text: Cybersecurity Governance Our Board of Directors is primarily responsible for risk oversight and discharges its responsibility directly or indirectly through its committees. In general, our risk management is designed to be facilitated through a top-down and bottom-up communication structure whereby the Board and/or its committees provide oversight and direction, and management is charged with the day-to-day management of risks, regular assessment of the risk environment and regular reporting to the Board, which may include management reports and reports from outside advisors and consultants engaged by the Board, a specific committee or management, as appropriate. This overall risk management and oversight framework includes risks related to cybersecurity threats. Pursuant to its charter, the Audit Committee oversees senior management's risk management processes related to assessing, identifying and managing cybersecurity risks in an effort to, among other things, help align our risk exposure with our strategic objectives. The Audit Committee meets no less frequently than annually with our IS department to discuss, among other things, recent trends in cyber risks, cybersecurity incidents, if any, and our cybersecurity defense strategy to protect against cyber-attacks and intrusions. These discussions with the Audit Committee are led by our IS Leaders and senior management. The Audit Committee provides regular updates to the full Board of Directors on matters under its purview, including risk management and cybersecurity matters.


text: Our information technology ("IT") networks and related systems are essential to the efficient operation of our business and our ability to perform day-to-day operations (including managing our building systems and accounting for our business operations). In some cases, our clients' operations depend on our building systems. The risk of a security breach, incident, compromise or disruption, particularly through cyber-attack or cyber intrusion, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. Like other businesses, we have been, and expect to continue to be, subject to attempts at unauthorized access of our network, mishandling or misuse, computer viruses or malware, cyber-attacks and intrusions and other events of varying degrees. To date, these events have not, individually or in the aggregate, materially affected our operations or business. In addition, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors" for additional discussion of the cybersecurity risks related to our Company.

companyName: BXP, Inc.

ticker: BXP

secItem: Item 1C


text: Cybersecurity Risk Management & Strategy We have implemented and maintain a cybersecurity program that is designed to identify, assess and manage risks from cybersecurity threats and was established by reference to the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The primary goal of our cybersecurity program is to prevent cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. We aim to take an active approach to monitoring and evaluating our cybersecurity threat environment and risk profile as part of our cybersecurity program, which is administered by our information systems ("IS") department, led by our Senior Vice President, Chief Technology Officer ("CTO") and Senior Vice President, Chief Information Officer ("CIO," together with our CTO, "IS Leaders"). Our IS Leaders are primarily responsible for the direction and implementation of technology, applications and security at BXP. Our CTO has extensive technology and program management experience with approximately 40 years of technology experience, 26 years of which have been with BXP and a total of 30 years with publicly-traded REITs. In January 2024, our IS leadership expanded to include our CIO, who has 30 years of technology experience developed across multiple industries, including commercial real estate, in guiding organizations through strategic initiatives that span technology, cybersecurity, and digital transformations.


text: We maintain written information security policies and procedures, including a Cybersecurity Incident Response Plan ("CIRP") for incidents involving potential or actual compromises of information security. Our CIRP is overseen by the cyber executive response team, which is chaired by our Vice President, Risk Management and includes representatives from our IS and legal departments. In the event of a cybersecurity incident, we have implemented procedures to (i) mobilize third-party subject matter experts and (ii) notify executive leadership and the Audit Committee and/or the full Board of Directors, in each case, as appropriate.


text: As part of our overall cybersecurity program, we also conduct: • Regular assessments of our cybersecurity program. We assess our cybersecurity program against the NIST Cybersecurity Framework through annual internal assessments, and, every two years, we engage a third-party consultant to conduct an additive cyber assessment. These assessments review, among other things, our IT security measures and activities for alignment with the NIST Cybersecurity Framework. • Periodic penetration testing & vulnerability assessments. On an annual basis, we engage a third-party consultant to conduct two penetration tests per year. We also conduct vulnerability assessments on a monthly basis. • Regular cybersecurity awareness trainings & simulations. We conduct cybersecurity awareness training for employees and primary on-site providers during onboarding, and thereafter, multiple times per year, and we conduct regular phishing simulations in an effort to raise awareness of spoofed or manipulated electronic communications and other security threats, as well as annual tabletop simulations.


text: In addition, our internal audit function integrates the assessment and identification of cybersecurity-related risks into our annual overall enterprise risk assessment ("ERA"). The ERA process is designed to assess and identify the key risks that management believes could adversely impact our business operations or impede the achievement of our business objectives, which includes an assessment of our cybersecurity program and the cybersecurity-related risks that we face. To the extent the ERA identifies a heightened cybersecurity-related risk(s), we have implemented a process for the risk(s) to be presented to the Audit Committee and the full Board of Directors, as appropriate.


text: We utilize certain third-party service providers to perform select functions. These third-party service providers also face cybersecurity threats, and a cybersecurity incident impacting any of our third-party service providers could also indirectly affect our operations, performance and results of operations. We have a data security committee, consisting of members from various BXP departments, including IS, legal and risk management, that meets periodically to assess, identify and manage cybersecurity risks related to certain third-party service providers and to protect our critical financial and sensitive business information, as well as personally identifiable information (collectively, "Sensitive Information"). The data security committee has implemented processes for evaluating the risk profile of those service providers that handle or have access to Sensitive Information, which informs applicable contractual obligations with these service providers. This evaluation, which occurs prior to onboarding, is designed to consider the nature of the services to be provided, the level of sensitivity and quantity of the information that the service provider handles or has access to, and the identity of the service provider.


text: Risks from Cybersecurity Incidents To our knowledge, Koil Energy has not been subject to cybersecurity incidents that have materially affected, or are reasonably likely to materially affect the Company, its operations or financial condition.

companyName: Koil Energy Solutions, Inc.

ticker: KLNG


text: Our cybersecurity processes include: • Basic security awareness online training for personnel with company email, on an annual basis; • Phishing tests for personnel with company email, on not less than an annual basis; • Reviews of certain third-party vendors' information security programs (as discussed below); • Consultation with external advisors regarding opportunities and enhancements to strengthen our practices and policies, on an ad hoc basis; • Electronic monitoring of the majority of our technology environments to identify cybersecurity events; • Periodic assessments of existing technology hardware configurations, patches, security and lifecycle; • Periodic assessments, in consultation with software providers, of existing software versions, configurations, patches and updates; and • Periodic assessments of data management and handling, including data use and access reviews. Certain information technology general controls are reviewed and tested as part of our internal control over financial reporting.

companyName: Cronos Group Inc.

ticker: CRON

stage1Category: Risk Management Process

stage1Method: unanimous


text: We use third-party services to assist with penetration testing, security incident monitoring, incident response preparation, end point protection, and security awareness online training.


text: Before engaging third-party service providers to whom we grant access to our information technology systems, we may review their information security programs, depending on the feasibility of such review and our assessment of the level of risk the third-party service provider poses to our business operations and our information technology and financial reporting systems. We determine risk level based on a set of internally developed criteria. We do not, however, review the information security programs of all third-party vendors. Where feasible, we also conduct periodic reviews (typically annual) of certain third-party service providers, particularly service providers of financial, financial reporting and accounting systems, depending on our assessment of the level of risk to our business operations and our information technology and financial reporting systems.

stage1Category: Third-Party Risk


text: To date, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a materially adverse effect on our business, including our business strategy, results of operations and financial condition. However, there can be no assurance that our processes and procedures will prevent or timely detect a cybersecurity incident. For more information regarding risks from cybersecurity threats, see the section entitled "Risk Factors—Risks Relating to Our Products—Risks Relating to Production and Distribution of Products."

stage1Category: Strategy Integration

stage1Method: majority


text: In fiscal year 2024, as part of our overall enterprise risk management process, our Board received a report on our program for assessing, monitoring and mitigating cybersecurity risks and has delegated oversight of such program to our Audit Committee. Going forward, the Audit Committee will receive periodic reports on our program for assessing, monitoring and mitigating cybersecurity risks. In addition, as part of its overall responsibility for overseeing the adequacy of the Company's internal control over financial reporting, our Audit Committee receives periodic reports about our financial reporting information system controls and security.

stage1Category: Board Governance


text: Our Information Systems department, in addition to managing our general information technology systems, is also responsible for managing our enterprise-wide cybersecurity processes. Personnel in our Information System department collectively have decades of experience in information security, information technology and cybersecurity operations. Our Information Systems department monitors, and receives notifications of, potential cybersecurity incidents detected through automated detection and monitoring tools. In the event we discover a material cybersecurity incident, Information Systems personnel reports such incident to our Chief Financial Officer, who then reports to our Chief Executive Officer and the Audit Committee, as appropriate. We do not currently have a Chief Information Security Officer or other senior security officer of a similar title.

stage1Category: Management Role


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Vice President, Digital and Information Technology, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Verona Pharma plc

ticker: VRNA


text: Our cybersecurity processes include: • Basic security awareness online training for personnel with company email, at least annually; • Phishing tests for personnel with company email on a periodic basis; • Reviews of certain third-party vendors' information security programs (as discussed below); • Consultation with external advisors regarding opportunities and enhancements to strengthen our practices and policies, on an ad hoc basis; • Electronic monitoring of the majority of our technology environments to identify cybersecurity events, including the use of a security information and event management system; • Periodic assessments of existing technology hardware configurations, patches, security and lifecycle; • Periodic assessments, in consultation with software providers, of existing software versions, configurations, patches and updates; and • Periodic assessments of data management and handling, including data use and access reviews. Certain information technology general controls are reviewed and tested as part of our internal control over financial reporting.


text: We rely on third-party services for penetration testing, security incident monitoring, managing our enterprise-wide cybersecurity processes, incident response preparation, end point protection, and security awareness online training.


text: To date, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a materially adverse effect on our business, including our business strategy, results of operations and financial condition. However, there can be no assurance that our processes and procedures will prevent or timely detect a cybersecurity incident. For more information regarding risks from cybersecurity threats, see "Risk Factors—Risks Relating to Our Products—Risks Relating to Production and Distribution of Products."


text: Our Board has delegated oversight of our program for assessing, monitoring and mitigating cybersecurity risks to our Audit Committee. Our Audit Committee receives periodic reports on our program for assessing, monitoring and mitigating cybersecurity risks. In addition, as part of its overall responsibility for overseeing the adequacy of the Company's internal control over financial reporting, our Audit Committee receives periodic reports about our financial reporting information system controls and security.


text: Our Information Systems department, in addition to managing our general information technology systems, is also responsible for managing our enterprise-wide cybersecurity processes. Our Information Systems department relies on a third-party managed security service provider ("MSSP") to implement, manage and monitor our cybersecurity systems. Personnel in our Information Systems department, together with personnel at the MSSP, collectively have decades of experience in information security, information technology and cybersecurity operations. The MSSP monitors and receives notifications of potential cybersecurity incidents detected through automated detection and monitoring tools, which are communicated to personnel within our Information Systems department. In the event we discover a material cybersecurity incident, Information Systems personnel reports such incident to our Chief Strategy Officer, who then reports to our Chief Executive Officer and the Audit Committee, as appropriate. We do not currently have a permanent Chief Information Security Officer or other senior security officer of a similar title and rely significantly on the MSSP for management of enterprise-wide cybersecurity processes.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our management team, including our Vice President, Digital and Information Technology and Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes decades of managing public pharmaceutical companies, including their related information technology and cybersecurity risk management programs.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • an information technology team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external advisors and service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, contractors, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and alignment with the broader corporate business continuity plan; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program includes: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • an information technology team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external advisors and service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees and contractors, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and alignment with the broader corporate business continuity plan; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management.

companyName: Fortive Corp

ticker: FTV


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Audit Committee the effectiveness of the Company's technology security, capabilities for disaster recovery, data protection, cyber threat detection and cyber incident response and management of technology-related compliance risks.

companyName: HERTZ GLOBAL HOLDINGS, INC

ticker: HTZ


text: Tim Langley-Hawthorne is our CIO and has served in this role since October 2021. Mr. Langley-Hawthorne has 11 years of experience in senior technology roles with cybersecurity responsibilities. Prior to joining the Company, Mr. Langley-Hawthorne served as the Chief Information Officer at Hitachi Vantara, a hi-tech subsidiary of Hitachi Ltd. Prior to Hitachi, Mr. Langley-Hawthorne held various executive technology and operations positions at Western Union, as well as various IT, consulting and commercial roles at Information Services Group, Electronic Data Systems, and IBM Australia. Mr. Langley-Hawthorne holds an Executive MBA from Pepperdine University and a Bachelor of Commerce degree from the University of Melbourne, Australia.


text: We are currently completing the search for a new CISO, following the voluntary departure of the incumbent CISO. An accomplished information technology leader with 29 years of experience in the field and 20 months of experience with the Company is currently serving in the role on an interim basis.


text: operations or financial condition in the future. See "Risks Related to Information Technology, Cybersecurity and Privacy" in Item 1A, "Risk Factors" of this 2024 Annual Report.

stage1Category: None/Other


text: Our Board oversees significant risks facing the Company. For some categories of risk, the Board has empowered a committee to provide more focused oversight. In the case of cybersecurity and technology risk more broadly, the Board's Audit Committee has that responsibility.


text: The Audit Committee is informed of risks from cybersecurity threats through regular reports from management and, from time to time, third parties that assist management in managing cybersecurity threats. The Audit Committee also receives regular reports on how management identifies, assesses and manages cybersecurity and broader technology risks. The Audit Committee reviews these reports and discusses them with management.


text: The Audit Committee provides a regular report to the full Board on key aspects of management's presentations on cybersecurity and broader technology risks. All members of the Board have access to written cybersecurity reports that are provided to the Audit Committee. Audit Committee conversations on cybersecurity topics are open to any member of the Board.


text: While our Board and Audit Committee oversee risk, our senior leadership is responsible for identifying, assessing and managing our exposure to risk, including material risks from cybersecurity threats. Direct accountability of our cybersecurity program is housed within our Information Technology organization, which is led by our Chief Information Officer ("CIO"). Our CIO has served in this role since October 2021. Our CIO has 12 years of experience in senior technology roles with cybersecurity responsibilities. Prior to joining the Company, our CIO held various executive technology and operations positions, as well as various IT, consulting and commercial roles. Our CIO holds an Executive MBA and a Bachelor of Commerce degree.


text: Our Chief Information Security Officer ("CISO") is the individual that reports to our CIO and provides day-to-day oversight of our cybersecurity program; our CISO additionally leads our cybersecurity program's ongoing evolution. Our CISO is responsible for assessing and managing risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity threats. Our CISO oversees direct reports and leverages a multi-disciplinary team that regularly communicates with respect to our prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The team consists of individuals that represent various organizations and departments across the Company who have knowledge, skills and expertise to respond to a cybersecurity incident. Our CISO coordinates with the Company's disclosure teams relating to potentially material cybersecurity incidents, attends the Company's disclosure committee meetings, and regularly discusses with the Audit Committee the effectiveness of the Company's technology security, capabilities for disaster recovery, data protection, cyber threat detection and cyber incident response and management of technology-related compliance risks. Our CISO has served in this role since March 2024. Our CISO has over 11 years of experience in senior technology roles with cybersecurity responsibilities, and more than 20 years of experience in technology and security. Our CISO holds an MBA; in addition, he holds a Bachelor of Computer Science degree and a Bachelor of Mathematics degree.


text: Risk Management and Strategy We rely on information technology and data to operate our business effectively and recognize the importance of implementing and maintaining cybersecurity systems and processes that allow us to protect the confidentiality, integrity and availability of our information systems and the data residing within them.

companyName: Permian Resources Corp

ticker: PR


text: In order to monitor our information technology systems and data and to identify potential threats to such, we maintain cybersecurity risk assessment and management programs. Such programs include, but are not limited to, annual security penetration tests performed both externally and internally, bi-annual security assessments against cybersecurity frameworks, continuous vulnerability scanning, incident response processes, monthly and annual security awareness and simulated phishing trainings for our employees, and various system alert monitoring and screenings.


text: As part of our cybersecurity risk management process, we conduct simulated cybersecurity incidents to ensure that we are prepared to respond to such incidents and to highlight any areas for potential improvement in our cyber incident preparedness. We have a cybersecurity incident management policy and response plan in place. Cybersecurity breaches are evaluated by our information technology teams, which includes our VP of Information Technology. If an incident is deemed to be a breach, it is communicated to our legal department and management for evaluation, including whether the breach requires communication to the Board of Directors or investors through a relevant public filing.


text: Our cybersecurity risk management is primarily the responsibility of our VP of Information Technology and information technology teams. Our VP of Information Technology has over 25 years of industry experience in the field of information systems and oversees our risk assessment programs, remediation of known risks, processes for the regular monitoring of our information systems and our employee cybersecurity training programs. Our Board of Directors also oversees cybersecurity risk through our Audit Committee who reviews periodic reporting and updates regarding our risk management associated with cybersecurity.


text: We have not experienced any cybersecurity incidents that have had a material impact on our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, refer to Risk Factors under Part I, Item 1A of this Annual Report.


text: In order to monitor our information technology systems and data and to identify, assess and manage potential threats to such, we maintain cybersecurity risk assessment and management programs. As part of such programs, we endeavor to conduct annual security penetration tests both externally and internally, bi-annual security assessments against cybersecurity frameworks, continuous vulnerability scanning and monthly and annual security awareness and simulated phishing trainings for our employees. We have also implemented incident response processes and various system alert monitoring and screenings. Our cybersecurity risk management processes are integrated into our broader risk management program.


text: As part of our cybersecurity risk management process, we conduct simulated cybersecurity incidents to ensure that we are prepared to respond to such incidents and to highlight any areas for potential improvement in our cyber incident preparedness. We have a cybersecurity incident management policy and response plan in place. Cybersecurity breaches are evaluated by our information technology teams, which includes our Vice President and Chief Information Officer. If an incident is deemed to be a breach, it is communicated to our legal department and management for evaluation, including whether the breach requires communication to the Audit Committee or the Board of Directors or investors through a relevant public filing.


text: Our cybersecurity risk management is primarily the responsibility of our Vice President and Chief Information Officer and the information technology teams he leads. Our Vice President and Chief Information Officer has 25 years of industry experience in the field of information systems, including information security and risk management. He oversees our risk assessment programs, remediation of known risks, processes for the regular monitoring of our information systems and our employee cybersecurity training programs. Our Board of Directors also oversees cybersecurity risks through the Audit Committee, which receives and assesses periodic reports and updates regarding our cybersecurity risk management from management and our Vice President and Chief Information Officer and then relays them to the Board of Directors as needed.


text: Impact of Risks from Cybersecurity Threats As of the date of this report, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations and financial condition. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents, material or otherwise, remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity incident will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. For more information about the cybersecurity risks we face, refer to Risk Factors under Part I, Item 1A of this Annual Report.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: Hancock Park Corporate Income, Inc.


text: Cybersecurity Risk Management and Strategy Our process for assessing, identifying, and managing material risks associated with cybersecurity threats, including risks related to disruptions to our operations, compromise of our intellectual property rights, data privacy, litigation and other legal liability and reputational impacts, is an important component of our overall enterprise risk management process. As part of this process, both corporate and operating company leaders collaborate with subject matter experts to identify and assess cybersecurity threats and implement relevant countermeasures. In addition to this component of our overall risk management process, we have separate cybersecurity-specific risk assessment and management processes that are managed centrally and executed at both the corporate and operating company levels. These processes, including corresponding controls, are designed to help us protect against, detect, and respond to cybersecurity threats, and to manage business continuity, the availability of critical systems, product security, disclosure controls and procedures, escalation, and regulatory compliance in the event of any cybersecurity disruption.


text: As part of our cybersecurity controls and processes: • we have designed our cybersecurity program based on the National Institute of Security and Technology ("NIST") framework, Generally Accepted Privacy Program ("GAPP") guiding principles, and ISO 27001/2 standards; • our cybersecurity team, led by our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") coordinates with our privacy and information governance team within our legal department to help ensure compliance with applicable regulatory and reporting requirements; • the CIO and CISO undertake an annual review of the cybersecurity strategy and initiatives for Fortive and each of the operating companies, with monthly reviews of performance relative to strategic initiatives with the Chief Executive Officer ("CEO") and the other executive officers; • the CIO and CISO participate in product design efforts with operating company leaders to enhance our product security; • through the compliance training program, we conduct mandatory cybersecurity management, data privacy and incident training for all employees; • we conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to possible threats; • through policy, practice and contract provisions, we require employees, as well as third-party vendors who process data, to treat customer and other personal information and data with care and in compliance with regulations; • we run tabletop exercises conducted by leading third-party cybersecurity experts, with involvement by the broader IT team, legal team, communications team, executive management team, and the Board, to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • we conduct regular network and endpoint monitoring, vulnerability assessments, and penetration testing designed to improve our information systems; • we review and update, and provide training, on cybersecurity incident response plans, business continuity plans, and cyber incident escalation plans, including the involvement of our Disclosure Committee (which includes our CISO as a regular member); • as part of that cyber incident escalation plan, our Disclosure Committee reviews cybersecurity incidents to assess materiality and consider disclosure requirements; • the CISO meets with the information security teams at the operating companies on a monthly basis, or as needed, to review escalated items, compliance with incident response plans, and performance against strategic targets; • the CIO and the CISO meet with the CEOs of our operating segments and the presidents of our operating companies to discuss IT strategies, updates, and initiatives, including those related to cybersecurity; • the CIO and the CISO meet with the Audit Committee on a quarterly basis and the full Board on an annual basis to provide updates on the cybersecurity program, including controls and processes, strategies, achievements, risks, and recent incidents;


text: • the CIO and the CISO also meet with the full Board on an annual basis as part of the overall enterprise risk management review; and • the CISO, as a member of the Disclosure Committee, meets with other members of the Disclosure Committee to discuss materiality and disclosure with respect to cybersecurity matters.


text: As part of the above processes, we regularly engage with assessors, consultants, auditors, and other third parties, including by regularly having independent cybersecurity experts conduct tabletop exercises, conduct penetration tests, and review our cybersecurity program to help identify areas for continued focus, improvement and compliance.


text: In addition, our processes also address cybersecurity threat risks associated with our use of third-party software and service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on critical third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties to agree by contract to manage their cybersecurity risks in specified ways to be subject to cybersecurity audits, which we may conduct as appropriate.


text: To date, we believe that the risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Refer to the discussions under the headings "Significant disruptions in, or breaches in security of, our information technology systems have adversely affected, and in the future could adversely affect, our business" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, and "Overview-Other Matters" included as part of our Management's Discussion and Analysis of Financial Condition and Results of Operations ("MD&A") at Item 7 of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management.


text: Our Audit Committee is responsible for the oversight of risks from cybersecurity threats and provides regular reports to the entire Board. In addition, at least annually, the entire Board receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards predetermined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Board generally receives materials indicating current and emerging material cybersecurity threat risks and describing the company's ability to mitigate those risks, and discusses such matters with our CIO and CISO. Material cybersecurity threat risks are also considered during separate Board meeting discussions of overall key enterprise risks, operational budgeting, crisis management planning, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CIO and our CISO. Our CIO and our CISO have over 30 years and 25 years, respectively, of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and implementing business continuity planning and incident response plans. Our CIO and CISO each hold several degrees and certifications relevant to their roles. Our CIO and our CISO are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, oversight of the entire IT function, including at Fortive Corporation and the IT leaders at our operating companies.


text: Our CIO and our CISO report to the Audit Committee and to the full Board about cybersecurity threat risks and other cybersecurity related matters. In addition, under our escalation policy, following the detection of a potentially significant cybersecurity incident, our CISO and our General Counsel escalate to the Executive Officers, core members of the Disclosure Committee, Chair of the Audit Committee and the Chair of the Board initially, and then to the entire Board, as appropriate.


text: To date, we believe that the risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Refer to the discussions under the headings "Significant disruptions in, or breaches in security of, our information technology systems have adversely affected, and in the future could adversely affect, our business" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Okta, like other companies, is subject to a wide variety of cybersecurity attacks on its systems and networks on an ongoing basis and with increasing sophistication. In addition to threats from traditional computer "hackers," malicious code (such as malware, viruses, worms and ransomware), employee or contractor theft or misuse, password spraying, phishing and denial-of-service attacks, Okta and its third-party service providers now also face threats from sophisticated nation-state actors and organized crime groups who engage in attacks (including advanced persistent threat intrusions). In the face of this threat landscape, Okta remains committed to protecting its systems, internal networks and its customers' systems, and the information that it and they store and process.

companyName: Okta, Inc.

ticker: OKTA


text: Okta has an established cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of its critical systems, internal networks and information. This program implements policies, processes and controls to respond to cybersecurity threats and mitigate business impacts. Okta's board of directors (the "board") has delegated to the cybersecurity risk committee of the board (the "cybersecurity risk committee") oversight responsibility of the cybersecurity risk management program, which includes a cybersecurity incident response plan.


text: Okta devotes significant resources, including human and financial capital, to create security measures, configuration policies and response plans to address cybersecurity threats. However, as a well-known provider of identity and security solutions, Okta is a particularly attractive target for such threats. For additional information related to these risks, see " Risk Factors " included under Part I, Item 1A of this Annual Report on Form 10-K. In the past we have experienced cybersecurity incidents, and we cannot anticipate when or the extent to which cybersecurity breaches will materially affect Okta or its customers' use of Okta's platform in the future. To date we have not identified any prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance that Okta's cybersecurity risk management program and processes, including its policies, controls or procedures, will be fully implemented, complied with or effective in protecting its systems and information.


text: Cybersecurity Risk Management and Strategy Cybersecurity is essential for Okta. Our cybersecurity strategy is to develop a consistent framework of security controls that can apply to all business functions. To execute on this strategy, we integrate cybersecurity risk management into our broader enterprise risk management program. We also take a cross-functional approach to cybersecurity risk management by engaging teams across the business, including security, technical operations, engineering, IT, customer support, legal and communications, to implement shared processes for identifying, assessing and managing key cybersecurity risks.


text: We design and assess our cybersecurity risk management program against the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Framework"). This does not imply that Okta satisfies any particular specifications or requirements, only that we use the NIST Framework to guide our efforts to improve our security posture.


text: Our cybersecurity risk management program consists of technical and organizational safeguards aimed at protecting the confidentiality of our systems and the Okta platform. From time to time, we engage external consultants and advisors to perform independent assessments and testing of our program, or otherwise assist with aspects of our program and security controls.


text: Key features of our cybersecurity risk management program include: • Designated security risk team. Our security risk management team is responsible for maintaining Okta's cybersecurity risk management framework and risk assessments and tracking risk mitigation efforts. This team, together with our enterprise risk management team, monitors and regularly reports on our cybersecurity risk profile. Our internal audit team partners with these teams to provide input on the overall effectiveness of Okta's security risk governance and management processes. • Risk assessments. We periodically perform enterprise-wide assessments to stay informed about critical security risks. Okta's functional teams also assess risks associated with their specific activities, with supervision by the security risk management team. Functional team risk assessments follow an established framework that includes information-gathering from internal and external sources to identify risks, and evaluating the adequacy of controls to mitigate those risks. We have a management-level risk oversight committee, led by internal audit and security risk management personnel, that meets quarterly with other internal business leaders to review the results of these enterprise-wide and functional team risk assessments and evaluate the adequacy of any proposed mitigation plans. • Incident response planning. Okta's cybersecurity incident response plan outlines the processes and procedures for responding to, remediating and resolving a security incident, and defines the roles and responsibilities of Okta personnel in responding to such incidents. • Security awareness training. We require our employees and contractors to complete general cybersecurity awareness training at least annually. These training sessions advise on how to protect Okta, our information systems and data, as well as our customers' systems and data. From time to time we may also require supplemental cybersecurity training for certain members of our workforce depending on their job responsibilities. • Third-party risk management. We require high risk third-party vendors, suppliers and service providers to undergo a cybersecurity risk assessment prior to contracting with Okta. Certain third parties are monitored and reassessed on an ongoing basis, depending on their level of risk or in the event of changes to their products or services.


text: Cybersecurity Governance Okta's board oversees Okta's enterprise risk management program, of which cybersecurity is a critical component. To facilitate the board's supervision of cybersecurity matters, the board formed a cybersecurity risk committee. Among other responsibilities, the cybersecurity risk committee oversees Okta's cybersecurity program.


text: The cybersecurity risk committee receives regular updates from Okta's chief security officer (the "CSO") on our cybersecurity program. In addition, management updates the cybersecurity risk committee, as appropriate, regarding cybersecurity incidents. The cybersecurity risk committee reports to the board on its activities. In addition to receiving reports from the cybersecurity risk committee, the board periodically receives cyber risk management program briefings directly from the CSO. Additionally, the audit committee of the board receives cybersecurity updates as part of the audit committee's oversight of Okta's enterprise risk management program.


text: Our management team, including the CSO, is responsible for assessing and managing our risks from cybersecurity threats. The CSO partners with the security, technical operations, legal, internal audit, engineering and product development teams to supervise both our cybersecurity program and our retained external cybersecurity consultants, and to stay informed on Okta's security and the overall security landscape. Our current CSO brings over 20 years of cybersecurity and risk management experience to his work at Okta, having held numerous security leadership positions in highly-regulated industries such as finance. Prior to joining Okta, the CSO was Senior Vice President and Chief Security Officer at Symantec Corporation, a leading cybersecurity company, where he had global oversight responsibility for all cybersecurity and physical security programs. His experience delivering cybersecurity at scale extends internationally, and includes security and risk management roles at companies in Australia, the United Kingdom and the United States. Our security team includes individuals with experience across a broad range of cybersecurity areas, including product security; cloud security; infrastructure security; security monitoring and incident response; identity and access management; vulnerability management; and governance, risk and compliance.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security and technical personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our technical environment.


text: Cybersecurity risk management is an important part of our overall risk management efforts. Okta, Inc., like other companies, is subject to a wide variety of cybersecurity attacks on its systems, networks and data on an ongoing basis and with increasing sophistication. Given the evolving cybersecurity threat landscape facing us and our third-party service providers, we remain committed to protecting our systems, internal networks and our customers' systems, and the information that we and they store and process.


text: We have an established cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of Okta, Inc.'s critical systems, internal networks, and information. This program implements policies, processes and controls to respond to cybersecurity threats and mitigate business impacts. Our board of directors (the "board") has delegated to the cybersecurity risk committee of the board (the "cybersecurity risk committee") oversight responsibility of the cybersecurity risk management program, which includes a cybersecurity incident response plan.


text: We devote significant resources, including human and financial capital, to create security measures, configuration policies and response plans to address cybersecurity threats. However, as a well-known provider of identity and security solutions, Okta, Inc. is a particularly attractive target to threat actors. For additional information related to these risks, see " Risk Factors " included under Part I, Item 1A of this Annual Report on Form 10-K. In the past we have experienced cybersecurity incidents, and cannot anticipate when or the extent to which cybersecurity incidents will materially affect us or our customers' use of our platforms in the future. To date we have not identified any prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite our efforts, we cannot eliminate all risks related to cybersecurity threats or incidents. There can be no assurance that Okta, Inc.'s cybersecurity risk management program and processes will be fully implemented. Even if implemented, they may not be complied with or may not effectively protect our systems and information or those of our customers.


text: Cybersecurity Risk Management and Strategy Cybersecurity is a top priority for Okta, Inc. Our cybersecurity strategy is to develop a consistent framework of security controls that can apply to all business functions. To execute on this strategy, we integrate cybersecurity risk management into our broader enterprise risk management program. We also take a cross-functional approach to cybersecurity risk management by engaging teams across the business, including security, technical operations, engineering, IT, customer support, legal and communications, to implement shared processes for identifying, assessing, and managing key cybersecurity risks.


text: We design and assess our cybersecurity risk management program against the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Framework"). This does not imply that Okta, Inc.'s cybersecurity risk management program satisfies any particular specifications or requirements, only that we use the NIST Framework to guide our efforts to improve our security posture. Certain of our Okta Platform product offerings have attained multiple security certifications, the details of which are described in "Our Technology" under Part I, Item I of this Annual Report on Form 10-K.


text: Our cybersecurity risk management program consists of technical and organizational safeguards aimed at protecting the confidentiality of our systems and platforms. From time to time, management will engage external consultants and advisors to perform independent assessments and testing of the cybersecurity risk management program, or otherwise assist with aspects of the program and security controls.


text: Key features of our cybersecurity risk management program include: • Designated security governance, risk and compliance team. Our security governance, risk and compliance team is responsible for maintaining Okta, Inc.'s cybersecurity risk management framework and risk assessments, and for tracking risk mitigation efforts. This team, together with our enterprise risk management team, monitors and regularly reports on our cybersecurity risk profile. Our internal audit team partners with these teams to provide input on the overall effectiveness of Okta, Inc.'s security risk governance and management processes. • Risk assessments. We periodically perform security risk assessments to stay informed about relevant security risks. Functional teams across the business assess risks associated with their specific activities, following an established framework with supervision by the security governance, risk and compliance team. Okta, Inc. has a management-level risk oversight committee, led by internal audit and security risk management personnel, that meets quarterly with other internal business leaders to review the results of these security risk assessments and evaluate the adequacy of any proposed mitigation plans. • Incident response planning. Our cybersecurity incident response plan outlines the processes and procedures for responding to, remediating and resolving a security incident, and defines the roles and responsibilities of company personnel and third-party service providers who may assist in responding to such incidents. In fiscal 2025, we conducted tabletop exercises involving multiple operational teams, as well as an executive preparedness simulation with members of our management team, to educate personnel on their roles in response scenarios. • Security awareness training. We require our employees and contractors to complete general cybersecurity awareness training at least annually. These training sessions advise on employee responsibilities and relevant policies designed to protect us, our information systems and data, as well as our customers' systems and data. From time to time we may also require supplemental cybersecurity training for certain members of our workforce depending on their job responsibilities. • Third-party risk management. We require high risk third-party vendors, suppliers and service providers to undergo a cybersecurity risk assessment prior to contracting with Okta, Inc. Certain third parties are monitored and reassessed on an ongoing basis, depending on their level of risk or in the event of changes to their products or services.


text: Cybersecurity Governance Our board oversees Okta, Inc.'s enterprise risk management program, of which cybersecurity is an important component. To facilitate the board's supervision of cybersecurity matters, the board formed the cybersecurity risk committee. Among other responsibilities, the cybersecurity risk committee provides oversight over the effectiveness of Okta, Inc.'s cybersecurity program.


text: The cybersecurity risk committee receives regular updates on our cybersecurity program from our chief security officer (the "CSO"). In addition, management updates the cybersecurity risk committee, as appropriate, regarding cybersecurity incidents. Our cybersecurity risk committee reports to the board on its activities. In addition to receiving reports from the cybersecurity risk committee, our board periodically receives cyber risk management program briefings directly from the CSO. Additionally, the audit committee of the board (the "audit committee") receives regular cybersecurity updates as part of the audit committee's oversight over our enterprise risk management program.


text: Our management team, including the CSO, is responsible for assessing and managing our risks from cybersecurity threats. The CSO partners with the security, technical operations, legal, internal audit, engineering and product development teams to supervise both our cybersecurity program and our retained third-party cybersecurity consultants, and to stay informed on security at Okta, Inc. and the overall security landscape. Our current CSO brings over 20 years of cybersecurity and risk management experience to his work at Okta, Inc., having held numerous security leadership positions in highly-regulated industries such as finance. His experience delivering cybersecurity at scale extends internationally, and includes security and risk management roles at companies in Australia, the United Kingdom and the United States. The Okta, Inc. security team includes individuals with experience across a broad range of cybersecurity areas, including product security; cloud security; infrastructure security; security monitoring and incident response; identity and access management; vulnerability management; and governance, risk and compliance.


text: Okta, Inc.'s management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security and technical personnel; threat intelligence and other information obtained from governmental, public or private sources, including third-party consultants engaged by us; and alerts and reports produced by security tools deployed in our technical environment.


text: Our cybersecurity risk management program is dependent on the use of external service providers to assist with our information technology security controls. Our cybersecurity policy includes a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and a third-party risk management process for relevant third-party service providers.

companyName: Highlands REIT, Inc.


text: Tenable recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data and our exposure management solutions. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, our critical data (including without limitation intellectual property, confidential information that is proprietary, strategic or competitive, customer vulnerability data, and information systems data), and exposure management solutions.

companyName: Tenable Holdings, Inc.

ticker: TENB


text: Our Information Security function is overseen by our Chief Security Officer, or CSO, and is supported by our Chief Information Officer, Product Engineering Team Lead, Chief Legal Officer, or CLO, and Head of Global Privacy. Our information security function is responsible for identifying, assessing and managing cybersecurity threats and risks and works to monitor and evaluate our threat environment and risk profile using various methods. These methods include conducting vulnerability assessments and threat assessments in certain environments for internal and external threats, scanning certain threat environments, analyzing certain reports of threats and actors, conducting internal audits for certain systems, evaluating our and our industry's risk profile, coordinating with law enforcement concerning select threats, and engaging with third-party service providers to conduct external audits, and threat assessments for certain systems, provide intelligence feeds, and conduct red/blue team testing and tabletop incident response exercises.


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data depending on the environment. This includes maintaining an incident response plan, vulnerability management policy, and disaster recovery and business continuity plan, conducting risk assessments for certain environments, implementing security standards and certifications for certain products and systems, encrypting data in transit and at rest, controlling data access in certain environments, using multiple network controls in certain environments, segregating data, monitoring systems, performing regular security assessments for certain systems, training employees, maintaining cybersecurity insurance, maintaining dedicated cybersecurity staff, and conducting internal and external penetration tests.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. This integration is designed to ensure that cybersecurity considerations are part of our decision-making processes. Our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Cybersecurity Risk Management Committee, or Cybersecurity Committee, of the Board of Directors, or Board.


text: We use third-party service providers to assist us from time to time in identifying, assessing, and managing material risks from cybersecurity threats, including for example cybersecurity consultants and software providers, managed cybersecurity service providers, threat intelligence service providers, forensic investigators, penetration testing firms, dark web monitoring services, and professional services firms, including legal counsel and auditors. By partnering with these specialized providers, we can leverage their insights and expertise to implement cybersecurity strategies and processes that are designed to align with industry best practices.


text: Our collaboration with third parties includes cybersecurity audits, threat assessments, and consultation on security enhancements. We have established processes designed to manage the cybersecurity risks associated with working with third-party service providers. We evaluate the risks associated with third parties before engagement and maintain ongoing monitoring of such third parties designed to ensure compliance with our security standards. This includes security questionnaires and assessments, as well as external attack surface management. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: See Risk Factors in this Annual Report on Form 10-K for a description of the risks from cybersecurity threats that may materially affect us and how they may do so.


text: Our Board addresses cybersecurity risk management as part of its general oversight function. The Cybersecurity Committee is tasked with assisting the Board in fulfilling its oversight responsibility for our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: The Cybersecurity Committee bears the primary responsibility for oversight of the management of risks related to the Company's information technology use and protection, cybersecurity, and product security. The Cybersecurity Committee consists of directors with cybersecurity and other expertise including risk management, technology and finance. The Cybersecurity Committee assists the Audit Committee and the Board in overseeing Tenable's overall process of risk assessment and enterprise risk management.


text: To date, we have not experienced any material cybersecurity incidents affecting our operations or financial condition. We continue to monitor risks and adjust our security measures as necessary.

companyName: BIOREGENX, INC.

ticker: BRGX


text: Our CSO is responsible for implementing and maintaining our cybersecurity risk assessment and management processes. Our CSO has over 25 years of experience in cybersecurity, including serving as a chief security and strategy officer at another company and founding a cybersecurity operational technology threat intelligence and solutions platform. Our CSO oversees and maintains our information security management framework and is responsible for defining and implementing our information security strategy, hiring appropriate personnel, communicating key cybersecurity priorities to relevant personnel, and managing cybersecurity budgets and cybersecurity processes.


text: Our CSO seeks to regularly obtain information about relevant developments in cybersecurity, including potential threats and risk management techniques to help shape our approach to preventing, detecting, mitigating, and remediating cybersecurity threats. Our CSO is also responsible for implementing and overseeing processes for regularly monitoring our information systems and data, including the conducting of periodic audits of certain systems to identify potential vulnerabilities. The CSO reports directly to the Chief Executive Officer and provides regular updates to our Chief Financial Officer, and CLO, on certain cybersecurity risks and incidents.


text: In the event of a cybersecurity incident, the CSO initiates our incident response plan that includes actions designed to mitigate the impact and long-term strategies for remediation and prevention of future incidents. Our incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including reporting to the Cybersecurity Committee and the Board for certain cybersecurity incidents.


text: Tenable recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data and our exposure management solutions. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, critical data (including without limitation intellectual property, confidential information that is proprietary, strategic or competitive, customer vulnerability data, and information systems data), and exposure management solutions.


text: Our Information Security function is overseen by our Chief Security Officer, or CSO, and is supported by our Chief Information Officer, Chief Product Officer and Product Engineering Team Leads, Chief Legal Officer, or CLO, and Head of Global Privacy. Our Information Security function is responsible for identifying, assessing and managing cybersecurity threats and risks and works to monitor and evaluate our threat environment and risk profile using various methods. These methods include conducting vulnerability assessments and threat assessments in certain environments for internal and external threats, scanning certain threat environments, analyzing certain reports of threats and actors, conducting internal audits for certain systems, evaluating our and our industry's risk profile, coordinating with law enforcement concerning select threats, and engaging with third-party service providers to conduct external audits, threat assessments for certain systems, provide intelligence feeds, and conduct red/blue team testing and tabletop incident response exercises.


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data depending on the environment. This includes maintaining an incident response plan, vulnerability management policy, and disaster recovery and business continuity plans, conducting risk assessments for certain environments, implementing certain security standards and certifications for certain products and systems, encrypting certain data in transit and at rest, controlling data access in certain environments, using multiple security controls in certain environments, segregating certain data, monitoring certain systems, performing regular security assessments for certain systems, training employees, maintaining cybersecurity insurance, maintaining dedicated cybersecurity staff, and conducting internal and external penetration tests.


text: We use third-party service providers to assist us from time to time in identifying, assessing, and managing material risks from cybersecurity threats, including for example cybersecurity consultants and software providers, managed cybersecurity service providers, threat intelligence service providers, forensic investigators, penetration testing firms, dark web monitoring services, and professional services firms, including legal counsel and auditors. By partnering with these specialized providers, we can leverage their insights and expertise to continue to refine our cybersecurity strategies and processes.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee is responsible for overseeing Company's our risk management processes, including oversight and mitigation of risks from cybersecurity threats. Management is responsible for the day-to-day administration of our risk management program and our cybersecurity policies, processes, and practices.

companyName: Quince Therapeutics, Inc.

ticker: QNCX


text: We have established processes designed to manage the cybersecurity risks associated with working with third-party service providers. We evaluate the risks associated with third parties before engagement and maintain ongoing monitoring of such third parties designed to ensure compliance with our security standards. This includes security questionnaires and assessments, as well as external attack surface management. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: Our CSO is responsible for implementing and maintaining our cybersecurity risk assessment and management processes. Our CSO has over 25 years of experience in cybersecurity, including serving as a chief security and strategy officer at another company as well as serving over 20 years conducting offensive and defensive cyber operations within the intelligence community and US Cyber Command. Our CSO oversees and maintains our information security management framework and is responsible for defining and implementing our information security strategy, hiring appropriate personnel, communicating key cybersecurity priorities to relevant personnel, and managing cybersecurity budgets and cybersecurity processes.


text: Our CSO seeks to regularly obtain information about relevant developments in cybersecurity, including potential threats and risk management techniques to help shape our approach to preventing, detecting, mitigating, and remediating cybersecurity threats. Our CSO is also responsible for implementing and overseeing processes for regularly monitoring our information systems and data, including the conducting of periodic audits of certain systems to identify potential vulnerabilities. The CSO reports directly to our Co-Chief Executive Officer and Chief Operating Officer and provides regular updates to our Co-Chief Executive Officer and Chief Financial Officer and CLO on certain cybersecurity risks and incidents.


text: Triton maintains a cybersecurity risk management program designed to identify, protect, detect and mitigate cybersecurity threats and ensure the reliability of our system applications and infrastructure (our "Information Security Program"). Our Information Security Program, which is integrated within the Company's enterprise risk management framework, leverages recognized best practices and standards, including the National Institute of Standards and Technology cybersecurity framework, and is comprised of a robust set of cybersecurity tools, processes and procedures as further described below.

companyName: Triton International Ltd

ticker: TRTN-PA


text: Our internal information security team is led by Triton's Chief Information Officer, who has held this role for 14 years and holds over 30 years of experience in information technology, audit and risk management and holds certifications as a Certified Information Systems Security Professional and Certified Information Systems Auditor. Our Director, Information Security and Compliance holds over eight years of experience in cybersecurity management and oversight and over 20 years in information technology portfolio, program and application management positions. Additionally, others in our information technology team have relevant security experience and certifications. Our internal resources are augmented by external cybersecurity partners, including those described below. Our information security leadership team is responsible for assessing and managing the Company's Information Security Program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. We also take a cross-departmental approach to managing cybersecurity risk and have formed a Cybersecurity Incident Response Team ("CIRT") comprised of senior representatives from primary corporate functions as well as senior representatives from field operations to ensure a coordinated and effective response and ongoing business continuity in the face of cybersecurity threats and incidents.


text: of December 31, 2023, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.

companyName: SKINVISIBLE, INC.

ticker: SKVI


text: Triton's Board is responsible for oversight of information technology and cybersecurity-related matters and monitoring cybersecurity risk management, and the Board actively engages with senior management on the state of the Company's Information Security Program. The information security leadership team prepares briefings for the Board on the effectiveness of the Company's cyber risk management program, typically on a quarterly basis, which include a review of key performance indicators, training and test results and related remediation, and recent threats and how the Company is managing those threats.


text: Triton's Information Security Program includes policies and procedures concerning cybersecurity matters, which include a cybersecurity incident response plan as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to password standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of electronic devices, electronic communications and social media. We perform routine vulnerability scanning of our network, with a focus on timely remediation of vulnerabilities. Our information security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. We periodically perform simulations and tabletop exercises at an information technology department and CIRT level and incorporate external resources and advisors as needed. All employees and certain contractors are required to complete cybersecurity trainings annually. We conduct cybersecurity phishing exercises, and follow-up training as necessary, to ensure employees maintain a high level of vigilance regarding cybersecurity risks. Using external resources, we also conduct periodic cybersecurity risk assessments, penetration tests and internal threat testing to assess our processes and procedures and the threat landscape and help guide and prioritize our cybersecurity investments and solutions. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Triton maintains dedicated backup systems and applications with enhanced ransomware protection features. In the event of an incident, we intend to follow our detailed incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying relevant functional areas, as well as senior leadership and the Board, as appropriate. We also maintain incident response service retainers with independent third parties to assist with response and recovery efforts. We continue to expand our cybersecurity investments and defenses and are establishing a cybersecurity operations center to be managed by a third party to provide 24/7 monitoring of our global cybersecurity environment and assist with coordination, investigation and remediation of alerts.


text: Triton faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. Although such risks have not materially affected us to date, Triton has experienced, and will continue to experience, cyber incidents in the normal course of its business. For more information on the cybersecurity risks we face, please see "We rely on our information technology systems to conduct our business. If these systems fail to adequately perform their functions, or if we experience an interruption in our operations, our business and financial results could be adversely affected" and "Security breaches and other disruptions could compromise our information technology systems and expose us to liability, which could cause our business and reputation to suffer" under Item 1A. "Risk Factors" of this Annual Report on Form 10-K.


text: Our Cybersecurity Risk Management Approach OFS Advisor utilizes the IT department ("IT Department") of CIM Group, LLC ("CIM Group"), an affiliate, as its IT administrator. The IT Department is responsible for the design and implementation of OFS Advisor's IT environment and controls, including policies and procedures to identify, assess and manage material risks from cybersecurity threats, which are integrated into OFS Advisor's internal controls and IT systems.


text: In collaboration with the IT Department, OFS Advisor's cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. The IT Department's cybersecurity risk management policies and procedures include, among other things: enterprise-wide hardware and software management and security controls; employee training; security assessments; penetration testing; security audits and ongoing risk assessments; due diligence on, and monitoring and oversight of, key third-party providers; vulnerability management; and management oversight to assess, identify and manage material risks from cybersecurity threats. The IT Department's controls leverage the National Institute of Standards and Technology Cyber Security Framework. The IT Department also utilizes industry and government associations, the results from regular internal and third-party audits and other similar resources to inform its cybersecurity processes and to allocate resources, including resources allocated to OFS Advisor.


text: In addition, OFS Advisor's employees receive mandatory training on cybersecurity matters at such employee's new hire and annually thereafter, periodic training and information updates that address new cybersecurity threats and trends, and quarterly "phishing" and social engineering testing to evaluate the effectiveness of the cybersecurity training program and raise employee awareness of cybersecurity threats.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: While we do not believe that our business strategy, result of operations or financial condition have been materially adversely affected by any cybersecurity incidents, for further discussion of cybersecurity risks, see "Item 1A. Risk Factors—Risk Related to Our Securities and an Investment in our Common Stock—Cybersecurity risks and cyber incidents may adversely affect our business or the business of our portfolio companies by causing a disruption to our operations or the operations of our portfolio companies, a compromise or corruption of our confidential information or the confidential information of our portfolio companies and/or damage to our business relationships or the business relationships of our portfolio companies, all of which could negatively impact the business, financial condition and operating results of us or our portfolio companies."


text: Management Oversight of Cybersecurity Risk Management Management's role in assessing and managing material cybersecurity risks includes various management positions, committees and subcommittees responsible for assessing such risks. The IT Department's internal processes require escalation of material cybersecurity risks to its management and its Cybersecurity Committee (the "Committee") for evaluation and, where appropriate, for escalation to the Board. The Committee consists of CIM Group's Chief Technology Officer (the "CTO"), CIM Group's Chief Compliance Officer (the "CCO"), and OFS Advisor's General Counsel (the "GC"), who has received a CERT Certificate in Cyber Oversight through the Cyber Oversight Program of the National Association of Corporate Directors, as well as representatives from CIM Group's operations, compliance and accounting departments. The Committee is also responsible for implementing our cybersecurity strategy and overseeing and managing our cybersecurity risk. In addition to the Committee's responsibilities, OFS Advisor has established a Cybersecurity Subcomittee (the "Subcommittee"). The Subcommittee consists of the CCO, the CTO, the GC, and the chief financial officer of each of OFS Advisor's public clients, including our Chief Financial Officer. The Subcommittee is responsible for overseeing our cybersecurity-related public disclosure obligations and ensuring our management and the Board is informed of material cybersecurity incidents affecting us and OFS Advisor. The Committee is chaired by CIM Group's CTO, and the Subcommittee is co-chaired by CIM Group's CTO and the CCO.


text: The Committee and Subcommittee each conduct both regular quarterly and as-needed meetings throughout the year during which members of the IT Department provide updates and report on meaningful cybersecurity risks, threats, incidents and vulnerabilities in accordance with the Committee's and the Subcommittee's respective reporting frameworks, as well as related priorities, mitigation and remediation activities, financial and employee resource levels, regulatory compliance, technology trends and third-party provider risks. To help inform this reporting framework, the IT Department and OFS Advisor maintain incident response plans and other policies and procedures designed to respond to, mitigate and remediate cybersecurity incidents based on the potential impact to our business, IT systems, network or data, including data held by third parties, or to the IT or other critical services provided by third-party vendors and service providers.


text: The IT Department's management responsible for developing and executing both OFS Advisor's and our cybersecurity policies, and is comprised of individuals with either formal education and degrees in IT or cybersecurity, or with experience working in IT and cybersecurity, including relevant industry experience in security related industries.


text: We believe that the processes, policies and procedures established by the Committee and the Subcommittee provide guidance for consistent and effective incident handling and response and set standards for internal notifications and escalations, as well as external notification considerations with respect to a cybersecurity event or incident requiring disclosure or notification in accordance with applicable laws.


text: Board of Directors Oversight of Cybersecurity Risk Management Our Board has ultimate oversight of cybersecurity risks as part of our enterprise risk management program, including oversight of the processes implemented by OFS Advisor and the IT Department to identify, assess, manage and mitigate cybersecurity risks. The Board receives quarterly updates from senior management of OFS Advisor and the IT Department with respect to the effectiveness of the cyber readiness and cybersecurity program that the IT Department administers on our behalf. This oversight includes briefing and a report by the CTO or CIM Group's Head of Operations, as well as a discussion of any cybersecurity breaches detected by the IT Department and a summary of, among other things, the current cybersecurity threat landscape, defensibility measures implemented by the IT Department, the health of our information security system, effectiveness of our cybersecurity controls and recoverability and business continuity testing.


text: Management Oversight of Cybersecurity Risk Management Management's role in assessing and managing material cybersecurity risks includes various management positions, committees and subcommittees responsible for assessing such risks. The IT Department's internal processes require escalation of material cybersecurity risks to its management and its Cybersecurity Committee (the "Committee") for evaluation and, where appropriate, for escalation to the Board. The Committee consists of CIM Group's Chief Technology Officer (the "CTO"), CIM Group's Chief Compliance Officer (the "CCO"), and OFS Advisor's General Counsel (the "GC"), who has received a CERT Certificate in Cyber Oversight through the Cyber Oversight Program of the National Association of Corporate Directors, as well as representatives from CIM Group's operations, compliance and accounting departments. The Committee is also responsible for implementing our cybersecurity strategy and overseeing and managing our cybersecurity risk. In addition to the Committee's responsibilities, OFS Advisor has established a Cybersecurity Subcommittee (the "Subcommittee"). The Subcommittee consists of the CCO, the CTO, the GC, and the chief financial officer of each of OFS Advisor's public clients, including our Chief Financial Officer. The Subcommittee is responsible for overseeing our cybersecurity-related public disclosure obligations and ensuring our management and the Board is informed of material cybersecurity incidents affecting us and OFS Advisor. The Committee is chaired by CIM Group's CTO, and the Subcommittee is co-chaired by CIM Group's CTO and the CCO.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we used the NIST CSF as a guide to help us create our cybersecurity policy.


text: Our cybersecurity risk management program forms a part of our overall enterprise risk management program, and shares reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not identified risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. However, we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - We are increasingly dependent on information technology, and potential cyber-attacks, security problems, or other disruptions present risks and could disrupt our operations, result in the loss of confidential information or damage our business relationships and reputation."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and our Audit Committee is responsible for the oversight of cybersecurity and other information technology risks. The Audit Committee also oversees management's implementation of our cybersecurity policy. Management will update the Audit Committee, as necessary, regarding any material cybersecurity incidents.


text: Our management team, including our Chief Executive Officer, Chief Operating Officer and Chief Accounting Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and retaining external information technology providers. The members of our management team do not have specialized cybersecurity backgrounds but have general experience managing financial, insurance, legal and operational risks. Our management team utilizes a third-party outsourced information technology service provider to monitor security events and actively respond to potential security incidents. If a security incident is identified, management in conjunction with the outsourced information technology service provider will take the appropriate actions to mitigate and remediate the security incident in a timely manner. Either during the incident, or post remediation, management will determine the materiality of the incident and if deemed material, will inform the Audit Committee and disclose the incident pursuant to SEC rules and regulations.


text: Our cybersecurity risk management program is dependent on the use of external service providers to assist with our information technology security controls. Our cybersecurity policy includes a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and a third-party risk management process for relevant third-party service providers.


text: Cybersecurity Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data (including intellectual property, confidential information that is proprietary, strategic or competitive in nature (collectively, "Information Systems and Data").


text: We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. Our Information Systems Representative and Chief Operating Officer identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment. We use various methods designed to accomplish this task including, for example: manual and automated tools, subscriptions to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, and evaluating threats reported to us.


text: Depending on the relevant information systems environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response strategies, systems monitoring, personnel training, cybersecurity insurance, data encryption strategies, network security controls, access controls, physical security controls, and asset management (such as tracking and disposal of Company information systems).


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our IT Department works with management in an effort to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.