies and holds industry-standard certifications with respect to cybersecurity risk management.


text: Company management, including members of the Risk Committee, provides regular updates to the Board of Directors regarding material matters with respect to the Company, including cyber matters. These updates include quarterly updates to the board with respect to material cyber events and a twice per annum cybersecurity program review covering topics such as cybersecurity strategy, assessment, risks, notable events and governance. We also conduct an annual enterprise risk assessment through which it identifies and assesses material risks to the Company, including both cyber and non-cyber risks. This assessment is reviewed and discussed with the Board of Directors.


text: We have developed policies and procedures with regard to cyber incident responses which policies and procedures are based on key components of the National Institute of Standards and Technology Cybersecurity Framework, together with other best practices. Since completion of the Separation and the Distribution, we have not had any risks of cybersecurity threats or cybersecurity incidents that have materially affected or, to our knowledge, are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, if such a material cybersecurity incident is identified or were to occur, Company management would report it to the Board of Directors immediately.


text: Cybersecurity Risk Management and Strategy We are regularly subject to cyberattacks and other cybersecurity incidents. In response, we evaluate and implement cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risks. Our management team collaborates with our Information Security function, led by our Chief Information Officer ("CIO") to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations.

companyName: Arhaus, Inc.

ticker: ARHS


text: Our IT department is responsible for day-to-day management of potential cybersecurity risks. As part of its management of cybersecurity risks, the IT department conducts regular cybersecurity training of our employees, which includes an annual training given to all employees and internal contractors, targeted trainings for employees and internal contractors with specific roles within the Company and simulated cyber threats, including phishing exercises that spoof common and novel tactics used by threat actors. The IT department, through our head of IT, provides regular updates and reports to our executive officers and the Risk Committee regarding cybersecurity threats, risks from such threats, strategies and recommendations to mitigate risk from such threats, cybersecurity incidents that have occurred, industry updates, and policy and process recommendations. Our executive officers and the Risk Committee provide guidance and approval of such items to ensure that such risks are mitigated and in line with our overall risk management systems and processes.


text: If our IT department identifies a cybersecurity incident, the IT department assesses such incident and its materiality. If the IT department makes a preliminary determination that a cybersecurity incident may be material, the IT department brings the incident to the attention of the Risk Committee. The Risk Committee then continues its assessment and makes the final determination whether the cybersecurity incident is material. The IT department, the Risk Committee, and any necessary third parties, including managed security service providers, forensic investigators, and internal auditors, collaborate in the response and management with respect to cyber incidents.


text: We utilize an independent external firm that provides services to detect cybersecurity risks and makes recommendations to us regarding ways the Company can better protect itself from threats and improve internal processes based on cyber threats and risks that are impacting other companies. Additionally, as part of its processes for assessing, identifying and managing risks from cybersecurity threats, we intend to periodically conduct maturity and other external cybersecurity assessments to evaluate its cybersecurity maturity and enhance its cybersecurity capabilities. Our internal auditors also perform annual inquiries and risk assessments into cybersecurity practices and potential incidents.


text: We have processes to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers. Such processes include evaluating service providers to ensure coverage of key cybersecurity risks have appropriate mitigations. We also monitor for threats impacting key service providers and assesses identified threats for potential impacts to services, data, and systems.


text: Risk Management & Strategy As previously discussed under the section titled "Enterprise Risk Management", through our ERM program we have a risk management framework that recognizes the risks inherent in our operating segments as well as the risks associated with the operations of our holding company. This process includes assessing, identifying and managing material risks related to cybersecurity.


text: ProAssurance's Information Systems Security department, with assistance from third-party security vendors, regularly monitors the Company's systems for indicators of attack or compromise to mitigate the risk of cyberattacks. The Company continually enhances its cyber and information security in order to identify and neutralize emerging threats and improve its ability to prevent, detect and respond to attempts to gain unauthorized access to the Company's data and systems. ProAssurance regularly adds additional security measures to its computer systems and network infrastructure to mitigate the possibility of cybersecurity breaches, including firewalls and penetration testing. The Company encrypts sensitive information and data and utilizes stringent access controls. Team members are required to complete quarterly security training which encompasses a wide range of cybersecurity topics. This training informs all team members of the processes and procedures to follow in the case they encounter a possible cybersecurity threat. This training is reinforced through periodic simulated phishing tests.


text: The Company also evaluates the integrity and security of the technology infrastructure of certain third parties that access, process or store data that the Company considers to be sensitive, significant, or legally protected. ProAssurance reviews and assesses its third-party providers' cybersecurity controls, as appropriate, and makes changes to the Company's business processes to manage these risks.


text: While our Board is responsible for ensuring that our entire ERM process is in place and functioning, our Audit Committee has the primary oversight responsibility for risks relating to cybersecurity. Our Vice President of Information Security regularly attends and presents to our Audit Committee on material cybersecurity risks and mitigating procedures. Our Vice President of Information Security oversees ProAssurance's information security and data privacy programs and is responsible for establishing and implementing our security strategy alongside our General Counsel, to whom the Vice President of Information Security reports directly. Our Vice President of Information Security has been with ProAssurance since 1998 and has over 25 years of IT and cybersecurity experience.


text: We maintain a cybersecurity program that is reasonably designed to protect our information against cybersecurity threats that may result in material adverse effects on the confidentiality, integrity and availability of our information systems as well as our business operations, financial condition and overall performance.


text: All possible cybersecurity incidents are reported to our General Counsel for consideration of materiality. Our General Counsel escalates consideration of materiality to our Chief Executive Officer, Chief Financial Officer and other corporate officers as appropriate. The Company does not utilize any third-party service providers for consideration of materiality for cybersecurity incidents. Upon determination that the Company has experienced a material cybersecurity incident, the Company will disclose the incident within four business days as required by regulation. Our Board is also notified of any material cybersecurity incidents immediately upon determination of materiality.


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company. Please refer to Item 1A, Risk Factors under the heading "Technology, Data Security and Privacy" for additional information on our cybersecurity threats.


text: ProAssurance's Information Systems Security department, with assistance from third-party security vendors, continually monitors the Company's systems for indicators of attack or compromise to mitigate the risk of cyberattacks. The Company regularly enhances its cyber and information security in order to identify and neutralize emerging threats and improve its ability to prevent, detect and respond to attempts to gain unauthorized access to the Company's data and systems. ProAssurance regularly adds additional security measures to its computer systems and network infrastructure to mitigate the possibility of cybersecurity breaches, including firewalls and penetration testing. The Company encrypts sensitive information and data and utilizes stringent access controls. Team members are required to complete quarterly security training which encompasses a wide range of cybersecurity topics. This training informs all team members of the processes and procedures to follow in the case they encounter a possible cybersecurity threat. This training is reinforced through periodic simulated phishing tests. Further, all team members are required to read and acknowledge the Company's guidelines for the use of publicly available generative artificial intelligence tools. The Company's guidelines explain how to protect the Company from risks that can arise if legally protected, proprietary or confidential information is shared with these tools.


text: The Company also evaluates the integrity and security of the technology infrastructure of certain third parties that access, process or store data that the Company considers to be sensitive, significant or legally protected. ProAssurance reviews and assesses its third-party providers' cybersecurity controls, as appropriate, and makes changes to the Company's business processes to manage these risks.


text: While our Board is responsible for ensuring that our entire ERM process is in place and functioning, our Audit Committee has the primary oversight responsibility for risks relating to cybersecurity. Our Vice President of Information Security regularly attends and presents to our Audit Committee on material cybersecurity risks and mitigating procedures. Our Vice President of Information Security oversees ProAssurance's information security and data privacy programs and is responsible for establishing and implementing our security strategy alongside our General Counsel, to whom the Vice President of Information Security reports directly. Our Vice President of Information Security has been with ProAssurance since 1998 and has over 26 years of IT and cybersecurity experience.