text: Our Board of Directors has overall oversight responsibility for our risk management and has delegated cybersecurity risk management oversight to the Audit Committee of the Board. The Audit Committee of the Board is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and procedures to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee of the Board also reports material cybersecurity risks to our full Board of Directors. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining our cybersecurity program. Our cybersecurity program is managed under the direction of our Senior Vice President for Business Transformation, who receives reports from our cybersecurity team, including our Chief Information Security Officer, or CISO, and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. The CISO, in coordination with senior management, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to respond promptly to any material cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications, the CISO and these teams inform senior management about, and monitor the prevention, detection, mitigation and remediation of, cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: Our CISO has 42 years of experience in a diverse array of information and security technologies and has managed various domains, with expertise in enterprise resource planning, finite scheduling, middleware technologies, network control, operational control, identity access and governance and data center management. He and our other dedicated cybersecurity personnel collectively hold numerous certifications, including in relation to forensic investigation, threat hunting and digital forensics, risk and information system controls, Google cybersecurity, information security auditors and fraud examiners. Additionally, the collective cybersecurity team members have substantial experience in information technology disciplines and prioritize remaining educated on current threats.

companyName: Pactiv Evergreen Inc.

secItem: Item 1C

stage1Category: Management Role

stage1Method: unanimous


text: Our cybersecurity team regularly updates the Audit Committee of the Board on our cybersecurity program, material cybersecurity risks and mitigation strategies and provides quarterly cybersecurity reports that cover, among other topics, third-party assessments of the Company's cybersecurity program, developments in cybersecurity and updates to the Company's cybersecurity program and mitigation strategies.

stage1Category: Board Governance

stage1Method: majority


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see the risk factor above entitled "Cybersecurity breaches and improper access to or disclosure of our data or user data, or other infiltration, hacking and phishing attacks on our systems, could harm our reputation and adversely affect our business."

stage1Category: Strategy Integration


text: Risk Management and Strategy The Trust's cybersecurity risk management is established and governed by the Sponsor. The Sponsor determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for the Trust and the Trust relies on the Sponsor for assessing, identifying and managing material risks to the Trust's business from cybersecurity threats. The Sponsor's cybersecurity policies and practices are set out in the Sponsor's compliance manual and are reviewed on an annual basis. In addition, all officers of the Sponsor and all employees of Bitwise receive annual compliance training and annual cybersecurity training. Attendance at the annual cybersecurity training and the annual compliance training is tracked and recorded.

companyName: Bitwise 10 Crypto Index ETF

ticker: BITW

stage1Category: Risk Management Process


text: The Sponsor engages a selection of third-party security experts ("Experts") to assist its internal legal, compliance and engineering personnel in developing, implementing and testing its cybersecurity policies and procedures. The Experts assist in performing assessments, penetration tests and reviewed areas of potential vulnerability. In addition, the Experts work with the Sponsor to conduct cybersecurity training, exercises and quarterly internal phishing tests. The Sponsor uses the findings of such exercises and campaigns to improve its practices, procedures, and technologies. The Sponsor also engages the Experts to support its cybersecurity threat and incident response management and maintains information security risk insurance coverage.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of Information Technology who has over twenty years of experience in IT and Systems Administration.

companyName: Tracon Pharmaceuticals, Inc.


text: The Sponsor conducts due diligence on the Experts and all third-party service providers both at the beginning of any contractual relationship and on an ongoing, periodic basis. The Sponsor reviews a selection of all of its service providers on an annual basis, with specific emphasis on any service providers deemed to be high risk and utilizes external compliance partners to assist with this review. As part of this review, the Sponsor tracks any identified deficiencies and requires that its third-party service providers have in place appropriate technical and organizational security measures and security-control principles based on recognized cybersecurity standards. The Sponsor also obtains contractual assurances from third-party service providers relating to their security responsibilities, controls, reporting, and roles and responsibilities as it pertains to cybersecurity incident response policies and notification requirements.

stage1Category: Third-Party Risk


text: While neither the Sponsor nor the Trust has experienced a material cybersecurity incident, cybersecurity threat risks may materially affect either the Sponsor or the Trust, including the Trust's business strategy, results of operations or financial condition. For further discussion of the risks the Trust faces from cybersecurity threats, see "Item 1A. Risk Factors--The Trust is subject to the risk of cybercrime and security breaches and incidents."


text: The Trust does not have any directors, officers or employees. Under the Trust Agreement, all management functions of the Trust have been delegated to and are conducted by the Sponsor, its agents and its affiliates. As a result, Katherine Dowling, the General Counsel, Chief Compliance Officer and Vice President of the Sponsor, is responsible for assessing and overseeing the Sponsor's and the Trust's cybersecurity risks and providing direction and oversight for risk mitigation action, in conjunction with Hong Kim, the Chief Technology Officer of Bitwise. Ms. Dowling has served as a Chief Compliance Officer at various companies since 2015 and has more than ten years of experience as an Assistant U.S. Attorney, most recently in the Economic Crimes Unit of the U.S. Attorney's Office for the Northern District of California. Ms. Dowling receives periodic reports from the Experts, outside legal representatives and members of the Sponsor's Legal and Compliance team who take part in cybersecurity review, implementation and testing. Mr. Kim graduated from the University of Pennslyvania with a Bachelor of Science in Computer Science, and, prior to Bitwise, worked on Google's backend infrastructure for Google Drive and worked in software security for the South Korean military.


text: Bitwise, the parent of the Sponsor, has a board of directors that is ultimately responsible for managing and directing the affairs of the Sponsor, including maintaining oversight of risks from cybersecurity threats. Mr. Kim serves on the Bitwise board of directors. Ms. Dowling serves as the General Counsel and Chief Compliance Officer of Bitwise and therefore is able to report directly to Bitwise's board of directors regarding cybersecurity risks to the Trust and the Sponsor.


text: Risk Management and Strategy We are committed to our goal to protect sensitive business-related and personal information, as well as our information systems. We are subject to numerous and evolving cybersecutity risks that could adversely and materially affect our business, financial conditions and results of operations.

companyName: Domtar CORP

stage1Category: None/Other


text: We have implemented a cybersecurity risk management program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework to assess, identify and manage cybersecurity risk that may result in material adverse effects on the confidentiality, integrity and availability of our business and information systems.


text: Our program includes regular risk assessments, penetration testing performed by the internal team and independent third parties, patch management, and vulnerability scanning to identify potential threats and vulnerabilities. We have also implemented a robust security awareness program that includes regular phishing tests and requires employees to undergo annual security awareness training. Our cybersecurity strategy is focused on establishing the zero-trust security model to protect our information assets' confidentiality, integrity, and availability. We also have an incident response process and various incident response plans that are designed to provide timely and effective actions in the event of a cybersecurity incident. Our incident response plan includes procedures for determining the root cause and impacts of the incident, containment actions to mitigate the impacts, and notifying affected parties.


text: With respect to third-party service providers, we perform information security assessments and due diligence reviews prior to entering into a contractual agreement.


text: Despite our efforts, we recognize that no system is completely secure, and our main material cybersecurity risks are related to ransomware attacks, phishing attacks, insider threats, and third-party attacks. We monitor our systems against these risks and adjust our cybersecurity strategy accordingly. Our IT systems have been, and will likely continue to be, subject to computer viruses or other malicious codes, unauthorized access attempts, phishing, and other cyber-incidents, none of which, to Domtar's knowledge, have had a material impact on its business information systems or operations. While we cannot guarantee that our security efforts will prevent breaches or breakdowns to our IT systems or those of our third-party providers, we have a robust disaster recovery process that is exercised annually. For more information about cybersecurity risks, see the Risk factors discussion in Item 1A of this Form 10-K.


text: Our Management Leadership Team reviews cybersecurity risks as part of their oversight and execution of the Company's business operations and strategy. The Company's Management Board, with the support of its committees, oversees risk management to ensure that the processes designed, implemented and maintained by our executives are functioning as intended and adapted when necessary to respond to changes in our Company's strategy as well as emerging risks. We have established oversight mechanisms intended to provide effective cybersecurity governance, risk management, and timely incident response.


text: Cybersecurity is critical to the delivery of our services to our clients. We face cybersecurity threats that are common to most industries. We have a cybersecurity risk management program in place that is designed to assess, identify, manage, and govern material risks from cybersecurity threats. This program is a key component of our enterprise risk management program. The Company's Board is responsible for oversight of the Company's information technology systems, including cybersecurity, and has delegated such oversight to the Audit Committee. The Audit Committee regularly reviews the status of the initiatives such as the seeking of certifications associated with our information technology systems and receives regular updates on matters relating to information technology and cybersecurity. Our corporate information security organization, led by our Senior Director of IT who reports to our Chief Financial Officer, is responsible for our overall information security strategy, policy, security, operations and cyber threat detection and response. Our current Senior Director of IT has an extensive background and experience in information technology management and design, and data security. An integral part of our cybersecurity framework is our Security Response Team which is responsible for the detection, review, and response to cybersecurity incidents. In the event of a security incident, we intend to follow our detailed incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas as well as senior leadership and the Board, as appropriate.

companyName: HACKETT GROUP, INC.

ticker: HCKT


text: We regularly review the effectiveness of our cybersecurity controls, promptly addressing any identified risk areas and subject our information technology systems to testing performed by external parties on an annual basis. Our employees are required to successfully complete training on topics relating to our cybersecurity, data privacy and information security policies and procedures. Training is administered and tracked through online training modules. In addition, we perform periodic testing to evaluate the effectiveness of our training programs and to help prevent loss associated with the disclosure of electronic information. We also leverage third-party service providers and solutions across our operations to review, test, and assess our security systems and controls, as well as assist in the mitigation of any potential cyber risks. We recently obtained the ISO 27001 certification.


text: To further bolster our cybersecurity controls, we also have a third-party risk management program in place applicable to all of its contractors, vendors, and service providers which includes risk assessments, cybersecurity questionnaires, data privacy addendums, and contractual flow-downs of legal and regulatory requirements. We also require our contractors, subcontractors, vendors and service providers to report security incidents to us without undue delay.


text: To date, the Company has not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business operations or financial condition. Despite the extensive approach we take to cybersecurity, prevention of a cybersecurity incident cannot be completely guaranteed. Please refer to "Item 1A. Risk Factors – We rely on information technology and security systems and any damage, interruption or compromise of our information technology and security systems or data could disrupt and harm our business" and "Item 1A. Risk Factors – A breach of our information technology and security systems could materially adversely affect our business" for further information.


text: Cybersecurity Risk Management and Strategy We maintain a team, tools, policies, and processes for identifying, assessing, and managing material risks from cybersecurity threats. Threats like malware attacks, system vulnerabilities, and data breaches are actively identified, monitored, evaluated, and mitigated along with other Company risks. Our security team maintains centralized documentation regarding known security risks and mitigation. Consideration of material risks from cyber threats is integrated into our enterprise risk management processes and is a standing agenda item for discussion at our Audit Committee meetings. An Information Security Executive Committee representing multiple areas of the Company is responsible for assessing material risks from cybersecurity threats and represents multiple functions of the business including Finance, Human Resources, Legal, and the Information Technology ("IT") departments. We have certain employee cybersecurity awareness campaigns and training designed to help promote a culture of cybersecurity awareness throughout the organization. Cybersecurity tools, processes, policies, and controls are periodically reviewed and updated in response to changes in the business environment and evolving threats, as well as to align with broader risk management objectives.

companyName: Pursuit Attractions & Hospitality, Inc.

ticker: PRSU


text: Our information security function, led by our Chief Information Officer ("CIO"), implements and maintains the processes and controls to help identify, assess, and manage material risks from cybersecurity threats. These controls include, but are not limited to, the following Center for Internet Security ("CIS") controls: • Account Management; • Access Control Management; • Continuous Vulnerability Management; • Network Infrastructure Management; • Incident Response Management; • Security Awareness and Skills Training; and • Data Protection - Encrypt Data on End-User Devices. Supporting these controls are specific security measures that include threat intelligence monitoring, vulnerability scanning, and policy enforcement.


text: We use third-party service providers to assist us in identifying, assessing, and managing material risks from cybersecurity threats, including professional service firms, legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, and forensic investigators. We have a Cybersecurity Incident Response Plan ("IRP") that includes procedures for responding to and, to the extent applicable, disclosing material cybersecurity incidents in a timely manner. We have third-party risk management processes designed to assess risks from key vendors and suppliers, including application providers and hosting companies. Key software service providers utilized by the Company undergo a review process for security, reliability, and effectiveness. We have processes in place to address access to our network by such third parties, to the extent applicable, including network access controls designed to provide access on a 'least privilege' basis.


text: For a discussion of risks from cybersecurity threats that may materially affect the Company, see "Risk Factors" under the heading "Cybersecurity and Data Privacy Risks." (Part I, Item 1A of this 2023 Form 10-K).


text: Cybersecurity Governance Cybersecurity risk management is a part of our risk management process and is subject to oversight by our Board of Directors and management. Our Board of Directors has delegated oversight and mitigation of risks from cybersecurity threats to our Audit Committee. Our Audit Committee receives quarterly reports from either our CIO or our General Counsel concerning any significant cybersecurity threats, risks, and the tools and processes we have implemented for mitigation. Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management including the following: • The Information Security Executive Committee consists of our General Counsel, Chief Accounting Officer, Chief Compliance Officer, CIO, and Vice Presidents of Human Resources from select business units. They are responsible for setting broad policy and communicating to the Chief Executive Officer, Chief Financial Officer, and the Board of Directors on potential material cybersecurity incidents, which may require disclosure. • The Information Security Council consists of our CIO, Chief Information Security Officer ("CISO"), in-house information security experts, and information technology experts and leaders from across the Company. The CIO leads this committee and communicates with the Information Security Executive Committee as required. • The Information Security Team consists of cybersecurity professionals primarily responsible for managing cybersecurity at Viad. This team has the primary responsibility for identifying, assessing, and managing material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware, software, and critical data. This team is led by our CIO, who has over 30 years of experience in information technology including cybersecurity oversight. This team includes the following: • The CISO is an external expert who works with the Viad Information Security team on a fractional basis, reporting directly to the CIO and reporting periodically to our Board of Directors. The CISO is an information security professional with over 20 years of experience guiding and overseeing multiple companies' development and implementation of information security strategy. • The Vice President of Global Infrastructure is an internal role directly reporting to the CIO and responsible for implementing, maintaining, and providing oversight of the IT Infrastructure and the Information Security Team. • The Security Architect is an internal role who leads the day-to-day operations of the Information Security team and oversees the individual analysts and IT experts on the team. • The Security Incident Response Team ("SIRT") is responsible for executing the IRP. The SIRT comprises individuals from multiple departments, divisions, and disciplines. Members of the SIRT are trained in incident response and reporting procedures.


text: Introduction: The medical device industry faces unique cybersecurity challenges, given the sensitive nature of the data and the critical role of devices in patient care. Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as information about our employees, contractors, vendors, suppliers, patients and customers. We remain committed to implementing robust security measures to protect against potential cyber threats and vulnerabilities that are constantly evolving across the globe.

companyName: Inogen Inc

ticker: INGN


text: Risk Management and Strategy: We have processes for assessing, identifying, and managing cybersecurity threats, and cybersecurity is an integral part of our overall enterprise risk management program which is overseen by our Audit Committee and the Board. Our strategy includes a comprehensive cybersecurity framework, utilizing advanced technologies and methodologies, such as cloud migrations and deployment of threat detection tools to effectively mitigate potential risks. Continuous risk assessments help us better refine our strategy, guiding the deployment of technical safeguards and shaping our incident response plans. For acquired companies, our integration strategies prioritize establishing comprehensive timelines for harmonizing information security, data privacy, and cybersecurity practices. This includes a strong focus on aligning employee education programs to ensure a seamless transition and uphold security and privacy standards across our entities.


text: Our cybersecurity infrastructure is based on a multi-layered defense framework, aligned with the U.S. National Institute of Standards and Technology (NIST) guidelines. We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers, ensuring the service providers adhere to our security standards, thereby safeguarding our integrated operations. The strategic migration of our data centers and infrastructure to secure cloud environments, coupled with the implementation of targeted technical cybersecurity measures, underscores our dedication to establishing foundational security across our users, applications, data, systems, and networks.


text: We have established a comprehensive incident response plan to swiftly address and recover from cybersecurity incidents, minimizing operational impact. We conduct regular trainings and simulations to enhance our team's awareness and preparedness against cyber threats. Biannual penetration testing and regular assessments by external experts validate the effectiveness of our cybersecurity measures. Our proactive approach to addressing identified vulnerabilities affirms the continuous improvement of our security posture.


text: Use of Consultants and Advisors: We engage various third-party cybersecurity service providers to assess and enhance our cybersecurity practices and assist with protection and monitoring of our systems and information, including with respect to, network monitoring, endpoint protection, vulnerability assessments and penetration testing. We engage cybersecurity consultants, auditors, and other third parties to assess and enhance our cybersecurity practices, such as a third-party consulting firm to evaluate our cyber processes including an assessment of our incident response procedures.


text: We have processes to evaluate third-party service providers and vendors that have access to sensitive systems and company and customer data, which may include due diligence procedures such as assessments of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. Following an assessment, we determine and prioritize service provider risk based on potential threat impact and likelihood, and such risk determinations drive the level of due diligence and ongoing compliance monitoring required for each service provider.


text: Board Oversight and Management's Role: The Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee oversees the proper functioning of our cybersecurity risk management program to ensures strategic alignment and governance of our cybersecurity efforts at the highest level. In particular, the Audit Committee assists the Board in its oversight of management's responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our information technology systems, processes and data.


text: Management has implemented risk management structures, policies and procedures, and Management is responsible for our day-to-day cybersecurity risk management. Our Chief Data and Information Officer (CDIO) is responsible for our day-to-day assessment and management of cybersecurity risks. Our Enterprise Enablement function facilitates a cross-departmental approach, ensuring the executive leadership team receives quarterly updates on cybersecurity from various teams. This strategy promotes a comprehensive stakeholder engagement and enhances management oversight on cybersecurity. The updates cover progress on ongoing cybersecurity initiatives, insights from any potential threats or incidents, outputs and action plans from external vulnerability and penetration tests, and key performance metrics in line with industry standards.


text: Risks from Material Cybersecurity Threats: Despite ongoing threats like cyber-attacks, phishing, and ransomware, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on our business strategy, results of operations or financial condition. Our proactive security measures, alongside those of our third-party vendors, aim to protect our information technology systems and the sensitive data they hold. Although these risks have not yet materially impacted our business, we remain vigilant, continuously monitoring and adapting to evolving cybersecurity threats.


text: Risk Management and Strategy Standard BioTools regularly assesses risks from cybersecurity threats; monitors our information systems for potential vulnerabilities; and tests those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to protect against cyber security incidents, as well as to identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. As part of this program, we conduct periodic assessments of our assets to evaluate the effectiveness of applicable security controls. These assessments are informed by industry standard frameworks (NIST, ISO) and include a review of our information security controls, policies and procedures to assess cybersecurity maturity against industry standards. In accordance with our IT Risk Management Program, we actively identify and assess risks based on the probability and potential impact to key business systems and processes. All risks identified will be assessed to identify the range of possible outcomes and risks will be prioritized by their level of importance. Each risk will be assigned to a risk owner who will track, monitor, and report on the status with a risk response aligned to the probability and impact of occurrence. Risks that are considered high are incorporated into our corporate risk management program overseen by the Audit Committee and our Board of Directors.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB


text: All employees receive cybersecurity training upon hire with at least annual training thereafter with job-specific topic considerations. Our Information Security team, consisting of the VP of Information Technology, Sr. Manager of Network Security and IT Security Manger, among others, engage third-party vendors to assist with providing timely cybersecurity threat alerts in addition to monitoring for cybersecurity threats and our defenses against cyberattacks. This monitoring includes the proactive identification of vulnerabilities in our systems through testing and threat intelligence awareness. The employees within our Information Security team and broader IT team who specialize in cybersecurity operations are responsible for coordinating and overseeing the activities of these third-party vendors.


text: Additionally, we require each third-party service provider with access to our internal systems, applications or data to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. Our practice is to perform due diligence, including the completion of security questionnaires and risk assessments, as appropriate, on these third parties.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition in our risk factor titled "Security incidents, loss of data, cyberattacks, and other information technology failures could disrupt our operations, damage our reputation, and adversely affect our business, operations, and financial results," in Part I, Item 1A. "Risk Factors." Refer to this risk factor for additional description of cybersecurity risks and potential related impacts on our Company.


text: As previously disclosed, in early 2019, we became aware of a ransomware attack that infiltrated and encrypted certain information technology systems, including systems containing critical business data. The financial impact of this incident was not material, and there were no changes to the previously released financial results or financial statements. As previously disclosed, immediately following the discovery, we commenced an investigation and were able to recover access to the compromised systems and restore their operation without significant loss of business data within weeks of the incident. Following the incident, we implemented additional protective measures and internal control policies and procedures. We also retained a professional cybersecurity investigation firm to conduct a full forensic analysis of the incident, and concluded that there was no evidence of malware, persistence mechanisms or other compromised exchange on-premises accounts within the Company's environment.

stage1Category: Incident Disclosure


text: In early 2024, Standard BioTools completed a merger with SomaLogic Operating Co, Inc. Critical to integration activities has been a wholesale review of policies, procedures and tools relevant to the combined cybersecurity environment with the objective of deploying and maintaining those which serve to reinforce our security presence to the greatest extent. While these activities persist, it has been noted that the SomaLogic organization takes a comparable, if not more stringent, approach to their cyber and information security posture inclusive of their ongoing ISO 27001 compliance certification.


text: While our management team is responsible for the day-to-day management of the risks Standard BioTools faces, our Board has the responsibility to oversee management's processes for identifying, monitoring, and addressing enterprise risks, evaluate and discuss with management its assessments of matters relating to enterprise risks, and oversee and monitor management's plans to address such risks. The Board takes an enterprise-wide approach to risk management designed to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance, and to enhance stockholder value. In order to understand the most significant risks faced by the Company and the steps being taken to manage those risks, Standard BioTools conducts quarterly enterprise risk management assessments, facilitated by the Company's executive leadership team in collaboration with the internal audit function, which are presented by management at each quarterly Board meeting. The Board's review of our business is an integral aspect of its assessment of management's tolerance for risk and its determination as to the appropriate level of risk for our Company.


text: Although the Board has determined that enterprise risk management should be the responsibility of the Board as a whole, it has delegated responsibility to oversee specific areas of risk management to its committees. Our Audit Committee oversees and reviews the Company's cybersecurity, data privacy, and other information technology risks, controls and procedures, including the Company's plans to mitigate cybersecurity risks and respond to data breaches. At periodic meetings of the Board and its committees and in other meetings and discussions, management reports to the Board and its committees with respect to the most significant risks that could affect our business, including cybersecurity-related risks. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident to meet reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our cybersecurity risk management and strategy processes are led by our Chief Financial Officer and our Vice President of Information Technology. Our Vice President of Information Technology has over 18 years of work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and has carried relevant degrees and certifications, including Certified Information Systems Auditor. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the Audit Committee of our Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, on an at least annual basis. Should a material breach be identified, as defined by the Board and the executive team, these management team members will notify the executive team and the Board and draft the required disclosure.


text: We maintain processes for identifying, assessing, and managing material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K) as part of our broader enterprise risk management program under the oversight of the Audit Committee of the Company's Board of Directors. These processes include a wide variety of mechanisms, controls, technologies, systems, and methods that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting data. We also use systems and processes to oversee and identify risks from cybersecurity threats associated with our third-party service providers.

companyName: Xperi Inc.

ticker: XPER


text: Our corporate information security organization, led by our Chief Information Officer ("CIO"), is responsible for our cybersecurity risk management and mitigation, incident prevention, detection, and remediation. This team's leadership includes professionals with deep cybersecurity expertise. This team collaborates with technical and business stakeholders across our businesses to analyze risk and form detection, mitigation and remediation strategies. They engage outside legal counsel, experts, consultants, and other third parties to perform regular audits, assist with forensic investigations, or address cybersecurity threats and incidents. As appropriate, they obtain input on the security industry and threat trends from external experts and consultants.


text: Significant incidents are reviewed by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as being or becoming potentially material is promptly escalated for further assessment and reported to designated members of senior management. Senior management is responsible for assessing the materiality of an incident, complying with any regulatory requirements, and communicating relevant information to the Audit Committee, as appropriate. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters.


text: Although the risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition to date, there can be no assurance that they will not be materially affected by such risks or a material incident in the future, or that we have not experienced an undetected cybersecurity incident. As discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to the Company, including potentially to our results of operations and financial condition. See "Risk Factors — Our systems, networks and online business activities and those of third parties that we utilize in our operations are subject to cybersecurity and stability risks, information technology system failures, and security breaches."


text: The Company's Board of Directors has oversight of our strategic and business risk management and has delegated cybersecurity risk management oversight to the Audit Committee of the Board. The Audit Committee oversees the guidelines and policies governing the process by which management assesses and manages our exposure to risk, including material risks from cybersecurity threats. The Audit Committee receives regular updates from management, including our CIO, regarding our cybersecurity risk management program, including cybersecurity risks, threats, incidents, and mitigation strategies.


text: Cybersecurity Risk Management and Strategy Due to the prevalence of cyberattacks and other cyber incidents directed at public companies, cybersecurity is a principal element of our overall enterprise risk management program. We have a multilayered approach for assessing, identifying and managing cybersecurity risks, which is designed to help protect the Company's information assets and operations from internal and external cyber threats by understanding and seeking to manage risk while protecting employee and customer information from unauthorized access or attack, as well as secure our networks, systems and devices. Cybersecurity is one of the top enterprise risks that we have identified. As part of our quarterly enterprise risk management meetings, we discuss efforts to manage this risk and we assess the degree of risk and whether it is increasing or decreasing.

companyName: LL Flooring Holdings, Inc.


text: We devote significant resources to protecting and evolving the security of our computer systems, software, networks and other technology assets. Our cybersecurity risk management processes include physical, procedural and technical safeguards. Our cybersecurity policies, standards and procedures include cyber and data breach response plans, which are benchmarked against the National Institute of Standards and Technology Cybersecurity Framework. The Company's incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations. The Company seeks to continually improve its policies and practices to identify potential and emerging security risks and develop mitigations for those risks. For example, the Company regularly conducts phishing tests, penetration tests and tabletop simulations to help discover potential vulnerabilities, which enable improved decision-making and prioritization and promote monitoring and reporting across compliance functions. As part of its overall risk mitigation strategy, the Company also maintains cyber insurance coverage.


text: We engage external parties, including consultants, computer security firms, forensic firms, public relations professionals and attorneys, to advise us on our preparedness and risk management activities. We also regularly consult with industry groups and law enforcement on emerging industry trends.


text: In order to oversee and identify risks from cybersecurity threats associated with the Company's use of third-party service providers, we conduct a security risk assessment on all proposed new third party vendors who will have access to our information and data. We have standard contractual language that we require for vendors who will have access to sensitive data.


text: We do not believe that there are currently any risks from cybersecurity threats of which we are aware that are reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition. We did experience a network security incident in 2019, which was disclosed previously, from which we have incorporated lessons learned and improved our risk management program. Despite our security measures, however, there is no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For additional information regarding the risks to the Company associated with cybersecurity incidents, see "If our management information systems, including our digital platform or our customer contact center, experience disruptions, it could disrupt our business and reduce our net sales" included in Part I, Item 1A (Risk Factors) of this Annual Report.


text: Our board of directors oversees our overall risk management process and significant risks facing us, including cybersecurity risks. The audit committee, which is comprised solely of independent directors, has been designated by our board of directors to oversee cybersecurity risks. Our board of directors oversees and evaluates strategic risk exposure, while our executive officers manage the significant risks we encounter on a daily basis.

companyName: 89bio, Inc.


text: Cybersecurity Governance and Oversight The Audit Committee of the Company's Board of Directors provides direct oversight over cybersecurity risk. The Audit Committee receives and provides feedback on quarterly updates from management regarding cybersecurity and is notified between such updates regarding new cybersecurity threats or incidents. Information presented at the quarterly updates includes any emerging risks or key topics and includes training initiatives, the status of projects to strengthen cybersecurity, cyber readiness, incident tracking, mitigation efforts and response plans. The full Board of Directors receives regular reports from the Audit Committee, as well as an annual report from management highlighting key aspects of our cybersecurity risk management activities and the emerging threat landscape.


text: The Company has a Chief Information Security Officer (the "CISO") whose team (the "IT Security Team") is responsible for leading company-wide cybersecurity strategy, policy, standards and processes and works across all areas of the Company to protect the Company and its employees and customers against cybersecurity risks, perform investigations and respond to cybersecurity incidents. The CISO reports to the Chief Technology Officer ("CTO") who is also actively involved with assessing and managing cybersecurity risks. The CISO and the CTO are responsible for the quarterly updates to the Audit Committee regarding cybersecurity. The CISO has 28 years of experience in the IT field, with ten of those years in cybersecurity. The IT Security Team has a combined experience of 42 years and two members of the IT Security Team have obtained their Certified Ethical Hacker certifications. The CTO has over 34 years of experience in the IT field with a broad understanding of e-commerce and customer facing technologies.


text: In an effort to prevent and detect cyber threats, the Company provides all employees with cybersecurity prevention training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately.


text: Risk Management and Strategy We have implemented procedures for assessing, identifying and managing significant risks from cybersecurity threats and have incorporated these procedures into our overall risk management systems and processes. We regularly evaluate significant risks from cybersecurity attacks, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information stored there. The program to manage cybersecurity risks has tools and activities designed to identify, examine and manage current and potential cybersecurity threats, as well as plans and strategies designed to deal with threats and incidents.


text: We regularly evaluate the cybersecurity risks that could affect our information systems, as well as on an ad hoc basis when there is a significant change in how we do business that may expose our information systems to more such risks. These evaluations include identifying the possible internal and external risks, how likely and harmful they are, and whether our current policies, procedures, systems, and safeguards are adequate to handle them.


text: We use these risk assessments to design, implement, and maintain appropriate safeguards that are intended to mitigate identified risks, address any shortcomings in our existing safeguards, and regularly check how well our safeguards work. Our information technology ("IT") department is primarily responsible for evaluating, overseeing, and handling our cybersecurity risks to manage the process of risk assessment and mitigation. We have established a cross-functional IT Security Steering Committee that oversees the management of our cybersecurity risks and execution of any mitigation efforts.


text: Our IT department and Company management work together to check and improve our safeguards as part of our overall risk management system. We also periodically provide training to our employees on these safeguards and keep them informed of our cybersecurity policies through regular communications across the Company.


text: We work with consultants or other third parties as part of our risk assessment processes, when appropriate. They help us create and execute our cybersecurity policies and procedures and check and test our safeguards. We ask key third-party service providers to confirm that it can apply and keep appropriate cybersecurity measures in line with all relevant laws, to apply and keep reasonable cybersecurity measures when they work with us, and to promptly report any possible breach of their cybersecurity measures that could impact our company.


text: We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. For additional information regarding these risks, please refer to Item 1A, "Risk Factors," "We depend on our information technology systems and those of our third-party collaborators, service providers, contractors or consultants. Our internal computer systems, or those of our third-party collaborators, service providers, contractors or consultants, may fail or suffer security breaches, disruptions, or incidents, which could result in a material disruption of our development programs or loss of data or compromise the privacy, security, integrity or confidentiality of sensitive information related to our business and have a material adverse effect on our reputation, business, financial condition or results of operations" in this Annual Report on Form 10-K.


text: The IT Security Steering Committee, which is in charge of our cybersecurity policies and procedures, including the ones discussed in "Risk Management and Strategy" above, is led by our Chief Financial Officer, who has eight years of senior leadership experience at public biotechnology companies, including five years with 89bio. The IT Security Steering committee also includes our Director of IT, who is an experienced Information Technology professional and has over 20 years of experience managing information technology, of which 10 years pertain to cybersecurity related experience.


text: Cybersecurity Risk Management Process We have developed and continue to enhance our cybersecurity program to help secure our computer systems, software, networks, and data against material risks from cybersecurity threats, and help manage the material cybersecurity risks associated with our use of third-party service providers.

companyName: BARRETT BUSINESS SERVICES INC

ticker: BBSI


text: BBSI has integrated cybersecurity risk management into our overall risk management framework to identify, assess, and manage cybersecurity risks. As part of our integrated risk management process, our technology and information security team work closely with our management team on an ongoing basis to identify and respond to cybersecurity threats. Our proactive approach to cybersecurity risk management includes cybersecurity risk assessments performed internally by our IT security team and externally by third-party experts, penetration and vulnerability testing using third-party vendors and tools, tabletop exercises that simulate cybersecurity incidents, cybersecurity awareness training, and internal audit assessments of critical IT controls.


text: Use of Cybersecurity Experts Due to the complex and evolving cybersecurity threat landscape, BBSI engages third-party experts to conduct in-depth threat assessments, identify vulnerabilities, monitor and detect threats, and offer strategic insights into our risk management process. Leveraging the knowledge, expertise, and resources of third-party experts, we regularly evaluate our cybersecurity risk management strategy to help us align with best practices and address cybersecurity threats that could impact our ability to achieve our business objectives.


text: Third-Party Service Provider Risk Management We utilize third-party service providers for a variety of reasons, including, without limitation, infrastructure and SaaS cloud computing services, technology and business process service providers, content delivery to customers, back-office support, and other functions. Such providers may have access to information about BBSI or that we hold about our customers, associates or vendors.


text: To mitigate the cybersecurity risk associated with the use of third-party service providers, we tier our third-party service providers based on their risk profile to establish applicable cybersecurity risk review standards and evaluate those providers in accordance with the tiering process. BBSI also relies on its third-party service providers to maintain cybersecurity control environments that address the risks associated with the products and services they provide to BBSI.


text: Cybersecurity Threats We are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect BBSI, including our business strategy, results of operations, or financial condition. Despite our efforts to ensure the integrity of our computer systems, software, networks, third-party relationships, and other technology assets, we may not be able to anticipate, detect, or recognize threats to our systems and assets, or to implement effective preventative measures against all cyber threats, given the sophistication of the techniques used. For further discussion, see Item 1A. "Risk Factors – Risks Related to Technology."


text: Board Oversight of Cybersecurity Risk Our Board of Directors has a significant role in the oversight of BBSI's cybersecurity risk. The Board's Risk Management Committee provides oversight of BBSI's enterprise-wide risk management framework, including the strategies, policies, procedures, processes, and systems established by management to identify, assess, measure, monitor, and manage cybersecurity and other risks facing the Company. The Board of Directors also periodically receives reports from third-party consultants on the current cybersecurity threat environment, the results of third-party penetration testing, and the evaluation of the Company's cybersecurity preparedness.


text: Management's Role in Assessing and Managing Cybersecurity Risk BBSI's Chief Information Security Officer ("CISO") leads our enterprise information security program and is primarily responsible for the assessment and management of the Company's cybersecurity risk. The CISO has extensive experience in information technology and cybersecurity, including at another publicly traded company. The CISO oversees our cybersecurity risk management framework and manages a team of IT security professionals to identify and prioritize cybersecurity risks. The CISO also utilizes the expertise of third-party security partners to provide threat detection support, vulnerability management, incident response, penetration testing, and consulting services.


text: Ongoing Monitoring and Reporting of Cybersecurity Incidents The Company has an internal security team, supplemented with third-party security partners, to consistently monitor, detect and respond to potential cybersecurity incidents. The Company has a cybersecurity incident reporting protocol that provides a mechanism for the appropriate members of management and the Board to be made aware of cybersecurity incidents. The Company also requires security awareness training for all employees to enable employees to understand their role in preventing and reporting cybersecurity incidents.


text: Cybersecurity Risk Management and Strategy The Company is externally managed by the Advisor and has no employees or internal information systems. Thus, the Company relies on the Advisor, BlackRock, Inc. ("BlackRock") as well as the custodian and other service providers to protect the Company's information from cybersecurity threats. The Company's chief compliance officer (the "CCO") oversees the Company's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board of Directors. The CCO and the Advisor also review key Company service providers' compliance and risk management policies and procedures related to cybersecurity matters, evaluate such service providers' use of information systems, which have the potential to subject the Company to information technology vulnerabilities, and receive reports from the Company's service providers regarding any cybersecurity threats and incidents.

companyName: BlackRock Direct Lending Corp.


text: Specifically, the Company relies on the enterprise risk management ("ERM") framework of BlackRock, Inc. ("BlackRock") for the Company's cybersecurity risk management and strategy. The Board of Directors of the Company periodically receives reports from BlackRock and from the Advisor regarding BlackRock's cybersecurity program. Key aspects of the ERM framework are summarized below.


text: BlackRock's Enterprise Risk Management Framework BlackRock recognizes the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Cybersecurity represents an important component of BlackRock's approach to ERM. BlackRock leverages a multi-lines-of-defense model with cybersecurity operational processes executed by global information security and other teams and dedicated internal audit technology and technology risk management ("TRM") teams that independently review technology risks. BlackRock's cybersecurity program is fully integrated into its ERM framework and is aligned with recognized frameworks, including NIST CSF, FFIEC CAT, FedRAMP, SOC 1/2, ISO 27001/2 and others. BlackRock aims to inform and continuously improve its cybersecurity program through engagement with regulatory, client, insurer, vendor, partner, peer, government and industry organizations and associations, as well as external audit, technology risk, information security and other assessments.


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas: o Governance: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's board of directors (BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC").


text: o Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks.


text: o Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls; perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention; tabletop exercises, ongoing vulnerability and patch management; vendor due diligence; multi-factor authentication; device encryption; application security, code testing and penetration testing; endpoint security, including anti-malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges; employee awareness, training, and phishing testing; data loss prevention program and monitoring; information security incident reporting and monitoring; and layered and comprehensive access controls.


text: o Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis.


text: o Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third-party systems. Operational incidents can arise as a result of failures by third parties with which BlackRock does business, such as failures by internet, communication technology and cloud service providers or other vendors to adequately follow processes and procedures, safeguard their systems or prevent system disruptions or cyber-attacks. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.


text: BlackRock's global information security team, in collaboration with the technology risk and internal audit teams, engages in the periodic assessment and testing of BlackRock's cyber risks and cybersecurity program. These efforts may include a wide range of activities, including audits, assessments, wargames and "tabletop" exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. BlackRock also participates in financial services industry and government forums in an effort to improve both internal and sector cybersecurity defense. BlackRock regularly engages third parties and advisors to assess its cybersecurity control environment. The results of certain program and control assessments are reported to the Risk Committee, and BlackRock adjusts its cybersecurity program as appropriate based on the information provided by these assessments.


text: As of December 31, 2023, the Company is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.


text: Cybersecurity Governance The Board of Directors of the Company periodically receives reports from BlackRock and from the Advisor regarding BlackRock's cybersecurity program. The CCO delivers quarterly reports to the Board of Directors of the Company. Team members who support the Company's information security program have relevant educational and industry experience.


text: At the BlackRock parent level, BlackRock's Board is actively engaged in the oversight of BlackRock's risk management program. The Risk Committee assists the Board with its oversight of BlackRock's levels of risk, risk assessment, risk management and related policies and processes, including risks arising from cybersecurity threats. The Risk Committee receives regular reports on BlackRock's cybersecurity program, technology resilience risk management and related developments from members of our information security team, including the CISO. The Board and the Risk Committee also receive information regarding cybersecurity incidents that meet certain reporting thresholds. On an annual basis, senior members of BlackRock's technology, risk and information security teams provide a comprehensive overview of BlackRock's cyber risk and related programs to a joint session of the Board's Risk and Audit Committees.


text: Technology and cybersecurity risks at BlackRock are also overseen by the TRCC, a dedicated management risk governance committee and sub-committee of the firmwide ERC. The chair of the TRCC is appointed by the head of Enterprise Risk Management at BlackRock and its members include the CISO as well as a broad range of senior business stakeholders across BlackRock. The TRCC is responsible for oversight of BlackRock's technology and cybersecurity risk management practices and helps ensure that technology and cybersecurity risks remain within firmwide risk tolerances and technology and cybersecurity risk issues are escalated as appropriate to the ERC and other committees. The TRCC also reviews any relevant technology and cybersecurity risk related issues and helps ensure that they are appropriately escalated, reported, and remediated.


text: BlackRock's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by BlackRock's CISO. As of December 31, 2023, the CISO had over 30 years of experience in information technology with a 25-year concentration in information security, including previously serving as the CISO at several global financial institutions, and held the Certified Information Systems Security Professional certification. The CISO works closely with the leadership team and other subject matter experts in the global cybersecurity group, who collectively have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and overseeing cybersecurity controls in technology risk and audit functions, as well as having relevant degrees and industry-leading certifications.


text: The CISO and members of the TRCC monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation of BlackRock's incident response plan.


text: Cybersecurity Risk Management and Strategy The Fund is externally managed by the Advisers and has no employees or internal information systems. Thus, the Fund relies on the Advisers, BlackRock, Inc. ("BlackRock") as well as the custodian and other service providers to protect the Fund's information from cybersecurity threats. The Fund's chief compliance officer (the "CCO") oversees the Fund's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board of Trustees. The CCO and the Advisers also review key Fund service providers' compliance and risk management policies and procedures related to cybersecurity matters, evaluate such service providers' use of information systems, which have the potential to subject the Fund to information technology vulnerabilities, and receive reports from the Fund's service providers regarding any cybersecurity threats and incidents.

companyName: BlackRock Private Credit Fund


text: Specifically, the Fund's relies on the enterprise risk management ("ERM") framework of BlackRock for the Fund's cybersecurity risk management and strategy. The Board of Trustees of the Fund periodically receives reports from BlackRock and from the Advisers regarding BlackRock's cybersecurity program. Key aspects of the ERM framework are summarized below.


text: We are requiring each of our significant third-party service providers to agree that it will implement and maintain appropriate security measures that are consistent with applicable law, implement and maintain reasonable security measures in connection with their work with us, and promptly report any suspected breach of its security measures that may affect our company.

companyName: IO Biotech, Inc.

ticker: IOBT


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's Board of Directors (BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC"). • Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks. • Safeguards: The Fund deploys a range of people, process and technical controls that are designed to protect the Fund's information systems from cybersecurity threats, which may include, among others: physical security controls; perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention; tabletop exercises, ongoing vulnerability and patch management; vendor due diligence; multi-factor authentication; device encryption; application security, code testing and penetration testing; endpoint security, including anti-malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges; employee awareness, training, and phishing testing; data loss prevention program and monitoring; information security incident reporting and monitoring; and layered and comprehensive access controls. • Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address the Fund's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis. • Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third-party systems. Operational incidents can arise as a result of failures by third parties with which BlackRock does business, such as failures by internet, communication technology and cloud service providers or other vendors to adequately follow processes and procedures, safeguard their systems or prevent system disruptions or cyberattacks. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.


text: • Education and Awareness: BlackRock's employees and contractors are required to complete an annual information security training to equip them with effective tools to address cybersecurity threats, and to receive communications on BlackRock's evolving information security policies and procedures.


text: As of December 31, 2023, the Fund is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect the Fund's business strategy, results of operations, or financial condition.


text: Cybersecurity Governance The Board of Trustees of the Fund periodically receives reports from BlackRock and from the Advisers regarding BlackRock's cybersecurity program. Team members who support the Fund's information security program have relevant educational and industry experience.


text: Risk Management and Strategy We have developed a framework designed to safeguard our organization's digital assets from threats and vulnerabilities. It involves a systematic approach of identifying, assessing, and mitigating risks associated with our technology systems, data, and operations. Key components of this include assessments of vulnerabilities, establishing security controls and policies, training employees, and having a well-defined incident response plan. Regular testing, compliance adherence, resource allocation, and continuous monitoring are also crucial to keeping our environment secure. We take a proactive approach, aiming to mitigate risk, protect sensitive information, and ensure the resilience of our digital infrastructure from cyber threats. We engage consultants or other third parties in conducting periodic assessments and testing of our policies, standards, processes, and practices.

companyName: Xponential Fitness, Inc.

ticker: XPOF


text: Material risks are those that have the potential to cause substantial harm or financial loss. Our approach involves a targeted strategy to protect critical data, systems, and infrastructure against cybersecurity challenges including cyber threats, data breaches, or regulatory compliance issues.


text: Third-party risk mitigation in cybersecurity is a crucial aspect of safeguarding our digital assets and ensuring data integrity and privacy. We monitor and manage the potential vulnerabilities and security gaps that can arise when working with external vendors, partners, or suppliers who have access to sensitive information or systems. We assess the cybersecurity practices of our third parties by evaluating their compliance with security standards. Evaluating third-party compliance helps us mitigate the risks of data breaches or security incidents originating from external sources, ultimately safeguarding our reputation, legal compliance, and overall cybersecurity posture.


text: We believe that the risks from cybersecurity threats, including as a result of any previous cybersecurity events, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business, results of operations, cash flows and financial condition.


text: The audit committee of our board of directors has primary responsibility for overseeing our risk management process relating to cybersecurity, which includes risks arising from cybersecurity threats.


text: The Vice President of Information Technology works together with our board of directors, audit committee, and members of executive management ("Cybersecurity Team") to set the strategic digital landscape. The Cybersecurity Team provides strategic guidance and oversight to ensure our cybersecurity posture is robust and aligned with our overall objectives. The Cybersecurity Team does this by establishing cybersecurity policies and setting risk tolerance levels, approving budgets for security initiatives, and ensuring compliance with relevant regulations and standards. The Cybersecurity Team engages in regular discussions regarding incident response strategies to assess the preparedness for cyber threats and continually evaluates our incident response plans. The Incident Response Team ("IRT") is led by the Vice President of Information Technology, who is the overall incident response coordinator. The IRT works together with our President to assess risk and materiality of an incident and engage members of Cybersecurity Team as needed.


text: Through ongoing communications with these teams, the Vice President of Information Technology and the Cybersecurity Team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the board of directors and the audit committee when appropriate.


text: Our Vice President of Information Technology's experience includes various roles in information technology and information security for over 15 years. Members of the Cybersecurity Team each hold undergraduate and, in some cases, graduate degrees in their respective fields, and each have experience managing risk at the Company or at similar companies, and assessing cybersecurity threats.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: LENSAR, Inc.

ticker: LNSR


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our board of directors, as a whole and through the Audit Committee, is responsible for the oversight of risk management, including oversight of risks from cybersecurity threats, and discusses with management our major risk exposures, including from cybersecurity threats, their potential impact on us, and the steps we take to manage them.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • an information technology team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Our Business— We rely significantly on the use of information technology. Cybersecurity risks – any technology failures causing a material disruption to operational technology or cyber-attacks on our systems affecting our ability to protect the integrity and security of customer and employee information – could harm our reputation and/or could disrupt our operations and negatively impact our business."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from internal information technology staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including the Director of Information Technology, Chief Operating Officer, Chief Financial Officer, and Principal Accounting Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team collectively has over 30 years of experience managing cybersecurity risks and is knowledgeable about our products and systems.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information technology personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Seer, Inc.

ticker: SEER


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards and Technology and the Center for Internet Security, as well as information security standards issued by the International Organization for Standardization, including ISO 27001. In 2023, our cybersecurity systems and processes achieved ISO 27001 certification. We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology (IT) environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - If we, or our vendors, partners or customers, experience a significant disruption in our information technology systems or breaches of data security, our business could be adversely affected."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of the cybersecurity risk management program. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives periodic briefings from the Audit Committe on our cybersecurity risk management program.


text: The Audit Committee receives regular reports from our dedicated Chief Information Security Officer (CISO) on our cybersecurity risks. In addition, our CISO updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser potential impact.


text: We have established an internal cross-functional leadership committee with the objective of overseeing the cyber security program, incidents, risks and initiatives. The committee is chaired by our CISO and is comprised of the President and Chief Financial Officer, Chief Legal Officer, Chief People Officer, Chief Data Officer, Chief Operations and Product Development Officer and the SVP of Product. This committee oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: The IT management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has over 20 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support and execution and holds a Certified Information Systems Security Professional certification.


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data.

companyName: BYLINE BANCORP, INC.

ticker: BY


text: Managing Material Risks and Integrated Overall Risk Management We have developed an Information Security Program (the "Program") as part of our overall risk assessment and Enterprise Risk Management ("ERM") to address material risks from potential cybersecurity threats, as well as to facilitate the governance and oversight of cybersecurity risks. The Program, which is administered by our Chief Risk Officer, includes policies and procedures that identify how security measures and controls are developed, implemented, maintained and assessed.


text: As part of our ERM, our Board of Directors reviews and approves the Program on an annual basis. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing management's reporting on Program effectiveness. In addition to a Privacy and Security Governance Committee, we also have Governance, Risk, Information Technology and Compliance functions that monitor and address enterprise risks, including cybersecurity risks.


text: A risk assessment, based on a method and guidance from a recognized national standards organization, is conducted at least annually. The risk assessment, along with risk-based analysis and judgment, are used to select security controls to address and to seek to mitigate risks. Factors considered during this process include, but are not limited to, the likelihood and severity of the risk, the impact on the Company and others, such as our customers, if a risk materializes, the feasibility and cost of controls, and the impact of controls on our operations.


text: Engaging Third Parties on Risk Management Specific controls that address cybersecurity risks include endpoint threat detection and response, identity and access management, logging and monitoring involving the use of security information and event management, multi-factor authentication, conditional access, firewalls and intrusion detection and prevention, and vulnerability and patch management. We engage third-party security firms in different capacities to provide or operate some of these controls, such as vulnerability assessments, penetration testing and other procedures to identify potential weaknesses in our systems and processes. In addition, as a financial institution, we conduct appropriate due diligence and monitoring procedures to address potential cybersecurity threats related to the use of third-party technology and outsourced services, including pre-acquisition due diligence, imposition of contractual obligations, and performance monitoring.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: BOX INC

ticker: BOX


text: Oversight of Third-party Risk We have processes in place to oversee and manage risks associated with third-party service providers, including risks related to data breaches or other security incidents. This includes conducting security due diligence reviews of critical third-party providers, subjecting third parties to periodic risk assessments and requiring third parties to sign standard contractual provisions before receiving sensitive information from the Company.


text: Risk from Cybersecurity Treats We recognize that individual employees are frequent targets of threat actors. We regularly train employees on the importance of protecting our information, and communicate with our customers and employees on the importance to protect information and enhancing cybersecurity through security campaigns, newsletters, posters and ad-hoc communications. If specific threats are identified, management may communicate those threats directly to employees for heightened awareness. Our cybersecurity program requires employees to review and acknowledge information security and privacy policies annually, complete multiple cybersecurity training courses throughout the year, and participate in mock phishing campaigns regularly.


text: We also have a written Incident Response Plan and conduct tabletop exercises to enhance incident response preparedness. Business Continuity and Disaster Recovery plans are used to prepare for the potential for a disruption in technology we rely on. Employees undergo security awareness training when hired and annually.


text: While to-date we have not experienced a significant cybersecurity incident, significant data loss or any material financial losses related to cybersecurity attacks on our systems and those of our customers and third-party service providers are under constant threat, and it is possible that we could experience an incident in the future that could have a material adverse effect on our business strategy, results of operations and financial condition. See also Item 1A, Risk Factors – Technology Risks.


text: As a financial institution (or third parties it relies on) we may not be able to fully, continuously, and effectively, implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate, and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: Cybersecurity Risk Management and Strategy We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our client's and our data. We have a global cybersecurity and privacy program to help effectively assess, identify, and manage cybersecurity threat risks. We have developed a list of cybersecurity risks from known threats and our own history to help identify what is most meaningful and potentially impactful to the Company. The cybersecurity and privacy initiatives to address the risks are complex, strategic, and ever evolving. Threats and risks are identified from threat intelligence sources that include our vendors, industry, and government organizations. We continuously monitor and scan the cyber landscape to review evolving threats and risks that may impact us. Information from these various sources are reviewed by our cybersecurity and risk teams to evaluate risks in line with the NIST Cybersecurity Framework. Threat intelligence from other financial institutions and industry consortiums that serve financial institutions, such as the Financial Services Information Sharing and Analysis Center, provides key information on how risks are affecting our industry, with ability to preemptively mitigate emerging threats, as discussed above in Part I, Item 1A of this Form 10-K under the heading Technology and Data Security.

companyName: CRAWFORD & CO

ticker: CRD-A


text: We score cybersecurity risks based on the likelihood and impact on our operations. Such cybersecurity risks are integrated and evaluated as part of the global Enterprise Risk Management ("ERM") program, which is managed by the ERM Director. The Governance Committee of the Board of Directors maintains oversight of the ERM program and the Audit Committee maintains oversight of the cybersecurity program to ensure risks to the Company are managed within our risk appetite.


text: Our ERM program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process when identifying and assessing material risks. Our ERM team collaborates with internal subject matter specialists, as necessary, to gather insights and report on the most significant risks. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to identify threats and improve our incident response plan.


text: We identify and assess cybersecurity incidents based on multiple factors including information from previous events and incidents. The Cybersecurity Incident Response Team ("CSIRT") categorizes events into four levels of severity with defined requirements to assess criticality. The CSIRT informs both our leadership as well as our SEC Cybersecurity Rules Disclosure Committee ("SCRDC"), Cybersecurity and Privacy Council and the Audit Committee of the Board on matters related to cybersecurity risks that are deemed to materially affect the Company.


text: The audit committee receives periodic reports from our CFO concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: IN8BIO, INC.

ticker: INAB