text: Risk Management and Strategy We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our overall risk management systems. These risks include, among other things: operational risks, encryption, intellectual property theft, fraud, extortion, harm to employees or other stakeholders, and violation of data privacy or security laws.

companyName: T1 Energy Inc.

ticker: TE


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to the Firm or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity program to identify the impact of their services on the cybersecurity risks to the Firm or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or a Firm audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's minimum cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.

companyName: LGAM Private Credit LLC

secItem: Item 1C


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, key elements of the Cybersecurity Program are subject to review by an independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley and Company Management's role in assessing and managing material risks from cybersecurity Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Cyber, Technology, and Information Security Non-Financial Risk, ("Head of NFR CTIS"), is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company.

stage1Category: Management Role

stage1Method: unanimous


text: The Chief Compliance Officer ("CCO") of the Company is responsible for overseeing the Company's risk management function and generally relies on the CIO, CISO, and Head of NFR CTIS to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of NFR CTIS has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies. The Company's CCO has worked in the financial services industry for 19 years and has covered business developments from a compliance perspective for over 10 years, during which time the Company's CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of NFR CTIS report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our Board.


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO, CISO, and/or Operational Risk functions, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

stage1Category: Board Governance


text: Material cybersecurity risks are addressed by Morgan Stanley management-level ERM committees with escalation to the BOTC and Board, as appropriate. The BOTC has primary responsibility for assisting the Morgan Stanley board in its oversight of significant operational risk exposures of the Firm and its business units, including IT, information security, fraud, third-party oversight, business disruption and resilience, and cybersecurity risks (including review of cybersecurity risks against established risk management methodologies) and the steps management has taken to monitor and control such exposures.


text: In accordance with its charter, the BOTC receives quarterly reports from (i) Technology, including the CIO or the CISO; (ii) Operations; and (iii) NFR. Such reporting includes updates on Morgan Stanley's Cybersecurity Program, risks from cybersecurity threats, our programs to address and mitigate the risks associated with the evolving cybersecurity threat environment, and NFR's assessment of cybersecurity risks. Senior officers in Technology and NFR also provide an annual report to the BOTC on the status of Morgan Stanley's broader information security program in compliance with the Gramm-Leach-Bliley Act, which includes a discussion of risks arising from cybersecurity threats. At least annually, senior management representatives in Technology and NFR discuss the status of the Cybersecurity Program and key cybersecurity risks with the Morgan Stanley board and, in accordance with such board's Corporate Governance Policies, all board members are invited to attend BOTC meetings and have access to meeting materials. The BOTC, which meets at least quarterly, also reviews and approves significant policies related to cybersecurity, receives an annual independent assessment of key aspects of Morgan Stanley's Cybersecurity Program from an independent third party and holds joint meetings with the BAC and BRC, as necessary and appropriate. The chair of the BOTC regularly discusses cybersecurity developments with senior Morgan Stanley management and reports to the Morgan Stanley board on cybersecurity risks and threats and other related matters.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2024, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Through its Manager, the Fund maintains a cybersecurity risk management program designed to identify, assess, manage, and mitigate threats, as well as respond to and recover from cybersecurity incidents. This program is coupled with an enterprise risk management program and covers the Fund's key information systems.

companyName: WTI Fund XI, Inc.


text: The cybersecurity risk management program includes a comprehensive risk assessment that is applicable to the Fund's operations. This assessment is based on recognized standards for cybersecurity and information technology as set forth in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). It is reviewed and updated at least annually. Internal controls designed to mitigate risks presented in the assessment are tested annually by an independent third party. Additionally, the Manager, on behalf of the Fund, contracts with a qualified third party to perform annual assessments of the Company's cybersecurity risk management program and to perform cybersecurity risk evaluations of selected key vendors. Another third party is engaged to provide day to day IT services which include implementing, monitoring, and maintaining the preventative and detective measures specified as part of the Fund's cybersecurity risk management program.


text: The Manager's Chief Compliance Officer led the development and oversees the implementation of the cybersecurity program, and is the head of the Manager's cybersecurity team, supported by the Director of Compliance. The Chief Compliance Officer is responsible for assessing and managing the Manager's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team, inclusive of all third parties engaged to provide operations, monitoring, detection, and remediation, has extensive experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes.


text: The Audit Committee of the Board of Directors oversees the Fund's cybersecurity risk exposures and the steps taken by management to monitor and mitigate identified risks. The Chief Compliance Officer briefs the Audit Committee on the effectiveness of the cyber risk management program at least on a quarterly basis. In addition, cybersecurity risks and cyber incidents, if any, are reviewed by the Fund's Board of Directors at least annually as part of the risk mapping exercise, or as warranted in the event of material incidents.


text: The Fund faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. See "Risk Factors – Risks Related to Cybersecurity" for further information on how our operations are subject to cyber incidents that could have a material adverse effect on our business, financial condition, results of operations, or cash flows.


text: Assessment, Identification and Management of Material Risks from Cybersecurity We have processes in place to assess, identify, and manage material risks from cybersecurity threats. We rely on the cybersecurity strategy and policies implemented by the Adviser and HPS, the providers of our technology services. The Adviser manages our day-to-day operations and has implemented, together with HPS, a firm-wide cybersecurity program that applies to us and our operations. References in this Item 1C to (i) any programs or processes of the Adviser shall be deemed to refer to any firm-wide programs and/or processes that have been implemented by HPS, and (ii) any actions of the Adviser shall be deemed to refer to actions of HPS and/or the Adviser, as the context may require.

companyName: HPS Corporate Capital Solutions Fund


text: will maintain reasonably up-to-date versions of system security agent software which must include malware protection and reasonably up-to-date patches and virus definitions, installed the extent technically feasible, personal information stored on portable devices, such as laptops or tablets, must be password protected, as must all records and files transmitted across public networks or wirelessly, to the extent technically feasible. computer systems must be monitored for unauthorized use of or access to personal information.

companyName: CoinShares Bitcoin ETF

ticker: BRRR

stage1Category: Risk Management Process


text: The Adviser's cybersecurity program prioritizes detection and analysis of and response to cybersecurity threats, management of security risks and resilience against cyber incidents, including those that may impact us. The Adviser's cybersecurity program is aligned to the Center for Internet Security critical controls framework. The Adviser's cybersecurity risk management processes applicable to us include technical security controls, policy enforcement mechanisms, monitoring systems, and other tools. Third-party providers are leveraged to assist in assessing, identifying and managing risks from cybersecurity threats applicable to us. The assessment of cybersecurity risks, including those which may be applicable to us, is integrated into the Adviser's overall risk management program. The Adviser has implemented and continues to implement risk-based controls designed to prevent, detect, and respond to information security threats and we rely on such controls.


text: The Adviser's cybersecurity program includes physical, administrative, and technical safeguards, as well as plans and procedures designed to help us prevent and respond to cybersecurity threats and incidents, including threats or incidents that may impact us. The Adviser's cybersecurity risk management processes seek to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat, and mitigate such threats. We rely on the Adviser to engage with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity program and risk management processes and responding to incidents.


text: The Adviser's cybersecurity risk management and awareness programs, which apply to us, include identification and testing of vulnerabilities, phishing simulations and cybersecurity awareness training. The Adviser undertakes internal security reviews of its information systems and related controls, including those applicable to us. The Adviser also completes external reviews of the cybersecurity program and practices applicable to us, which may include assessments of relevant data protection practices and targeted attack simulations.


text: The Adviser has developed an incident response plan that provides guidelines for responding to cybersecurity incidents. The incident response plan includes notification to the applicable members of cybersecurity leadership, including the Adviser's Chief Information Security Officer ("CISO"), and, as appropriate, escalation to other relevant individuals. Incidents may also be reported to the audit committee or full board of directors of the Adviser, as well as to the Audit Committee, if appropriate.


text: Our m anagement is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with the Adviser's CISO, as well as other risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: We depend on and engage various third parties, including suppliers, vendors, and service providers, to operate our business. We rely on the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Material Impact of Cybersecurity Risks During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or that are reasonably likely to materially affect us, including our business strategy, operational results and financial conditions. However, future incidents could have a material impact on our business strategy, results of operations or financial condition.


text: Management's Role in Cybersecurity Risk Oversight The Adviser's CISO and dedicated internal cybersecurity team are responsible for the cybersecurity program applicable to us (including enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture, and processes). Our Chief Compliance Officer ("CCO") is responsible for monitoring and reporting to the board about the Adviser's compliance with its responsibilities for the Adviser's and our cybersecurity program. The Adviser's CISO has over 15 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures in both US Government Intelligence agencies and Financial Services firms. The Adviser's CISO reports to the Chief Financial Officer of the Adviser and works closely with our management to administer, assess, discuss, and prioritize our cybersecurity efforts. Our CCO has been responsible for this monitoring and reporting as CCO to us for 3 years and has worked in the financial services industry for more than 30 years, during which time the CCO has gained expertise in assessing and managing risks applicable to us.


text: Board Oversight of Cybersecurity Risks The Audit Committee provides strategic oversight of risk assessment and risk management matters, including risks associated with cybersecurity threats. Certain of our members update the Audit Committee as well as our full Board, as appropriate, on cybersecurity matters, primarily through presentations by our CCO and the Adviser's CISO. Such reporting includes updates on the cybersecurity program applicable to us, the external threat environment, and the Adviser's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes, which includes employee training on awareness and identifying cybersecurity threats. Cybersecurity risks related to our business, technical operations, privacy, and compliance activities are identified and addressed through our risk control process and through our monthly security meetings where we address the threat landscape, including risks related to our third-party service providers. We use an external cybersecurity firm and cybersecurity experts to provide various services to supplement our internal personnel and expertise.


text: We have implemented a program for incident response and breach management as part of our crisis management process, and we perform tabletop exercises for cyber incidents with the crisis management team. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational, business, and privacy impacts.


text: The Audit and Risk Committee (the "ARC") has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. The ARC reports any findings and recommendations, as appropriate, to the full Board of Directors for consideration. Management regularly discusses cyber risks and trends and, should they arise, any material incidents with the ARC. Members of management overseeing cybersecurity threats, including our Chief Digital Officer and Chief Information Security Officer have experience in areas including management of information technology, data security, and cybersecurity.


text: As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. See also the cybersecurity-related risks in Item 1A "Risk Factors."

stage1Category: Strategy Integration


text: Risk Management and Strategy We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our overall risk management systems. These risks include, among other things: operational risks, encryption, intellectual property theft, fraud, extortion, harm to employees or other stakeholders, and violation of data privacy or security laws.


text: The Audit and Risk Committee (the "ARC") has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. The ARC reports any findings and recommendations, as appropriate, to the full Board of Directors for consideration. Management regularly discusses cyber risks and trends and, should they arise, any material incidents with the ARC. Members of management overseeing cybersecurity threats report to our Chief Executive Officer and have experience in areas including management of information technology, data security, and cybersecurity.

stage1Method: majority


text: As a community bank, we rely heavily on information technology and telecommunications systems to conduct our business activities, such as processing transactions, maintaining records, communicating with customers and vendors, and providing online and mobile banking services. These systems are subject to various cybersecurity threats, such as unauthorized access, hacking, phishing, malware, ransomware, denial-of-service attacks, and other malicious or criminal activities, that could compromise the confidentiality, integrity, or availability of our systems, data, or customer information. Cybersecurity threats may originate from external sources, such as cybercriminals, hackers, terrorists, or foreign governments, or from internal sources, such as employees, contractors, or vendors. Cybersecurity threats may also target our third-party service providers, such as core processors, cloud providers, or payment processors, whose systems and data are interconnected with ours.

companyName: MUNCY COLUMBIA FINANCIAL Corp

ticker: CCFN


text: Cybersecurity Risk As a fully integrated electric and gas utility, we operate and participate in regional markets and are interconnected with other entities. The operation of these systems depends on information technology systems we own and operate as well as third party systems and service providers. Strategic business partners are also leveraged to support our mission. As an operator of critical infrastructure, nefarious actors may find us a valuable target if they wish to disrupt our operations and negatively impact our customers. The systems and partnerships described above are all potential targets for a cyber-incident. Any significant interruption or failure of our information systems due to cyber-attacks, hacking or internal security breaches could prevent us from fulfilling our critical business functions including delivering energy to our customers, and sensitive, confidential, and other data could be compromised. This could adversely affect our business, our financial condition, operating results or liquidity. For the year ended December 31, 2023, there have been no cybersecurity incidents with a material impact on our business strategy, operations, or financial condition.

companyName: NorthWestern Energy Group, Inc.

ticker: NWE


text: Risk Management and Strategy We utilize a comprehensive, defense in depth approach to cybersecurity risk, which helps us to continually assess, identify and manage enterprise-wide material cybersecurity risks. Our cybersecurity risk management is integrated into our overall Enterprise Risk Management (ERM) process and is reviewed at least quarterly. Our cybersecurity strategy focuses on maintaining the confidentiality, integrity and availability of data. We leverage frameworks established by the National Institute of Standards and Technology and the Center for Information Security for our information and cybersecurity governance program. We have a comprehensive cybersecurity threat detection and monitoring program for our technology and network infrastructure, which leverages various systems, processes, and operational measures to monitor, detect, and respond to cyber incidents. Our cybersecurity processes, including our threat detection, monitoring, and response protocols are subject to ongoing vulnerability testing, and comparison to industry practices. An Incident Response and Disaster Recovery Plan is maintained and periodically exercised. The plan includes a process to identify, protect, detect, respond to and recover from cybersecurity threats and incidents. Resiliency and recoverability are paramount in the plan. This includes a clearly defined escalation process within the plan to ensure management and the Board of Directors are notified if an incident or series of events warrant escalation.


text: Our strategy includes employee training and awareness on cybersecurity risks and related best practices, required password complexity, the use of multi-factor authentication, information security protocols, modern end point protection against threats, patching strategy, the execution of tabletop exercises on a periodic basis, established policies and protocols for cyber incident response planning and reporting, and ongoing internal cybersecurity testing.


text: We monitor potential risks associated with the use of third-party service providers and vendors. Our cyber incident monitoring process includes dialog with any third party or business partner potentially impacted by a disclosed incident. Service providers and vendors must adhere to security requirements such as security incident or data breach notification and response protocols, appropriate data encryption requirements, and data disposal. In addition, we engage with third party consultants to perform penetration (PEN) studies. These independent third party assessments provide valuable insight to enhance our cybersecurity posture.

stage1Category: Third-Party Risk


text: Board Governance Our Board of Directors reviews the cybersecurity program through risk review and cybersecurity reporting on at least a quarterly basis. The Audit Committee oversees our ERM program, including cybersecurity protocols. The Safety, Environmental, Technology and Operations (SETO) Committee provides oversight and review of technology policy and strategy as it relates to cybersecurity issues impacting company operations. Both the Audit Committee and the SETO Committee include Directors with diverse experience in technology, finance, enterprise risk, and security providing effective assessment and oversight of cybersecurity risk. Of note, one member of the Board has bolstered their understanding of technology and security issues by obtaining a certificate in cybersecurity oversight.


text: Roles and Responsibilities of Management Our cyber security team, which reports to the Vice President - Technology, has primary responsibility for cybersecurity strategy and assessing cyber risk. The Vice President - Technology is responsible for informing the Chief Executive Officer and other Officers, as necessary, about cybersecurity incidents, covering prevention, detection, mitigation, and remediation efforts as they are detected by the cyber security team. Collectively, our cyber security team has experience in cybersecurity, hold numerous industry certifications related to cybersecurity, and have experience in desktop support, networking, application administration and programming.


text: Cybersecurity Risk As a fully integrated electric and gas utility, we operate and participate in regional markets and are interconnected with other entities. The operation of these systems depends on information technology systems we own and operate as well as third party systems and service providers. Strategic business partners are also leveraged to support our mission. As an operator of critical infrastructure, nefarious actors may find us a valuable target if they wish to disrupt our operations and negatively impact our customers. The systems and partnerships described above are all potential targets for a cyber-incident. Any significant interruption or failure of our information systems due to cyber-attacks or incidents could hinder our ability to fulfill our critical business functions. This could adversely affect our business, our financial condition, operating results or liquidity. Through the year ending on December 31, 2024, there have been no cybersecurity incidents that have had a material impact, or any impact, on our business strategy, operations, or financial condition.


text: Risk Management and Strategy We utilize a comprehensive, defense in depth approach to cybersecurity risk, which helps us to continually assess, identify and manage enterprise-wide material cybersecurity risks. Our cybersecurity risk management is integrated into our overall Enterprise Risk Management (ERM) process and is reviewed at least quarterly. Our cybersecurity strategy focuses on maintaining the confidentiality, integrity and availability of data. We leverage frameworks established by the National Institute of Standards and Technology and the Center for Information Security for our information and cybersecurity governance program. We have a comprehensive cybersecurity threat detection and monitoring program for our technology and network infrastructure, which leverages various systems, processes, and operational measures to monitor, detect, and respond to cyber incidents. Our cybersecurity processes, including our threat detection, monitoring, and response protocols are subject to ongoing vulnerability testing, and comparison to industry practices. An Incident Response and Disaster Recovery Plan is maintained and exercised. The plan includes a process to identify, protect, detect, respond to and recover from cybersecurity threats and incidents. Resiliency and recoverability are paramount in the plan. This includes a clearly defined escalation process within the plan to ensure management and the Board of Directors are notified if an incident or series of events warrant escalation.


text: Our strategy includes employee training and awareness on cybersecurity risks and related best practices, simulated phishing campaigns, required password complexity, the use of multi-factor authentication, information security protocols, modern end point protection against threats, patching strategy, the execution of tabletop exercises on a periodic basis, established policies and protocols for cyber incident response planning and reporting, and ongoing internal cybersecurity testing.


text: As part of engaging a new third party provider, we assess their security standards, require security terms and conditions and work with risk management to ensure insurance coverage is adequate for the exposure risk. Service providers and vendors must adhere to security requirements such as security incident or data breach notification and response protocols, appropriate data encryption requirements, and data disposal. Our cyber incident monitoring process includes dialog with any third party or business partner potentially impacted by a disclosed incident. In addition, we leverage third party consultants to perform penetration (PEN) studies. These independent third party assessments provide valuable insight to enhance our cybersecurity posture.


text: Roles and Responsibilities of Management Our cyber security team, which reports to the Vice President - Technology, has primary responsibility for cybersecurity strategy and assessing cyber risk. The Vice President - Technology is responsible for informing the Chief Executive Officer and other Officers, as necessary, about cybersecurity incidents, covering prevention, detection, mitigation, and remediation efforts as they are detected by the cyber security team. Collectively, our cyber security team holds numerous industry certifications related to cybersecurity and have experience in desktop support, networking, application administration and programming.


text: GE Vernova has processes for assessing, identifying, and managing cybersecurity risks that are built into our risk management program and IT functions. These processes are designed to help protect our information assets from internal and external cyber threats, protect employee information from unauthorized access or attack, and secure our networks, systems, and products. We have developed and implemented a cybersecurity framework intended to assess, identify, and manage risks from threats to the security of our information, systems, products, and networks using a risk-based approach. The framework is informed in part by industry standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework and International Organization for Standardization 27001 (ISO 27001) Framework. This approach does not imply that GE Vernova meets all technical standards, specifications, or requirements under the NIST Cybersecurity Framework or ISO 27001.

companyName: GE Vernova Inc.

ticker: GEV


text: Our key cybersecurity processes include: • Risk-based controls for information systems and information on our network. We seek to maintain an IT infrastructure that implements physical, administrative, and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity, and availability of our information systems and information stored on the Company's networks, including customer information, employee information, IP, and proprietary information. • Cybersecurity incident response plan and testing. We have a cybersecurity incident response plan and a dedicated team to respond to cybersecurity incidents. When a cybersecurity incident occurs or a vulnerability is identified, GE Vernova has cross- functional teams that are responsible for leading the initial assessment of priority and severity. External experts may also be engaged as appropriate. GE Vernova's cybersecurity team assists in responding to incidents depending on severity levels and seeks to improve our cybersecurity incident management plan through periodic tabletops or simulations at the enterprise and business levels. • Training. We provide security awareness training to help employees understand their information protection and cybersecurity responsibilities. We also provide additional role-based training to applicable employees based on customer requirements, regulatory obligations, and industry risks. • Supplier risk assessments. We have implemented a third-party risk management process that includes expectations regarding information protection and cybersecurity. That process, among other things, provides for GE Vernova to perform cybersecurity assessments on certain suppliers based on their risk profile and a related rating process. GE Vernova also seeks contractual commitments from key suppliers to appropriately secure and maintain their IT systems and protect our information that is processed on their systems. • Third-party assessments. We have third-party cybersecurity companies engaged to periodically assess GE Vernova's cybersecurity posture and assist in identifying and remediating risks from cybersecurity threats.


text: GE Vernova considers cybersecurity, along with other top risks, within our enterprise risk management framework. The enterprise risk management framework includes internal reporting at the enterprise level with consideration of key risk indicators, trends, and countermeasures for cybersecurity and other types of significant risks. GE Vernova does not believe that there are currently any known incidents from cybersecurity threats that are reasonably likely to materially affect GE Vernova or its business strategy, results of operations, or financial condition. As is the case for all large, global companies, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the Company, including our operations, business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors—Risks Relating to Technology and Intellectual Property" for further information about these risks. We outsource certain cybersecurity functions and will continue to look for opportunities to utilize managed security service providers.


text: In addition, we collaborate with GE Aerospace on certain cybersecurity functions and will continue to do so during a transition period following our Spin-Off. These arrangements increase our overall cyber risk given the degree of our interconnectedness with these third parties and the potential impact on our outsourced functions that could be caused by an attack on them.


text: The Audit Committee of the GE Vernova's Board of Directors is responsible for board-level oversight of cybersecurity risk, and the Audit Committee reports back to the full Board about this and other areas within its responsibility. As part of its oversight role, the Audit Committee receives reporting about GE Vernova's practices, programs, notable threats or incidents, and other developments related to cybersecurity throughout the year, including through periodic updates from our Chief Information Security Officer (CISO). The Audit Committee also receives information about cybersecurity risks as part of GE Vernova's enterprise risk management framework and reporting. In addition to receiving reports from the Audit Committee, the Board also periodically receives direct reports from the CISO on the Company's cybersecurity risk management.


text: GE Vernova's CISO reports to GE Vernova's Chief Information Officer and leads our overall cybersecurity function. The CISO has over 20 years of experience in managing and leading IT or cybersecurity teams and participates in various cyber security organizations. The CISO collaborates with business unit CISOs to identify and analyze cybersecurity risks to GE Vernova; consider industry trends; implement controls, as appropriate and feasible, to mitigate these risks; and enable business leaders to make risk-based business decisions that implicate cybersecurity considerations. The CISO meets with senior leadership to review and discuss GE Vernova's cybersecurity program, including emerging cyber risks, threats, and industry trends. The CISO also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including by collaborating with internal security personnel and business stakeholders, and incorporating threat intelligence and other information obtained from governmental, public, or private sources to inform our cybersecurity technologies and processes.


text: ITEM 2. PROPERTIES. GE Vernova is headquartered in Cambridge, Massachusetts and occupies approximately 600 sites in 465 cities and 95 countries. Approximately 85% of the sites are leased and 15% are owned. GE Vernova periodically reviews the portfolio of facilities for opportunities to optimize and best align our footprint needs.

stage1Category: None/Other


text: Within this portfolio of properties, GE Vernova's subsidiaries operate 91 manufacturing sites, 18 of which are located in the U.S. and 73 are located internationally. The manufacturing facilities are used by GE Vernova's segments as follows: Number of Facilities Power Electrification Total The locations of GE Vernova's manufacturing locations by geographic region are as follows: Number of Facilities Americas Association of Southeast Asian Nations (ASEAN) Europe, the Middle East, and Africa (EMEA) Total In addition to the manufacturing facilities described above, GE Vernova maintains many offices, warehouses, and distribution facilities globally.


text: Many of our facilities serve several of our businesses and may be used for multiple purposes, such as for administration, sales, research, laboratory matters, manufacturing, and service operations. We consider our facilities suitable and adequate for their respective purposes and do not anticipate difficulty in renewing existing leases as they expire or finding alternative facilities if necessary.


text: Risk Management and Strategy Securing Bunge's business information, customer, supplier, and employee data and information technology systems is an important part of our overall risk management framework. We rely on certain key information technology systems, some of which are dependent on services provided by third parties, to provide critical data and services for internal and external users, including procurement and inventory management, transaction processing, financial, commercial and operational data, human resources management, legal and tax compliance, and other information and processes necessary to operate and manage our business.

companyName: Bunge Global SA

ticker: BG


text: of Risks and Cybersecurity Governance combat internal risks to the security, confidentiality, and/or integrity of any electronic records containing personal information, and evaluating and improving, where necessary, the effectiveness of the current safeguards for limiting such risks, Valkyrie has identified the following risks that are present to its business as well as procedures to help mitigate those risks: Internal Threats There must be communication to employees on the detailed provisions of the cybersecurity program at onboarding and annually.


text: Our cybersecurity risk management program monitors our systems and networks for threats, breaches, intrusions and other weaknesses; assesses the security of our company-wide software, applications and systems; conducts security audits and threat assessments; responds to cybersecurity incidents; and facilitates training for our employees. Within our cybersecurity team, subject matter experts regularly obtain cybersecurity certifications. Our program includes procedures to identify cybersecurity risks and threats of our third-party service providers. These procedures measure the maturity of third-party provider cybersecurity programs against industry best practices. The collection of this information is used to assess the use of third-party software or partnerships. We also review the cybersecurity scores of our business customers and suppliers, and we rely on consultants and other third-party advisors to conduct security assessments and independent audits of the security and resilience of our systems and networks. Our cybersecurity risk management program includes response plans that are aligned with our crisis response plans and outline the procedures and protocols to follow when a cybersecurity incident has or may have occurred, including to allow assessments related to disclosure and notice requirements to be timely made to regulators and affected parties. The response plan includes protocols to notify our Chief Technology Officer ("CTO"), our Chief Legal Officer, other members of senior management as appropriate, and, under certain circumstances, the Audit Committee of our Board, or our full Board as appropriate.


text: We have integrated cybersecurity risk assessments into Bunge's overall enterprise risk management framework to promote a company-wide culture of cybersecurity risk management. Our CRO formulates periodic reports and provides them to our Management Risk Committee ("MRC"). As noted in "Item 1. Business - Risk Management", the MRC reviews key enterprise risks on an ongoing basis and is responsible for reviewing and monitoring key exposures, emerging risks, and drivers of risk.


text: Increased global cybersecurity vulnerabilities, threats, and more sophisticated and targeted cybersecurity attacks, including those tied to global conflicts, pose a potentially significant risk to the security of our information technology systems, networks and services, as well as the confidentiality, availability and integrity of our data and the confidential data of our employees, customers, suppliers, and other third parties that we may hold. Although, to date, we have not experienced a material cybersecurity incident resulting in a significant interruption of our operations, the scope of any future incident cannot be predicted with any meaningful accuracy. See "Item 1A. Risk Factors" for more information.


text: Our CTO leads our Business Technology organization and our cybersecurity risk management program in coordination with our CRO. The Business Technology team is responsible for assessing, identifying, and managing risks from cybersecurity threats. Our CTO and CRO regularly receive briefings on cybersecurity matters, and in turn our CTO regularly reports to the Audit Committee on such matters. Our CRO regularly reports on enterprise risks facing the Company to the ERMC. Our CTO has more than 20 years of experience in leading, managing, and transforming information technology systems for large, global organizations, and our CRO has several years of experience in leading and managing risk oversight for global organizations.


text: Our Board oversees Bunge's approach to risk management. Our Board has established a dedicated Board committee, the Enterprise Risk Management Committee, which enables greater focus at the Board level on risk oversight tailored to our business and industries. Additionally, each of our other Board committees is responsible for considering risks within its area of responsibility. The Board has delegated oversight and review of risks related to cybersecurity and information technology systems to the Audit Committee.


text: The Audit Committee is responsible for reviewing and assessing the overall cybersecurity risk management program and management's processes and policies with respect to cybersecurity risk monitoring, identification, assessment, and response. Senior management and the Audit Committee receive at least quarterly updates on Bunge's cybersecurity readiness and the current "threat environment," which includes an update on the cybersecurity threat landscape, the strategic priorities of the cybersecurity risk management program and progress made in respect of those priorities, a review of cybersecurity incidents, as well as additional updates on an as-needed basis. Our internal audit team also reports to the Audit Committee on the effectiveness of management in identifying and appropriately controlling risks, including cybersecurity risks. The Audit Committee regularly reports on its activities to the full Board to promote effective coordination and to ensure that the entire Board remains apprised of the effectiveness of the cybersecurity risk management and the cybersecurity risk landscape, and also assesses how management is managing these risks.


text: to records containing client's personal information shall be limited to those persons who are reasonably required to know such information.


text: security measures shall be reviewed at least annually, or whenever there is a material change in our business practices that may reasonably implicate the security or integrity of records containing personal information.


text: Our cybersecurity risk management program monitors our systems and networks for threats, breaches, intrusions and other weaknesses; assesses the security of our company-wide software, applications and systems; conducts security audits and threat assessments; responds to cybersecurity incidents; and facilitates training for our employees. Within our cybersecurity team, subject matter experts regularly obtain cybersecurity certifications. Our program includes procedures to identify cybersecurity risks and threats of our third-party service providers. These procedures measure the maturity of third-party provider cybersecurity programs against industry best practices. The collection of this information is used to assess the use of third-party software or partnerships. We also review the cybersecurity scores of our business customers and suppliers, and we rely on consultants and other third-party advisors to conduct security assessments and independent audits of the security and resilience of our systems and networks. Our cybersecurity risk management program includes response plans that are aligned with our crisis response plans and outline the procedures and protocols to follow when a cybersecurity incident has or may have occurred, including to allow assessments related to disclosure and notice requirements to be timely made to regulators and affected parties. We have also performed and plan to continue to conduct cybersecurity incident simulation exercises involving members of senior management as part of our cybersecurity risk management program. The Board is provided with an update following a simulation exercise. Our response plans include protocols to notify our Chief Technology Officer ("CTO"), our Chief Legal Officer, other members of senior management as appropriate, and, under certain circumstances, the Audit Committee of our Board, or our full Board as appropriate.


text: Our worldwide team of cyber and information security professionals undertakes a range of activities to protect its employees, assets, and reputation globally, leveraging internal and external resources to monitor cybersecurity threats to its systems and networks and to understand the broader threat environment. In support of these efforts, Our security experts use automated threat intelligence feeds and tools to increase vulnerability awareness, taking action to mitigate the highest risks.


text: Bunge's dedicated cyber risk organization meets regularly with business units and corporate operations to raise cyber risk awareness and keep diverse cybersecurity skill sets connected across the global enterprise. We invest in broad cybersecurity awareness and training to educate those with access to Bunge's networks, which includes a review of company policies and best practices. We conduct phishing tests to train our workforce, and assess its ability, to identify and report malicious emails and activity. Privacy and data protection awareness and training is provided to employees and the Board as part of Bunge's required Code of Conduct training.


text: We have integrated cybersecurity risk assessments into Bunge's overall enterprise risk management framework to promote a company-wide culture of cybersecurity risk management. Our CRO formulates periodic reports and provides them to our Management Risk Committee ("MRC"). As noted in "Item 1. Business - Risk Management", the MRC reviews key enterprise risks on an ongoing basis and is responsible for reviewing and monitoring key exposures, emerging risks, and drivers of risk. Bunge uses a risk-based information security process aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to identify, prioritize, and mitigate cybersecurity risks, which is periodically assessed by an independent third party.


text: Increased global cybersecurity vulnerabilities, threats, and more sophisticated and targeted cybersecurity attacks, including those tied to global conflicts, pose a potentially significant risk to the security of our information technology systems, networks and services, as well as the confidentiality, availability and integrity of our data and the confidential data of our employees, customers, suppliers, and other third parties that we may hold.


text: Although we have experienced and will continue to experience cybersecurity incidents of varying degrees, to date, we have not experienced a cybersecurity incident that has materially affected or is reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Despite the measures the company takes to mitigate cybersecurity risks, there can be no assurance that such measures will be sufficient to protect the company's systems, information, intellectual property,and other assets from significant harm and, therefore, the scope and impact of any future cybersecurity incident cannot be predicted with any meaningful accuracy. See "Item 1A. Risk Factors" for more information.


text: employees must return all records containing personal information, in any form, that may at the time of such termination be in the former employee's possession.


text: Valkyrie does not provide its clients with online account access nor does process funds transfer requests. If the firm's business changes to allow for remote client access and funds transfer requests, Valkyrie will update the cybersecurity program accordingly by identifying the potential risks involved and implementing the appropriate safeguards to protect the client's personal information.


text: The Audit Committee is responsible for reviewing and assessing the overall cybersecurity risk management program and management's processes and policies with respect to cybersecurity risk monitoring, identification, assessment, and response. Senior management and the Audit Committee receive an annual update and ongoing quarterly updates on Bunge's cybersecurity readiness and the current "threat environment," which includes an update on the cybersecurity threat landscape, the strategic priorities of the cybersecurity risk management program and progress made in respect of those priorities, a review of cybersecurity incidents, as well as additional updates on an as-needed basis. Our internal audit team also reports to the Audit Committee on the effectiveness of management in identifying and appropriately controlling risks, including cybersecurity risks. The Audit Committee regularly reports on its activities to the full Board to promote effective coordination and to ensure that the entire Board remains apprised of the effectiveness of the cybersecurity risk management and the cybersecurity risk landscape, and also assesses how management is managing these risks.


text: Risk Management and Strategy We collect, store, process and use data necessary to conduct our business, including information regarding our customers and employees in digital form. Data maintained in digital form is subject to unauthorized access, modification, theft, misuse or other cybersecurity risks.

companyName: WEBTOON Entertainment Inc.

ticker: WBTN


text: We maintain comprehensive processes to assess, identify, and manage material risks from internal and external cybersecurity threats, and have integrated such processes into our overall enterprise risk management systems and processes. We regularly assess our cybersecurity threats based on industry leading frameworks, including ISO 27001, ISO 27701 and National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). Assessments are performed by dedicated cybersecurity teams led by our Chief Information Security Officer and Data Protection Officer (CISO and DPO) to identify risks related to data loss, theft, misuse and other cybersecurity risks. Following such risk assessments, we design and implement safeguards to prevent and mitigate identified risks based on our risk management methodology. Additionally, we regularly conduct cybersecurity/privacy awareness training, phishing attack simulation training, disaster recovery training and other tabletop exercises to improve our practices.


text: To maintain the highest levels of cybersecurity, we engage independent third-party experts to assess and audit our cybersecurity and obtain cybersecurity certifications, including ISO 27001, ISO 27701 and/or SOC2 on our key services. Our insurance coverage addresses certain financial exposures related to cybersecurity incidents. Although, we have not experienced any material cybersecurity incidents, we face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. Despite our efforts, the risk of unauthorized access, modification, theft, misuse and other cybersecurity attacks cannot be eliminated entirely. We have experienced, and may continue to experience, cybersecurity incidents in our normal course of business. See "Risk Factors — Risks Related to Our Business, Industry and Operations — If the security of our platform is compromised, it could compromise our and our creators' and users' personal, sensitive, confidential and proprietary information, disrupt our internal operations and harm public perception of our platform, which could adversely affect our business and reputation."


text: We use third party systems and software and provide personal information about customers and employees to third parties in certain cases. We assess the cybersecurity of third party service providers and regularly conduct access review. We may decline or terminate the engagement with certain third party service providers if we determine that the use of their services would increase our exposure to cybersecurity risks.


text: Our CISO and DPO serves as the chair of the IT Compliance Committee, which directly reports to our CEO. The IT Compliance Committee also includes key representatives from management, and is responsible for reviewing IT planning, cybersecurity and privacy, and managing our cybersecurity teams. The IT Compliance Committee, upon reviewing assessment results regularly reported by cybersecurity teams, provides periodic updates to the Audit Committee on the effectiveness of our cybersecurity processes, and the Audit Committee reviews cybersecurity risks as part of the Company's enterprise risk management system. The Audit Committee periodically reports the results of its review to the Board. When a cybersecurity incident occurs, information is escalated to the CISO and DPO who may convene IT Compliance Committee meetings to discuss findings, actions taken, potential disclosure obligations, impact and recurrence prevention plan depending on the severity of the incident.


text: The IT Compliance Committee members rely on the cybersecurity experience of our CISO and DPO, which includes more than 20 years of directing privacy policies at public companies that provide web portal and instant messenger services, and managing cybersecurity and privacy policies at a game developer company. All IT Compliance Committee members have robust experience in their respective fields as well as a general familiarity with cybersecurity matters and an understanding of the potential financial impacts, disclosure obligations, and enterprise risks to the Company as they relate to cybersecurity.


text: As described under Item 1A in this Form 10-K, the Combined Company is subject to risks from cybersecurity threats, including risks relating to maintaining customer and employee data. Cybersecurity is a key focus at multiple levels of the organization, and management has developed policies and procedures to assess, identify and manage risks from cybersecurity threats.

companyName: Six Flags Entertainment Corporation/NEW

ticker: FUN


text: – Board of Directors – Enterprise risk management ("ERM") process: As part of the ERM process, executive management and the Board of Directors regularly review an assessment related to cybersecurity and data protection risks to identify material risk areas, assess processes to mitigate those risks, and identify process and procedure improvements to alleviate identified risks, including allocating appropriate resources. Cybersecurity and data protection focus areas of ERM include phishing, malware, data breaches, outdated software, staffing levels for key information technology positions, and risks associated with the use of third parties. – Audit and Finance Committee of the Board of Directors: The Audit and Finance Committee is responsible for discussing the Combined Company's major information technology risk exposures, including cybersecurity, and the steps management has taken to monitor and control such exposures. The Audit and Finance Committee dedicates attention to and provides oversight of certain cybersecurity risks. The Chief Digital and Technology Officer and Corporate Vice President, IT Infrastructure Operations and Security, meet with the Audit and Finance Committee regularly to assess management's progress on implementing process and procedure improvements related to cybersecurity. The Audit and Finance Committee also provides guidance on long-term and short-term cybersecurity strategies.


text: –Executive Management – Technology Governance Committee: The Technology Governance Committee consists of certain members of executive management, including the Chief Accounting Officer, Chief Digital and Technology Officer, Chief Commercial Officer, Chief Strategy Officer, and Corporate Vice President, IT Infrastructure Operations and Security. This committee evaluates projects involving information technology, including reviewing best practices and change management needs and communicating a company-wide approach. Therefore, the information technology department is aware of system and application implementations prior to execution to facilitate proper application and infrastructure security both during implementation and after implementation. Internal audit is notified of system and application implementations as part of this process as well. The internal audit department works with the information technology department to review information technology projects to ensure key projects are appropriately planned, designed, developed, tested, deployed and maintained, including verifying proper security both during and after implementation.


text: –Information Technology Department: The information technology department consists of employees with extensive cybersecurity experience, including the Chief Digital and Technology Officer and Corporate Vice President, IT Infrastructure Operations and Security, as well as a team of compliance and security associates. Cybersecurity experience within the information technology department includes prior work experience and bachelor's degrees or higher in technology related fields. In addition to internal resources, management engages a cyber insurance carrier with comprehensive data privacy and security risk management services; a managed security service provider with comprehensive security solutions, including continuous network monitoring, reporting and assistance with investigation; and an information security consulting company that consists of cybersecurity experts and information security practitioners to provide additional cybersecurity support. Management also maintains a system of information technology controls and procedures, including controls and procedures related to authentication and access, recovery plans and secured backups of data, the design of applications and selection of packaged software, and testing of significant changes in applications and infrastructure technology. Management also provides training to its employees about cybersecurity, performs penetration testing at least annually, performs security incident preparedness activities at least annually, and performs an annual Payment Card Industry ("PCI") attestation. Third party providers involving information technology are identified as part of the contract review process. System and Organizational Controls ("SOC") reports are reviewed annually for third party providers. The information technology department continuously monitors for cybersecurity threats in order to detect if a cybersecurity incident has occurred. The department uses endpoint detection and response ("EDR") and security information and event management ("SIEM") with the assistance of a managed security service provider and internal analysts to detect and identify threats. Lastly, management follows the National Institute of Standards and Technology ("NIST") Framework, which enables management to compare the Company against the industry and manage dynamic cybersecurity risks.


text: If a cybersecurity incident were to occur, including a cybersecurity incident associated with a third-party provider, management has developed an incident response plan to align responsibilities throughout the organization to facilitate an efficient and effective response, as well as an appropriate investigation of each incident. The incident response plan is led by executive management, the Chief Digital and Technology Officer, the Corporate Vice President, IT Infrastructure Operations and Security, and the information technology department and includes a further delegation of incident responsibility to key internal stakeholders, including the legal, investor relations, human resources, and internal audit departments. Upon identification of an incident, each incident is assigned an incident materiality rating based on both quantitative and qualitative considerations. Qualitative considerations include the presence of ransomware, operational degradation or interruption, operational loss, and sensitive or confidential data loss. Based on the severity of each incident, the incident response is escalated. Cybersecurity incidents, regardless of materiality, are investigated by the information technology department led by Corporate Vice President, IT Infrastructure Operations and Security and are communicated to the Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Digital and Technology Officer, the Executive Chairman of the Board of Directors, Lead Independent Director and the Chair of the Audit and Finance Committee. The entire Board of Directors is notified of material or high-risk incidents.


text: Risks from cybersecurity threats could materially affect the Combined Company's business strategy, results of operations or financial condition as described under Item 1A in this Form 10-K. There are no known risks from cybersecurity incidents that have materially affected or are reasonably likely to materially affect the registrant as of the date of this filing.


text: terminated employee's physical and electronic access to personal information must be immediately blocked. Such terminated employee shall be required to surrender all keys, IDs or access codes or badges, business cards, and the like, that permit access to the firm's premises or information. Moreover, such terminated employee's remote electronic access to personal information must be disabled; his/her voicemail access, e-mail access, internet access, and passwords must be invalidated. employees' user ID's and passwords must be managed in accordance to Valkyrie's password policy. are encouraged to report any suspicious or unauthorized use of customer information.


text: We have implemented various security measures and controls to protect our systems and data from unauthorized access, use, or disclosure, such as firewalls, encryption, authentication, backup, and recovery, both internally and with our third party managed service provider. We also have established policies and procedures to monitor and respond to cybersecurity incidents, and to comply with applicable laws and regulations regarding cybersecurity and data privacy. We regularly review and update our security measures and controls to address the evolving nature and sophistication of cybersecurity threats. We also provide training and education to our employees and customers on cybersecurity awareness and best practices. In addition, we maintain cyber liability insurance coverage to mitigate the potential financial impact of cybersecurity incidents. Furthermore, internal and external auditors and regulators periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain a Business Continuity and Incident Response Program that provides a documented framework for responding to actual or potential incidents, including engagement of appropriate third parties such as insurance providers and incident response professionals, and timely reporting to our CEO and Board of Directors as appropriate. The Business Continuity and Incident Response Program is coordinated by the Information Security Officer and key members of management are embedded into the Plan by its design. The Business Continuity and Incident Response Program facilitates coordination across multiple areas of our organization and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is always present. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. Despite our efforts, we cannot guarantee that our security measures and controls will be sufficient or effective to prevent, detect, or mitigate all cybersecurity incidents or to protect our systems and data from unauthorized access, use, or disclosure. We may experience cybersecurity incidents in the future that could result in operational disruption, reputational damage, customer dissatisfaction, loss of business or revenue, legal liability, regulatory actions, fines, penalties, or remediation costs. Any of these outcomes could have a material adverse effect on our business, operations, and financial condition. While we have experienced cybersecurity incidents in the past, risks from cybersecurity threats have not materially affected the Corporation to date.


text: rely on the information technology and systems maintained by Pillar and their employees to identify and manage material risks from cybersecurity threats. Pillar takes various actions, and incurs significant costs, to maintain and manage the operation and security of information technology and systems, including the data maintained in those systems. We believe that Pillar's Director of Information Technology and his associates endeavor to evaluate and address cyber risks in alignment with our business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology and CIS Critical Security Controls frameworks. Since we rely on accounting, financial, operational, management and other information systems, including the Internet and third-party hosted services to conduct our operations, store personal and sensitive data, process financial information and results of operations for internal reporting purposes and comply with financial reporting, legal and tax requirements, we have processes and procedures in place to monitor the prevention, detection, mitigation and remediation of cybersecurity risks. These include, but are not limited to (i) maintaining a defined and practiced incident response plan; (ii) employing appropriate incident prevention and detection safeguards; (iii) maintaining a defined disaster recovery policy and employing disaster recovery software, where appropriate; (iv) educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and (v) reviewing and evaluating new developments in the cyber threat landscape. Recognizing the complexity and evolving nature of cybersecurity risk, we engage with a range of external support in evaluating, monitoring and testing our cybersecurity management systems and related cyber risks.

companyName: INCOME OPPORTUNITY REALTY INVESTORS INC /TX/

ticker: IOR


text: Audit Committee of the Board of Directors oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from Pillar's Director of Information Technology regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, a detailed incident response plan is in place for contacting authorities and informing key stakeholders, including management. We do not believe we are reasonably likely to be materially affected from cybersecurity threats, including as a result of previous incidents.


text: Sponsor, its parent Valkyrie Investments Inc., and their respective affiliates (collectively, "Valkyrie") have adopted an organizational wide cybersecurity program. The program is administered by the Chief Compliance Officer ("CCO") of Valkyrie Funds, LLC, an affiliate of the Sponsor and wholly-owned subsidiary of Valkyrie Investments Inc. Valkyrie's objective, in the development and implementation of this comprehensive cybersecurity program, is to create effective administrative, technical, and physical safeguards for the protection of personal information of the organization and its clients.


text: has designated the CCO to implement and maintain the cybersecurity program. The CCO may delegate any of the CCO's responsibilities to appropriate designees as long as the CCO remains primarily responsible for compliance oversight and administration. The CCO will is responsible for: Initial implementation of the cybersecurity program; employee education; testing of the cybersecurity program's safeguards;


text: the ability of each of our third party service providers to implement and maintain appropriate security measures for the personal information to which we have permitted them access, and requiring such third party service providers by contract to implement and maintain appropriate security measures.


text: the scope of the security measures in the cybersecurity program at least annually, or whenever there is a material change in our business practices that may implicate the security or integrity of records containing personal information.


text: the Trust has no directors, principal officers or employees, the Sponsor is responsible for managing cybersecurity risks to the Fund. The Sponsor has an information security program and policy in place, as mandated by new Regulation S-K Item 106. This program is designed to assess, identify, and manage material risks from cybersecurity threats. Regular reviews of cybersecurity and information technology plans are conducted for key service providers, as part of the Sponsor's disaster recovery and business continuity planning process. Additionally, the Sponsor evaluates whether any cybersecurity threats, including those resulting from previous incidents, have materially affected or are reasonably likely to materially affect the Trust and the Fund.

companyName: Hashdex Commodities Trust

ticker: DEFI


text: The Sponsor's Vice President of IT & Cybersecurity, Mr. Tiago DeMesquita, is responsible for identifying, assessing and managing the Sponsor's risks from cybersecurity threats. Mr. DeMesquita has over 5 years of experience in technology and cybersecurity. Mr. DeMesquita heads the Cybersecurity Committee of the Sponsor which meets regularly to evaluate strategies, governance, risk management, compliance, engineering and development, security operations, and incident management. In addition, the Sponsor maintains a cybersecurity insurance policy.


text: Our business strategy, results of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats.

companyName: Tonix Pharmaceuticals Holding Corp.

ticker: TNXP


text: During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, the ordinary course of our business, we use, store and process data including data of our employees, partners, collaborators, and vendors.


text: To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management program, which is comprised of a wide array of policies, standards, architecture, and processes. The cyber risk management program falls under the responsibility of our Director of Information Technology ("IT"), who has cross-functional expertise in IT, computer science, cyber security, and more than 20 years of experience. The IT Director leads a team of IT specialists with similar IT and cybersecurity backgrounds. Under the guidance of our IT Head, we develop, maintain, and evidence the policies, standards, and processes in a manner consistent with applicable legal requirements. We also utilize a variety of cybersecurity software from reputable vendors in cybersecurity.


text: We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems and ensure the effectiveness of our security controls. Our cybersecurity risk management program is intended to address applicable NIST 800-171 & CMMC requirements for our business. Our cybersecurity risk management program incorporates several components, including information security program assessments, continuous monitoring of critical risks from cybersecurity threats using automated tools, backup testing, periodic threat testing, and documented standards, policies, and procedures. We deploy a wide range of security tools across the environment, and implement access control policies to further limit access to data within the systems.


text: We periodically engage third parties to conduct risk assessments, including penetration testing, tabletops and other system vulnerability analyses. As a result of these assessments and testing, we have not identified any material cybersecurity risks and are constantly hardening our environment. Additionally, our program includes annual cybersecurity training for all employees. Our Board of Directors ("Board")


text: is responsible for the oversight of cybersecurity risk management. The Board delegates oversight of the cybersecurity risk management program to the Information Security Oversight Committee ("ISOC"). The Chief Financial Officer ("CFO"), who serves on ISOC, provides updates to the Audit Committee on our cybersecurity risk management program, including any critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards on a quarterly basis.


text: The CFO also notifies the Board and Audit Committee of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.


text: risk management is an important part of our overall risk management efforts. We maintain a cybersecurity program that is comprised of policies, procedures, controls and plans whose objective is to help us prevent and effectively respond to cybersecurity threats or incidents. Through our cybersecurity risk management process, we continuously monitor cybersecurity vulnerabilities and potential attack vectors to company systems. We maintain various measures to safeguard against cybersecurity threats such as monitoring systems, security controls, policy enforcement, data encryption, employee training, tools and services from third-party providers and management oversight to assess, identify and mitigate risks from cybersecurity threats. We conduct regular testing of these controls and systems including vulnerability scanning, penetration testing and simulating the execution of parts of our disaster recovery plan. All employees are required to pass a mandatory cybersecurity training course on an annual basis and we regularly conduct phishing simulations to train our employees on how to recognize phishing attempts. have implemented cybersecurity frameworks, policies and practices which incorporate industry-standards and contractual requirements.

companyName: CPI AEROSTRUCTURES INC

ticker: CVU


text: We also contractually flow cybersecurity regulatory requirements to our subcontractors as required by the Defense Federal Acquisition Regulation Supplement and other government agency specific requirements. These contractual flow downs include the requirement that our subcontractors implement certain information security controls. Additionally, we gather information and review the SOC-2 reports of certain third-parties who integrate with our systems, such as our payroll processor, managed solutions provider and software as a service providers on an annual basis to identify and manage risk. We continuously evaluate and seek to improve and mature our cybersecurity processes. We apply lessons learned from our defense and monitoring efforts to help prevent future attacks and utilize data analytics to detect anomalies and search for cyber threats. Additionally, our Internal Audit function regularly assesses our program effectiveness through audits of systems and processes to help maintain compliance with policies.


text: threats of all types, such as attacks from computer hackers, cyber criminals, nation-state actors, social engineering and other malicious internet-based activities, continue to increase. We believe that our current preventative actions and response planning provide adequate measures of protection against cybersecurity risks. While we have implemented measures to safeguard our information technology systems, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: board of directors has oversight of our strategic and business risk management and oversees management's execution of our cybersecurity risk management program. The board receives regular updates from management on our cybersecurity risks. In addition, management updates the board as necessary, regarding any material cybersecurity incidents, as well as incidents with lesser impact potential. Management is responsible for identifying, assessing, and managing cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), as well as senior leadership and the board, as appropriate.


text: Vice President of Human Resources & Administration ("VP HR&A") leads our cybersecurity program and is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response.


text: The VP HR&A manages a team of information technology professionals with broad experience, including in cybersecurity threat assessments and detection, mitigation technologies, incident response, insider threats and regulatory compliance.


text: cybersecurity program is regularly assessed through management self-evaluation and ongoing monitoring procedures to evaluate our program effectiveness, including assessments associated with internal controls over financial reporting as well as vulnerability management through active discovery and testing to validate patching and configuration.


text: oversight from our board of directors, our advisor and our senior management have implemented an enterprise-wide information security program designed to identify, protect against, detect, assess, respond to, and manage reasonably foreseeable cybersecurity risks and threats. Our cybersecurity processes have been integrated into our overall risk management system. To protect our information systems from cybersecurity threats, our advisor uses various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting and monitoring and detection tools. Our advisor also employs third parties to identify, prioritize, assess, mitigate and remediate information system risks; however, our advisor relies on such third parties to implement security programs commensurate with their risk, and our advisor cannot ensure in all circumstances that their efforts will be successful.

companyName: Moody National REIT II, Inc.


text: advisor regularly assesses risks from cybersecurity and technology threats and monitors our information systems for potential vulnerabilities. Our advisor uses a risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. Our advisor conducts regular reviews and tests of our information security program to evaluate the effectiveness of our information security program and improve our security measures and planning.


text: of Risks and Cybersecurity Governance combat internal risks to the security, confidentiality, and/or integrity of any electronic records containing personal information, and evaluating and improving, where necessary, the effectiveness of the current safeguards for limiting such risks, the Sponsor has identified the following risks that are present to its business as well as procedures to help mitigate those risks: Internal Threats There must be communication to employees on the detailed provisions of the cybersecurity program at onboarding and annually.


text: The results of these assessments are reported to our senior management. and our advisor's systems could potentially experience directed attacks intended to lead to interruptions and delays in our operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property. Any significant disruption to our or our advisor's operations or access to our or our advisor's systems could adversely affect our business and results of operation. Further, a penetration of our or our advisor's systems or a third-party's systems or other misappropriation or misuse of personal information could subject our advisor or us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See " Risk Factors - Operational risks, including the risk of cyberattacks, may disrupt our businesses, result in losses or limit our growth. "


text: advisor's Vice President - Communications leads our advisor's information security group responsible for overseeing our information security program. Our advisor's Vice President - Communications has over 18 years of industry experience.


text: Team members who support our advisor's information security program have relevant educational and industry experience. The teams, led by our advisor's Vice President – Communications, provide regular reports to our senior management and other relevant teams on various cybersecurity threats, assessments and findings. Our board of directors receives updates regarding cybersecurity issues as and when deemed necessary by our senior management.


text: advisor experienced a security incident in January 2023 that impacted the operability of its computer systems. Our advisor promptly reported the incident to federal law enforcement and restored the functionality of its computer systems. We are unaware of any misuse of our information.

stage1Category: Incident Disclosure


text: management oversees our annual enterprise risk assessment, where we assess key risks within our company, including security and technology risks and cybersecurity threats, oversees our cybersecurity risk, and receives regular reports from our Vice President - Communications on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.


text: Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats rely on the information technology and systems maintained by Pillar and their employees to identify and manage material risks from cybersecurity threats. Pillar takes various actions, and incurs significant costs, to maintain and manage the operation and security of information technology and systems, including the data maintained in those systems. We believe that Pillar's Director of Information Technology and his associates endeavor to evaluate and address cyber risks in alignment with our business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology and CIS Critical Security Controls frameworks. Since we rely on accounting, financial, operational, management and other information systems, including the Internet and third-party hosted services to conduct our operations, store personal and sensitive data, process financial information and results of operations for internal reporting purposes and comply with financial reporting, legal and tax requirements, we have processes and procedures in place to monitor the prevention, detection, mitigation and remediation of cybersecurity risks. These include, but are not limited to (i) maintaining a defined and practiced incident response plan;


text: (ii) employing appropriate incident prevention and detection safeguards; (iii) maintaining a defined disaster recovery policy and employing disaster recovery software, where appropriate; (iv) educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and (v) reviewing and evaluating new developments in the cyber threat landscape. Recognizing the complexity and evolving nature of cybersecurity risk, we engage with a range of external support in evaluating, monitoring and testing our cybersecurity management systems and related cyber risks.


text: Audit Committee of the Board of Directors oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from Pillar's Director of Information Technology regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, a detailed incident response plan is in place for contacting authorities and informing key stakeholders, including management. We do not believe we are reasonably likely to be materially affected from cybersecurity threats, including as a result of previous incidents.


text: Sponsor has adopted an organizational wide cybersecurity program. The program is administered by the Head of IT of the Sponsor (the "Head of IT"). The Sponsor's objective, in the development and implementation of this comprehensive cybersecurity program, is to create effective administrative, technical, and physical safeguards for the protection of personal information of the organization and its clients.


text: Sponsor has designated the Head of IT to implement and maintain the cybersecurity program. The Head of IT may delegate any of the Head of IT's responsibilities to appropriate designees as long as the Head of IT remains primarily responsible for compliance oversight and administration. The Head of IT will is responsible for: Initial implementation of the cybersecurity program; employee education; testing of the cybersecurity program's safeguards;


text: terminated employee's physical and electronic access to personal information must be immediately blocked. Such terminated employee shall be required to surrender all keys, IDs or access codes or badges, business cards, and the like, that permit access to the firm's premises or information. Moreover, such terminated employee's remote electronic access to personal information must be disabled; his/her voicemail access, e-mail access, internet access, and passwords must be invalidated. employees' user ID's and passwords must be managed in accordance to the Sponsor's password policy. are encouraged to report any suspicious or unauthorized use of customer information.


text: are prohibited from keeping open files containing personal information on their computer screen when they are not at their desks. Employees are responsible for locking computer screen when away from workspace. must not share login information with co-workers.


text: Sponsor will maintain reasonably up-to-date firewall protection (if applicable) and operating system security patches, reasonably designed to maintain the integrity of the personal information, installed on systems processing personal information.


text: Sponsor will maintain reasonably up-to-date versions of system security agent software which must include malware protection and reasonably up-to-date patches and virus definitions, the extent technically feasible, personal information stored on portable devices, such as laptops or tablets, must be password protected, as must all records and files transmitted across public networks or wirelessly, to the extent technically feasible. computer systems must be monitored for unauthorized use of or access to personal information.


text: Associated with Remote Client Access and Funds Transfer Requests the Sponsor does not provide its clients with online account access nor does process funds transfer requests. If the firm's business changes to allow for remote client access and funds transfer requests, the Sponsor will update the cybersecurity program accordingly by identifying the potential risks involved and implementing the appropriate safeguards to protect the client's personal information.


text: Sponsor periodically conducts risk assessments with vendors and other third parties that have access to the Firm's networks, customer data, and other sensitive information.


text: of Unauthorized Activity who believe their terminal or computer systems have been subjected to unauthorized activity, or has otherwise been improperly accessed or used, are required to report the situation to the Head of IT immediately to determine the course of action.


text: Sponsor takes the issue of security seriously. Firm employees who use the technology and information resources of the firm must be aware that they can be disciplined if they violate this policy. Upon violation of this policy, an employee may be subject to discipline up to and including discharge. The specific discipline imposed will be determined by a case-by-case basis, taking into consideration the nature and severity of the violation of the cybersecurity program, prior violations of the policy committed by the individual, state and federal laws and all other relevant information.


text: a case where the accused person is not a firm employee, the matter shall be submitted to the Head of IT. The Head of IT may refer the information to law enforcement agencies and/or prosecutors for consideration as to whether criminal charges should be filed against the alleged violator(s).


text: Company regularly evaluates cybersecurity risk from computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human error and technological errors.

companyName: SOLESENCE, INC.

ticker: SLSN


text: overall strategy in combatting known cybersecurity risks includes a variety of individual tactics, including: use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect data intrusions.


text: deployment of updates and patches as they are available and maintaining the current versions of major software to reduce the exposure to vulnerabilities. necessary, the use of third-party security experts if and when an incident is detected.


text: are not aware of having experienced any material cybersecurity incidents in 2024. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions.


text: management of cybersecurity threats is conducted by our information technology consultant which is charged with identifying and reporting threats to senior management, which then reports to the Board of Directors. Board of Directors is responsible for oversight of management's efforts to eliminate cybersecurity risks.