text: Management's Responsibility The Bank's cybersecurity program is managed by our CISO, who reports to the Audit Committee. Management's Corporate Information Security Committee (the "Security Committee"), led by our CISO, is a governance body that drives alignment on security decisions across multiple departments and functional areas within the Bank, while monitoring and managing Cyber risks to minimize exposure to the Bank. Members of the Security Committee include the Chief Information Officer ("CIO"), the CRO, and the COO. The Security Committee oversees processes for assessing, identifying, and managing material risks from cybersecurity threats. The Security Committee meets at least quarterly to review cybersecurity performance metrics, identify cybersecurity risks, and assess the status of approved cybersecurity enhancements. The Security Committee also considers and makes recommendations on cybersecurity policies and procedures, service requirements, and risk mitigation strategies.


text: Our CISO has more than 27 years of Information Technology and 21 years of Information Security experience in financial services including two other regional banks. He holds an undergraduate and master's degree in Cybersecurity and Information Assurance. Our CIO has 25 years of information technology experience and 18 years of experience in the financial services industry. Our CRO has more than 33 years of experience in Banking and over 15 years of experience in risk management, compliance, and BSA. Our COO is a seasoned bank operations executive with over 35 years of banking experience in Operations, Vendor Management, IT, Security, Treasury Management and Payment Operations.

companyName: CVB FINANCIAL CORP

ticker: CVBF

secItem: Item 1C

stage1Category: Management Role

stage1Method: majority


text: Information Technology and Cybersecurity The Company depends on the proper functioning, availability, and security of its information systems, including financial, data processing, communications, and operating systems, as well as proprietary software programs that are important to the efficient operation of the business. The Company also utilizes software applications provided by third parties, grants limited access to the Company's systems to third parties providing specific outsourced functions or other services, and increasingly stores and transmits data using connected information technology or "cloud" systems. Any significant failures or disruptions of the Company's critical information systems, including ransomware attacks or other cyber incidents, that impact the availability or other proper functioning of these systems or that result in the compromise of sensitive or confidential information, including information of tenants, employees, and others (including joint venture partners and Curbline Properties), could result in liability for the Company to third parties and have a significant impact on the Company's operations and reputation.

companyName: SITE Centers Corp.

ticker: SITC

stage1Category: None/Other

stage1Method: unanimous


text: The Company's internal audit team annually assesses and reviews the risks posed to the security of the Company's networks, including a review of system and process assurance for information technology and application controls, and takes into account certain frameworks and policies. The Company's internal audit team also reviews the Company's fraud assessment and confirms IT management's oversight of its cybersecurity policies. This oversight has been integrated into the Company's enterprise risk management system. For example, the Company's management team reviews the findings, if any, of the internal audit team's assessments, analyzed the identified risks, and takes action based on the Company's overall risk profile. In order to assess the risks posed to the Company's information systems by third-party service providers and vendors, the information technology department, coordinating with the Company's internal audit services team, evaluates new software and network application vendors' contracts, internal policies, certifications, and System and Organization Controls ("SOC") reports during the procurement of solutions and services.

stage1Category: Risk Management Process


text: To mitigate the risk and impact of any cybersecurity incidents on the security and availability of the Company's networks, the Company's information technology systems are protected through physical and software safeguards and backup procedures the Company considers appropriate. The Company contracts with independent cybersecurity providers for security event incident management, end-point detection and incident response monitoring, and security incident response services. Additionally, the Company has deployed a layered approach to network intrusion detection and protection using technology provided by industry-leading companies. The information technology department also performs timely system and security updates to maintain current software versions and apply appropriate security updates to reduce the Company's risk.


text: The Company has also implemented various safeguards designed to ensure the confidentiality, availability and the integrity of its network and data, including redundant telecommunication facilities, replicating critical data and backups to multiple off-site locations, a fire suppression system to protect the Company's on-site data center, and electrical power protection and generation facilities. The Company also has a catastrophic disaster recovery plan and alternate processing capability available for its critical data processes in case of a catastrophe that renders the primary data center unusable.


text: The Company conducts annual cybersecurity awareness training for all employees, new-hire cybersecurity training, monthly simulated phishing tests, and additional training for specific departmental requirements as part of the Company's risk mitigation efforts. The Company also maintains cybersecurity insurance; however, there is no assurance that the insurance the Company maintains will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related losses.


text: Under the leadership of the Company's Chief Technology Officer, the Company's information technology department is primarily responsible for assessing and managing material risks to the Company's information systems, including from cybersecurity threats. The Company's Chief Technology Officer has over 30 years' experience working in information technology and managing information technology systems and holds several specialized security certifications, including the Certified Information Security Manager certification from the Information Systems Audit and Control Association. In addition, certain members of the Company's information technology department have obtained specialized security certifications, including accreditation as Certified Information Systems Security Professionals, and have prior work experience in various roles involving technology and security. The Company has established an internal Security and Privacy Governance Committee, comprised of the Chief Technology Officer and other senior members of management that generally meets quarterly. This committee receives updates from the Company's information technology department with respect to the implementation of various systems and security measures, the Company's cybersecurity training and awareness program, enhancements or modifications to the security program, and the impacts of such changes to the Company's information security risk environment. The Company has adopted a Cybersecurity Incident Response Plan, which requires communication of cybersecurity incidents to varying levels and personnel within the organization depending on the severity of the threat impact and encompasses tactics related to cybersecurity, systems and facilities availability, and information privacy.


text: The Board of Directors has specifically delegated oversight of the Company's cybersecurity risks and related practices to the Audit Committee of the Board of Directors ( the "Audit Committee") through the committee's charter. At least annually, senior members of the Company's information technology team (including the Chief Technology Officer) and internal audit services team brief the Audit Committee on information and cyber security matters, including results from risk assessments, the Company's policies and its internal control function. The Audit Committee reviews such information alongside other company risks as part our overall risk assessment process.

stage1Category: Board Governance


text: The Company has experienced issues from cybersecurity threats, including issues related to malware, email phishing, and other events intended to disrupt information systems, wrongfully obtain valuable information, or cause other malicious events. To the best of the Company's knowledge, these threats have not materially affected the Company, nor have they materially obstructed the availability of its information systems and data on which it relies. Although no assurances can be given, the Company does not believe that such threats are reasonably likely to materially affect the Company in the future. See Item 1A. Risk Factors under the caption "Risks Related to the Company's Business, Properties and Strategies—A Disruption, Failure or Breach of the Company's Networks or Systems, Including as a Result of Cyber-Attacks, Could Harm Its Business."

stage1Category: Strategy Integration


text: Introduction: The medical device industry faces unique cybersecurity challenges, given the sensitive nature of the data and the critical role of devices in patient care. Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as information about our employees, contractors, vendors, suppliers, patients and customers. We are committed to implementing robust security measures to protect against potential cyber threats and vulnerabilities that are constantly evolving across the globe.

companyName: Inogen Inc

ticker: INGN


text: Risk Management and Strategy: We have processes for assessing, identifying, and managing cybersecurity threats, and cybersecurity is an integral part of our overall enterprise risk management program which is overseen by our Audit Committee and the Board. Our strategy includes a comprehensive cybersecurity framework, utilizing advanced technologies and methodologies, such as cloud migrations and deployment of threat detection tools to effectively mitigate potential risks. Continuous risk assessments help us better refine our strategy, guiding the deployment of technical safeguards and shaping our incident response plans. For acquired companies, our integration strategies prioritize establishing comprehensive timelines for harmonizing information security, data privacy, and cybersecurity practices. This includes a strong focus on aligning employee education programs to ensure a seamless transition and uphold security and privacy standards across our entities.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: SKECHERS USA INC


text: Our cybersecurity infrastructure is based on a multi-layered defense framework, aligned with the U.S. National Institute of Standards and Technology guidelines. We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers, ensuring the service providers adhere to our security standards, thereby safeguarding our integrated operations. The strategic migration of our data centers and infrastructure to secure cloud environments, coupled with the implementation of targeted technical cybersecurity measures, underscores our dedication to establishing foundational security across our users, applications, data, systems, and networks.


text: We have established a comprehensive incident response plan to swiftly address and recover from cybersecurity incidents, minimizing operational impact. We conduct regular trainings and simulations to enhance our team's awareness and preparedness against cyber threats. Biannual penetration testing and regular assessments by external experts validate the effectiveness of our cybersecurity measures. Our proactive approach to addressing identified vulnerabilities affirms the continuous improvement of our security posture.


text: We have insurance coverage in place for certain potential liabilities and costs relating to cybersecurity risks, data security incidents and/or network security breaches, but this insurance is limited in amount, subject to a deductible, and may not be adequate to cover us for all costs arising from these incidents.


text: Use of Consultants and Advisors: We engage various third-party cybersecurity service providers to assess and enhance our cybersecurity practices and assist with protection and monitoring of our systems and information, including with respect to, network monitoring, endpoint protection, vulnerability assessments and penetration testing. We engage cybersecurity consultants, auditors, and other third parties to assess and enhance our cybersecurity practices, such as a third-party consulting firm to evaluate our cyber processes including an assessment of our incident response procedures.


text: We have processes to evaluate third-party service providers and vendors that have access to sensitive systems and company and customer data, which may include due diligence procedures such as assessments of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. Following an assessment, we determine and prioritize service provider risk based on potential threat impact and likelihood, and such risk determinations drive the level of due diligence and ongoing compliance monitoring required for each service provider.


text: Board Oversight and Management's Role: The Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee oversees the proper functioning of our cybersecurity risk management program to ensures strategic alignment and governance of our cybersecurity efforts at the highest level. All of the Audit Committee members are independent directors. In particular, the Audit Committee assists the Board in its oversight of management's responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our information technology systems, processes and data.


text: Management has implemented risk management structures, policies and procedures, and Management is responsible for our day-to-day cybersecurity risk management. Our Chief Data and Information Officer, or CDIO, is responsible for our day-to-day assessment and management of cybersecurity risks. Our Enterprise Enablement function facilitates a cross-departmental approach, ensuring the executive leadership team receives quarterly updates on cybersecurity from various teams. This strategy promotes a comprehensive stakeholder engagement and enhances management oversight on cybersecurity. The updates cover progress on ongoing cybersecurity initiatives, insights from any potential threats or incidents, outputs and action plans from external vulnerability and penetration tests, and key performance metrics in line with industry standards.


text: Risks from Material Cybersecurity Threats: Despite ongoing threats like cyber-attacks, phishing, and ransomware, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on our business strategy, results of operations or financial condition. Our proactive security measures, alongside those of our third-party vendors, aim to protect our information technology systems and the sensitive data they hold. Although these risks have not yet materially impacted our business, we remain vigilant, continuously monitoring and adapting to evolving cybersecurity threats.


text: We rely on digital technology to conduct our businesses and interact with customers, policyholders, agents, and vendors. With this reliance on technology comes the associated security risks from using today's communication technology and networks.

companyName: HCI Group, Inc.

ticker: HCI


text: Cybersecurity Governance Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. Our Senior Vice President ("SVP") of Information Technology and the Vice President ("VP") of Information Security have overall responsibility for assessing and managing our material risks from cybersecurity threats. To help ensure effective oversight, the Audit Committee receives reports on information security and cybersecurity at least annually, and receives an update quarterly on information security and cybersecurity from materials provided by the VP of Information Security.


text: Risk Management and Strategy The goal of our cybersecurity risk management strategy is to protect the privacy, integrity, and availability of our critical systems and information. Our processes identify, assess, and manage material risk from cybersecurity threats as part of our entity-wide risk management efforts. To safeguard our data and the data of our customers, management utilizes a multi-layered approach consisting first of an external security operations center company that specializes in the detection and containment of cyber-attacks. For protection of endpoint devices connected to our network, we use the tailored security software of a third-party consultant company for managed detection and response. Perimeter defense technology is used to filter e-mail for threats from malware viruses and e-mail phishing attempts. We also detect threats through the use of our firewalls that monitor incoming and outgoing network traffic.


text: Tools utilized to prevent threats include multifactor authentication, e-mail security services, mobile e-mail security policies, virtual private networks, third-party security experts, and timely applied software patches, among others. We engage in annual penetration testing, disaster recovery testing, internal and external audits of our cybersecurity controls and simulated cyberattack scenarios to gauge our preparedness for these situations. In addition, employees are required to pass a mandatory cybersecurity training course annually and receive periodic phishing simulations to facilitate recognizing phishing attempts. We carry Cyber Insurance which includes access to a Cyber Incident Response team in the case of a cybersecurity event.


text: Management of cybersecurity also extends to third-party service providers we use for specialized purposes such as payroll processing, investment tracking, regulatory financial reporting, and equity compensation plan administration. Our communication with these providers is protected by the safeguards within our security operation center. In addition, we annually obtain a Service Organization Controls (SOC) report on the suitability and operating effectiveness of the providers' controls, known as a SOC 1 Type 2 Report. The report is prepared by an independent service auditor. We review such reports to confirm the existence of effective controls over unauthorized access at third party service providers.


text: We respond to cybersecurity events in accordance with our Cyber Security Incident Response Plan (CSIRP), which follows the guidance of the National Institute of Standards and Technology Cybersecurity Framework and provides for assessment, mitigation, and if necessary, remediation of any effects of a system breach. We also conduct annual breach simulations with internal information technology teams to test each step of our CSIRP.


text: There have been no cybersecurity events in the past that have materially affected the Company's business strategy, results of operations, or financial condition. Although we believe our defenses against cyber-intrusions are sufficient, we continue to update our prevention programs to respond to sophisticated and rapidly evolving attempts to overcome our security measures. Such continuing threats could have a variety of adverse business impacts. See Item 1A – "Risk Factors" under the heading "Security and fraud risks" above for additional information on risks to our business from cybersecurity incidents and related matters.


text: Cybersecurity is a critical component of our overall risk management process. Our Board of Directors oversees our cybersecurity efforts as delegated to and performed by senior management which is responsible for the identification and assessment of material risks from cybersecurity incidents. The members of management responsible for managing cybersecurity threats are HCI Group's Director of Information Technology (IT) and its Network Security Manager, and the President of Exzeo USA, Inc., TTIG's software development and IT company. Both the Director of IT and the President have extensive experience in managing information systems including the defense of computer networks against cyber intrusions. The Network Security Manager is dedicated to overseeing our multi-layered cybersecurity defenses and leads monthly security meetings attended by IT managers.


text: Our Board receives periodic reports on cybersecurity risks and any material cybersecurity incidents. One member of our Board of Directors, Paresh Patel, has information technology expertise.


text: Risk Management and Strategy We recognize the critical importance of cybersecurity and data privacy in safeguarding our operations, sensitive data, and maintaining the trust of our stakeholders. We acknowledge the significance of cybersecurity incidents and threats as potential risks that may impact our operations and information systems. We have developed and implemented cybersecurity and data privacy programs in accordance with the requirements of ISO standards 27001:2022 and 27701:2019, which are intended to appropriately preserve the confidentiality, integrity, and availability of information maintained by our company. These programs identify, select, maintain, operate, and improve cybersecurity and privacy controls.

companyName: EXPONENT INC

ticker: EXPO


text: The VP of Information Security oversees the Information Security Steering Committee ("Steering Committee"), which provides education on the Company's cybersecurity programs and controls to key members of the Company. The Steering Committee meets quarterly and is comprised of members from the Executive Leadership Team, including the Chief Financial Officer and Executive Vice President of Business Affairs, as well as the SVP of Information Technology, VP of Information Security, VP of Corporate Communications, SVP of Digital Innovation, and Head of Global Human Resources.


text: We evaluate each third-party service provider to verify the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures, and to promptly report any suspected breach of security measures that may affect the Company. Our Board of Directors and Audit Committee are responsible for overseeing our cybersecurity risk management and strategy.

companyName: Aldeyra Therapeutics, Inc.

ticker: ALDX

stage1Category: Third-Party Risk


text: We have implemented processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are designed to preserve the confidentiality, integrity, and availability of our information systems and the information residing therein. Our cybersecurity incident response plan is based on the NIST 800-61r2 "Computer Security Incident Handling Guide." This plan is used to process security events identified through our real-time, 24x7 monitoring, and is also used to conduct security incident tabletop exercises. The incident response plan includes detailed steps for incident leadership, escalation to established partners, response protocols based on the type of incident, responsibilities for follow-up and reporting, and steps to capture lessons learned and improvement opportunities. Our vulnerability management processes include real-time monitoring for vulnerabilities and standardized reporting for managing remediation efforts. Our cybersecurity risk management processes are integrated into our overall risk management system to ensure alignment with our business objectives and strategies. We engage assessors, consultants, auditors and other third parties to execute certification audits, penetration tests, and security framework risk assessments. These external entities provide specialized expertise and insights to enhance the effectiveness of our cybersecurity risk management processes.


text: We have established processes to oversee and identify cybersecurity risks associated with our use of third-party service providers, including cloud service providers and AI system. We conduct due diligence assessments and evaluate contractual obligations to mitigate potential risks arising from third-party relationships.


text: Cybersecurity threats, including previous incidents, have the potential to materially affect our company, including our business strategy, results of operations, and financial condition. While we have not experienced material adverse effects from cybersecurity threats to date, we recognize the evolving nature of these risks and remain vigilant in our efforts to mitigate potential impacts.


text: Our Board of Directors provides oversight of risks from cybersecurity threats. The Security and Privacy Management Committee (the "SPMC") consists of our Chief Financial Officer, General Counsel, Vice President of Information Technology, Chief Human Resources Officer, Director of Information Security and Director of Environmental Health and Safety. The SPMC is tasked with ensuring risks are adequately addressed within our governance framework.


text: We maintain a dedicated team of cybersecurity professionals. The Director of Information Security, the Information Security team, the SPMC, the Vice President of Information Technology, and the Information Technology leadership team are principally responsible for assessing and managing cybersecurity risks for our company. These individuals possess relevant expertise in cybersecurity risk management and are equipped to address the evolving nature of cyber threats. Our Director of Information Security has over 20 years of cybersecurity experience, holds several professional certifications and is an adjunct faculty member teaching courses on information security management and governance. Our cybersecurity professionals have a proven track record of executing strategic security objectives across various sectors, including utility, government, healthcare, and consulting. They bring with them experience in designing, implementing, and managing information security programs focused on quality, performance, and compliance.


text: Our information security team and our third-party security service providers actively monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents, ensuring timely response and resolution. Processes are in place to inform relevant management positions and committees about emerging threats and incident response activities. The Director of Information Security provides regular updates on cybersecurity risks and incidents to the Board of Directors, the SPMC, and IT leadership.


text: CYBERSECURITY RISK MANAGEMENT AND STRATEGY We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. This process is supported by both management and our Board of Directors.


text: We have developed and implemented a Cybersecurity Risk Management Program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.


text: We leverage industry standard frameworks such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and Center for Internet Security ("CIS") framework to inform how we identify, assess and manage cybersecurity risks relevant to our business.


text: Our Cybersecurity Risk Management Program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of our employees, and incident response personnel; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • a third-party risk management process for service providers, suppliers, and vendors; and • engage ment of third parties for our 24/7 monitoring, detection, and response; regular penetration testing, program controls assessment, and proactive incident preparedness activities.


text: Our Audit Committee is responsible for overseeing our major financial, legal, and regulatory risk exposures, which span a variety of areas, including cybersecurity.

companyName: Outset Medical, Inc.

ticker: OM


text: Cybersecurity risk management is led by our VP of Information Security and our SVP of Information Technology, who reports to our Chief Operating Officer, who are generally responsible for management of cybersecurity risk and the protection and defense of our networks, systems and data. The VP of Information Security manages a team of cybersecurity professionals with broad experience, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, digital security and regulatory compliance.


text: Our VP of Information Security has over 15 years of experience in technology and information security, serves on the board of directors of the Retail & Hospitality Information Sharing and Analysis Center ("RH-ISAC") and holds several cybersecurity and risk management certifications. Our SVP of Information Technology has over 30 years of information technology management and cybersecurity experience and has held leadership roles overseeing all aspects of information technology operations for multiple Fortune 500 and Fortune 50 global companies, particularly in the retail and media & entertainment sectors.


text: We continue to invest in cybersecurity and resiliency of our networks and adapt our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Item 1A "Risk Factors."


text: Cybersecurity is critical to the delivery of our services to our clients. We face cybersecurity threats that are common to most industries. We have a cybersecurity risk management program in place that is designed to assess, identify, manage, and govern material risks from cybersecurity threats. This program is a key component of our enterprise risk management program. The Company's Board is responsible for oversight of the Company's information technology systems, including cybersecurity, and has delegated such oversight to the Audit Committee. The Audit Committee regularly reviews the status of the initiatives such as the seeking of certifications associated with our information technology systems and receives regular updates on matters relating to information technology and cybersecurity. Our corporate information security organization, led by our Senior Director of IT who reports to our Chief Financial Officer, is responsible for our overall information security strategy, policy, security, operations and cyber threat detection and response. Our current Senior Director of IT has an extensive background and experience in information technology management and design, and data security. An integral part of our cybersecurity framework is our Security Response Team which is responsible for the detection, review, and response to cybersecurity incidents. In the event of a security incident, we intend to follow our detailed incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas as well as senior leadership and the Board, as appropriate.

companyName: HACKETT GROUP, INC.

ticker: HCKT


text: We regularly review the effectiveness of our cybersecurity controls, promptly addressing any identified risk areas and subject our information technology systems to testing performed by external parties on an annual basis. Our employees are required to successfully complete training on topics relating to our cybersecurity, data privacy and information security policies and procedures. Training is administered and tracked through online training modules. In addition, we perform periodic testing to evaluate the effectiveness of our training programs and to help prevent loss associated with the disclosure of electronic information. We also leverage third-party service providers and solutions across our operations to review, test, and assess our security systems and controls, as well as assist in the mitigation of any potential cyber risks. We recently obtained our second ISO 27001 certification.


text: To further bolster our cybersecurity controls, we also have a third-party risk management program in place applicable to all of its contractors, vendors, and service providers which includes risk assessments, cybersecurity questionnaires, data privacy addendums, and contractual flow-downs of legal and regulatory requirements. We also require our contractors, subcontractors, vendors and service providers to report security incidents to us without undue delay.


text: To date, the Company has not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business operations or financial condition. Despite the extensive approach we take to cybersecurity, prevention of a cybersecurity incident cannot be completely guaranteed. Please refer to "Item 1A. Risk Factors – We rely on information technology and security systems and any damage, interruption or compromise of our information technology and security systems or data could disrupt and harm our business" and "Item 1A. Risk Factors – A breach of our information technology and security systems could materially adversely affect our business" for further information.


text: At Outset, we strive to protect the confidentiality, integrity and availability of the personal data entrusted to us. We continue to invest in our cybersecurity program in an effort to enhance our ability to prevent, detect, contain, and mitigate cybersecurity threats.


text: Oversight of our information security program, including oversight of risks related to cybersecurity threats and the assessment and management of such risks, is accomplished through a governance structure which includes our Board, Audit Committee, and executive management.


text: BOARD AND AUDIT COMMITTEE OVERSIGHT One of the key functions of our Board is informed oversight of our risk management process. Our Board focuses on the overall risks affecting us and delegates responsibility for oversight of certain specific risks to its standing committees. For significant risks related to cybersecurity, the Board has delegated oversight responsibility to the Audit Committee.


text: Our full Board and Audit Committee are kept informed about significant risks related to cybersecurity, including enterprise-level risks from cybersecurity threats. The Board receives written updates, generally on a quarterly basis, regarding the status of our information security program. In addition, the Audit Committee receives in-person updates on our information security programs on at least an annual basis. These updates generally cover topics such as our cybersecurity strategy, the threat landscape, key cybersecurity risk areas facing the organization, any key findings of audits and testing, the status of key initiatives, as well as a review of any major incidents.


text: Executive management plays a significant role in assessing and managing material risks from cybersecurity threats. Our VP of Information Technology manages our information security program.


text: Executive leadership Our VP of Information Technology and the information security team periodically present information about the Company's information security program, including program goals and actions, progress against key initiatives and key risks, to our executive leadership team. As described above, significant risks related to cybersecurity are escalated to the Audit Committee and/or the full Board as appropriate.


text: Cross-functional management engagement We have established a committee comprised of leaders from key functions across the Company including, but not limited to, information security, IT, engineering, legal, privacy, finance, and people operations. Members of this committee generally meet regularly to review the Company's cybersecurity program, the evolving threat landscape and key related action items.


text: Governance of information security risks We have also established a risk governance committee, which generally meets on a quarterly basis. This committee, which is sponsored by our VP of Information Technology, is comprised of Company leaders from information security, information technology (IT), legal, privacy, finance, operations, and other functions, who have experience in managing cybersecurity risks, who review the cybersecurity threat landscape, and who evaluate key emerging data security risks. The committee reviews certain cybersecurity-related risks facing the company; discusses open policy exceptions and key risk indicators; and manages cybersecurity risks presented by the information security team and proposed mitigation actions. Members of this committee review the key risks identified as an outcome of our cybersecurity risk management strategy described below.


text: Risk Management and Strategy Our cybersecurity risk management program is designed to identify, assess, and manage reasonably foreseeable material risks facing Outset from cybersecurity threats. We identify cybersecurity risks in various ways, including but not limited to the ongoing monitoring of our systems using various technologies and processes, monitoring of emerging threats, third-party penetration testing of our device and systems, vulnerability scanning and assessments, and cross-functional risk discussions. We have also received Systems and Organizations Controls 2 (SOC 2) certification for Tablo cloud. We have developed processes to help us track, prioritize, and manage identified cybersecurity risks. For example, risks are defined, categorized, and assigned a risk rating based on potential impact and likelihood, which informs acceptance, mitigation or remediation actions which should be undertaken. The Risk Governance Committee reviews key identified risks and discusses related mitigation actions in response to such risks.


text: We have operationalized key processes to help us identify, assess, manage, and mitigate reasonably foreseeable risks from potential cybersecurity threats. For example: • USE OF THIRD PARTIES: We engage third-party cybersecurity consulting firms to assist us with various aspects of our cybersecurity risk management program. For example, we currently consult with third party firms to assist with our annual penetration testing for the Tablo device, Tablo cloud and IT infrastructure. In addition, In addition, we used a third-party audit firm accredited by the American Institute of Certified Public Accountants (AICPA) to support us in the SOC 2 certification process for Tablo cloud. • VENDOR ASSESSMENT: We leverage a third-party risk assessment tool to help us identify cybersecurity, privacy, and operational related risks associated with our use of certain third-party service providers. • INCIDENT PREPAREDNESS AND RESPONSE: We maintain a Cybersecurity Incident Response Plan (IRP) which establishes a framework designed to enable us to respond to cybersecurity incidents in a consistent, timely and effective manner. Our IRP outlines procedures for identifying, reporting, investigating, assessing, and responding to cybersecurity incidents, including incident response team formation, roles and responsibilities by department, and communication and escalation protocols. Depending on the severity of the cybersecurity incident, our IRP contemplates escalation to our executive leadership team and the Audit Committee and/or the full Board, as well as periodic briefings on developments related to the incident response. We periodically review and update our IRP and have conducted training of key team members regarding the IRP. In addition, we have conducted a tabletop exercise to simulate a response to a cybersecurity incident. • SECURITY STANDARDS: Our IT and Tablo cloud security architecture are designed to comply with the HIPAA Security Rule. In addition, our Tablo cloud security architecture leverages recognized frameworks designed to protect customer data. For example, we have received SOC 2 certification for Tablo cloud and we are working to align our processes, protocols and product software with the FDA's recent cybersecurity guidance finalized in September 2023. We periodically examine our security controls and take steps to review, prioritize and address key compliance gaps where identified, using a risk-based approach. • TECHNICAL SAFEGUARDS: We perform information security maturity assessments and penetration testing for the Tablo device and Tablo cloud (including in connection with new product features and services), as well as for our IT infrastructure. We conduct vulnerability scans across key assets, core infrastructure, and endpoints to identify potential vulnerabilities and potential cybersecurity events. We assess and prioritize the remediation of vulnerabilities and other cybersecurity risks identified through these activities, using a risk-based approach. • THREAT LANDSCAPE AWARENESS: We regularly receive and review threat landscape bulletins from Health Information Sharing and Analysis Center (H-ISAC), Cybersecurity and Infrastructure Security Agency (CISA) and others, and incorporate enhancements into our ongoing cybersecurity program based on this review. • INSURANCE: We maintain information security risk insurance coverage to mitigate potential losses in the event of a business disruption.


text: • TRAINING: All Outset employees are assigned HIPAA and information security training as part of the new employee onboarding process and refresher training is assigned annually. Our IT team also conducts continuous automated phishing simulation campaigns, which can trigger additional training for employees on how to recognize social engineering attempts (e.g., phishing, smishing, etc.). We track employee performance on phishing exercises to help us monitor the awareness of our employees and inform future training priorities. For employees whose jobs require access to sensitive data, including PHI, additional security training may be required.


text: Risks from Cybersecurity Threats Our business relies on secure and continuous processing of information and the availability of our IT networks and IT resources, as well as critical IT vendors that support our technology and data processing operations. Security breaches, computer malware and computer hacking attacks have become more prevalent across industries and may occur on our systems or those of our third-party service providers. Attacks upon IT systems are increasing in their frequency, levels of persistence, sophistication, and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. We may face increased risks from cybersecurity threats due to our reliance on internet technology and the increased frequency of employees working remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities.


text: o Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks.

companyName: BlackRock Direct Lending Corp.


text: Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that would provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: STORE CAPITAL LLC


text: We regularly monitor for, defend against, and respond to cybersecurity threats to our networks and information systems, as well as other types of security threats and incidents. Despite our information security efforts, our facilities, systems, servers, platforms and data, as well as those of our third-party cloud and other service providers and Tablo's two-way wireless communication system, may be vulnerable to privacy and information security incidents and may be breached due to the actions of outside parties, employee error or misconduct, malfeasance, or a combination of these and, as a result, an unauthorized party may obtain access to our data or the personal information maintained by us or on our behalf. These include data breaches, viruses or other malicious code, exploitation of known or unknown vulnerabilities, coordinated attacks, data loss, phishing attacks, ransomware, denial of service attacks, insider threats or other security or IT incidents caused by threat actors, technological vulnerabilities, or human error. Additionally, outside parties may attempt to fraudulently induce employees to disclose sensitive information to gain access to the data and personal information we maintain. As of the date of this Annual Report, we are not aware of any material adverse impact to our business or operations from cybersecurity threats or incidents. We do, however, recognize that the cybersecurity landscape evolves rapidly and that we are not immune to such incidents. If we, or any of our third-party service providers, fail to comply with laws requiring the protection of sensitive personal information, or fail to safeguard and defend personal information or other critical data assets or IT systems, or if our incident response, containment or mitigation measures are inadequate in the face of a particular data breach or cybersecurity incident, we may face significant business interruptions, incur reputational damage, and be subject to regulatory enforcement and fines as well as private civil actions. We may be required to expend significant resources in the response, containment, and mitigation of cybersecurity incidents as well as in defense against claims that our information security was unreasonable or otherwise violated applicable laws or contractual obligations. In addition, to the extent that our cloud and other service providers experience security breaches that result in the unauthorized or improper use of confidential information, employee information or personal information, we may not be indemnified for any losses resulting from such breaches. If we are unable to prevent or mitigate the impact of such security breaches or other cyber events that impact our operations, our ability to attract and retain new customers, patients, and other partners could be harmed, as they may be reluctant to entrust us with their data, and we could be exposed to litigation and governmental investigations, which could lead to a potential disruption to our business or other adverse consequences.


text: In addition, manufacturing operations at our Mexico-based facility may also suffer disruptions from cybersecurity attacks, which could negatively impact our ability to produce Tablo consoles and cartridges, restrict or delay our ability to deliver products to our customers and meet our customers' demand on a timely basis, and result in customer dissatisfaction, all of which would adversely impact our results of operations. Moreover, we use Amazon Web Services to support Tablo's cloud connectivity and any disruption of service as a result of cybersecurity attacks could interrupt or delay our ability to receive and deliver certain treatment and reporting information from and to providers and patients. The continuing and uninterrupted performance of Tablo is critical to our success and any repeated or prolonged system failures may damage our reputation, reduce the attractiveness of Tablo to providers and patients, and result in decreased demand for Tablo, thereby adversely affecting our business, financial condition and results of operations. For more information on the risks we face from cybersecurity threats and the potential impacts on our company, see the section above entitled "Risk Factors" under Part I, Item 1A, including the risk factor entitled "We may face additional costs, loss of revenue, significant liabilities, harm to our brand, decreased use of our platform and business disruption if there are any security or data privacy breaches or other unauthorized or improper access."


text: Cybersecurity Risk Management and Strategy The Company is externally managed by the Advisor and has no employees or internal information systems. Thus, the Company relies on the Advisor, BlackRock, Inc. ("BlackRock") as well as the custodian and other service providers to protect the Company's information from cybersecurity threats. The Company's chief compliance officer (the "CCO") oversees the Company's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board of Directors. The CCO and the Advisor also review key Company service providers' compliance and risk management policies and procedures related to cybersecurity matters, evaluate such service providers' use of information systems, which have the potential to subject the Company to information technology vulnerabilities, and receive reports from the Company's service providers regarding any cybersecurity threats and incidents.


text: Specifically, the Company relies on the enterprise risk management ("ERM") framework of BlackRock, Inc. ("BlackRock") for the Company's cybersecurity risk management and strategy. The Board of Directors of the Company periodically receives reports from BlackRock and from the Advisor regarding BlackRock's cybersecurity program. Key aspects of the ERM framework are summarized below.


text: BlackRock's Enterprise Risk Management Framework BlackRock recognizes the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Cybersecurity represents an important component of BlackRock's approach to ERM. BlackRock leverages a multi-lines-of-defense model with cybersecurity operational processes executed by global information security and other teams and dedicated internal audit technology and technology risk management ("TRM") teams that independently review technology risks. BlackRock's cybersecurity program is fully integrated into its ERM framework and is aligned with recognized frameworks, including NIST CSF, FFIEC CAT, FedRAMP, SOC 1/2, ISO 27001/2 and others. BlackRock aims to inform and continuously improve its cybersecurity program through engagement with regulatory, client, insurer, vendor, partner, peer, government and industry organizations and associations, as well as external audit, technology risk, information security and other assessments.


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas: o Governance: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's board of directors (BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC").


text: o Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls; perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention; tabletop exercises, ongoing vulnerability and patch management; vendor due diligence; multi-factor authentication; device encryption; application security, code testing and penetration testing; endpoint security, including anti-malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges; employee awareness, training, and phishing testing; data loss prevention program and monitoring; information security incident reporting and monitoring; and layered and comprehensive access controls.


text: o Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis.


text: o Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third-party systems. Operational incidents can arise as a result of failures by third parties with which BlackRock does business, such as failures by internet, communication technology and cloud service providers or other vendors to adequately follow processes and procedures, safeguard their systems or prevent system disruptions or cyber-attacks. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.


text: o Education and Awareness: BlackRock's employees and contractors are required to complete an annual information security training to equip them with effective tools to address cybersecurity threats, and to receive communications on BlackRock's evolving information security policies and procedures.


text: BlackRock's global information security team, in collaboration with the technology risk and internal audit teams, engages in the periodic assessment and testing of BlackRock's cyber risks and cybersecurity program. These efforts may include a wide range of activities, including audits, assessments, wargames and "tabletop" exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. BlackRock also participates in financial services industry and government forums in an effort to improve both internal and sector cybersecurity defense. BlackRock regularly engages third parties and advisors to assess its cybersecurity control environment. The results of certain program and control assessments are reported to the Risk Committee, and BlackRock adjusts its cybersecurity program as appropriate based on the information provided by these assessments.


text: As of December 31, 2024, the Company is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.


text: Cybersecurity Governance The Board of Directors of the Company periodically receives reports from BlackRock and from the Advisor regarding BlackRock's cybersecurity program. The CCO delivers quarterly reports to the Board of Directors of the Company. Team members who support the Company's information security program have relevant educational and industry experience.


text: At the BlackRock parent level, BlackRock's Board is actively engaged in the oversight of BlackRock's risk management program. The Risk Committee assists the Board with its oversight of BlackRock's levels of risk, risk assessment, risk management and related policies and processes, including risks arising from cybersecurity threats. The Risk Committee receives regular reports on BlackRock's cybersecurity program, technology resilience risk management and related developments from members of our information security team, including the CISO. The Board and the Risk Committee also receive information regarding cybersecurity incidents that meet certain reporting thresholds. On an annual basis, senior members of BlackRock's technology, risk and information security teams provide a comprehensive overview of BlackRock's cyber risk and related programs to a joint session of the Board's Risk and Audit Committees.


text: Technology and cybersecurity risks at BlackRock are also overseen by the TRCC, a dedicated management risk governance committee and sub-committee of the firmwide ERC. The chair of the TRCC is appointed by the head of Enterprise Risk Management at BlackRock and its members include the CISO as well as a broad range of senior business stakeholders across BlackRock. The TRCC is responsible for oversight of BlackRock's technology and cybersecurity risk management practices and helps ensure that technology and cybersecurity risks remain within firmwide risk tolerances and technology and cybersecurity risk issues are escalated as appropriate to the ERC and other committees. The TRCC also reviews any relevant technology and cybersecurity risk related issues and helps ensure that they are appropriately escalated, reported, and remediated.


text: The Audit Committee of our Board of Directors provides direct cybersecurity risk oversight. Our management provides timely disclosure and related updates to the Audit Committee regarding potential cybersecurity threats, incidents and general risks.

companyName: Rezolute, Inc.

ticker: RZLT


text: BlackRock's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by BlackRock's CISO. As of December 31, 2024, the CISO had over 30 years of experience in information technology with a 25-year concentration in information security, including previously serving as the CISO at several global financial institutions, and held the Certified Information Systems Security Professional certification. The CISO works closely with the leadership team and other subject matter experts in the global cybersecurity group, who collectively have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and overseeing cybersecurity controls in technology risk and audit functions, as well as having relevant degrees and industry-leading certifications.


text: The CISO and members of the TRCC monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation of BlackRock's incident response plan.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: 4D Molecular Therapeutics, Inc.

ticker: FDMT


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The Committee members receive presentations on cybersecurity topics from our Senior Vice President, Information Technology & Facilities, internal security staff or external experts as part of the Committee's continuing education on topics that impact public companies.


text: Our management team, including our Sr. Director, Information Technology Operations and Security, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes decades of security management in the Financial & Life Sciences industries.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We maintain an information security program and governance framework that is designed to protect our information systems against operational risks related to cybersecurity.

companyName: Ridgepost Capital, Inc.

ticker: RPC


text: Cybersecurity Risk Management and Strategy We utilize third party cybersecurity consultancy firms to manage and execute our cybersecurity programs. These third party firms are led and supervised by our Chief Information Officer ("CIO"). Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards. On a quarterly basis, our third party cybersecurity consultancy firms perform phish testing and on demand information security training. On a yearly basis, our third party consultancy firms perform, among other trainings and assessments, information security awareness training, internal cybersecurity risk assessments, internal and external penetration tests, key vendor risk assessments, incident response tabletop exercises, written information security and business continuity plan policy gap analysis reviews and revisions as well as incident response plan reviews and revisions. The results of the assessments are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee and members of management.


text: While we do not believe that our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive, and, similar to other global financial services firms, we, as well as our clients, investors, associates, regulators, service providers, and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber attacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. For more information on risks to us from cybersecurity threats, see "Operational risks, data security breaches, loss or leakage of data and other interruptions of our information technology systems or those of our third-party service providers may disrupt our business, compromise sensitive information related to our business, or prevent us from accessing critical information, which may result in losses or limit our growth." in "Item 1A – Risk Factors" of this Form 10-K.


text: Our Board of Directors and Audit Committee are primarily responsible for overseeing and governing our cybersecurity risk management program. Our Board receives updates on cybersecurity and material cybersecurity risks as needed and at least annually by our Chief Compliance Officer or their designee.


text: Management's Role Our CIO, who has 15 years experience in technology, has primary responsibility for assessing and managing material cybersecurity risks, including overseeing and identifying cybersecurity risks associated with our use of third party cybersecurity consultancy firms, and are members of management's IT Steering Committee, which consists of management team members and certain employees who drive alignment on technology and security decisions across the Company. The IT Steering Committee meets monthly to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The IT Steering Committee also considers and makes recommendations to management, the Board of Directors and the Audit Committee on security policies and procedures, security service requirements, and cybersecurity risk mitigation strategies.


text: All companies utilizing technology are subject to threats of breaches of cybersecurity. To mitigate the threat to our business and address regulatory requirements, we take a comprehensive approach to cybersecurity risk management and have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We continue to make proactive and strategic investments to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are imbedded into our overall risk management governance and are reviewed at least annually by the Audit Committee of our board of directors.


text: Risk Management and Strategy We have implemented a set of comprehensive cybersecurity and data protection policies and procedures. Our employees and contractors receive regular cybersecurity awareness trainings, including specific topics related to social engineering and email fraud. We have engaged consultants with significant expertise and certifications in cybersecurity related to our industry. For continuous cybersecurity monitoring across our information technology environment, we have invested in advanced technologies that are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.


text: Our information security policy is based on recognized industry standards and cover areas such as risk management, data backup, and data recovery. We engage consultants and IT managed service providers (IT MSP), to help us design and implement our cybersecurity policies and procedures. IT MSP assist us with monitoring security threats and vulnerabilities and responding to identified cybersecurity incidents, including prompt escalation and timely communication of major security incidents to senior business leadership and the Audit Committee. We conduct cybersecurity penetration testing as warranted to identify and remediate cybersecurity gaps.


text: Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our current IT consultants and IT MSP, who report to our Chief Development Officer.


text: Cybersecurity Threat Disclosure There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our "Risk Factors" in Item 1A include further detail about the material cybersecurity risks we face, to date, we are not aware of any cybersecurity threats that have materially affected our business. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data.

companyName: BYLINE BANCORP, INC.

ticker: BY


text: Managing Material Risks and Integrated Overall Risk Management We have developed an Information Security Program (the "Program") as part of our overall Enterprise Risk Management ("ERM") framework to address material risks from potential cybersecurity threats, as well as to facilitate the governance and oversight of cybersecurity risks. The Program, which is administered by our Chief Risk Officer, includes policies and procedures that identify how security measures and controls are developed, implemented, maintained and assessed.


text: As part of our Risk Governance, our Board of Directors reviews and approves the Program on an annual basis. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing management's reporting on Program effectiveness. In addition to Board Oversight, we also have Governance, Risk, Information Technology, Information Security, and Compliance functions that monitor and address enterprise risks, including cybersecurity risks.


text: A risk assessment, based on a method and guidance from a recognized national standards organization, is conducted at least annually. The risk assessment, along with risk-based analysis and judgment, are used to select security controls to address and to seek to mitigate risks. Factors considered during this process include, but are not limited to, the likelihood and severity of the risk, the impact on the Company and others, such as our customers, if a risk materializes, the feasibility and cost of controls, and the impact of controls on our operations.


text: Engaging Third Parties on Risk Management Specific controls that address cybersecurity risks include endpoint threat detection and response, identity and access management, logging and monitoring involving the use of security information and event management, multi-factor authentication, conditional access, firewalls and intrusion detection and prevention, and vulnerability and patch management. We engage third-party security firms in different capacities to provide or operate some of these controls, such as vulnerability assessments, penetration testing and other procedures to identify potential weaknesses in our systems and processes. In addition, as a financial institution, we conduct appropriate due diligence and monitoring procedures to address potential cybersecurity threats related to the use of third-party technology and outsourced services, including pre-acquisition due diligence, imposition of contractual obligations, and performance monitoring.


text: Oversight of Third-party Risk We have processes in place to oversee and manage risks associated with third-party service providers, including risks related to data breaches or other security incidents. This includes conducting security due diligence reviews of critical third-party providers, subjecting third parties to periodic risk assessments and requiring third parties to sign standard contractual provisions before receiving sensitive information from the Company.


text: Risk from Cybersecurity Treats We recognize that individual employees are frequent targets of threat actors. We regularly train employees on the importance of protecting our information, and also regularly communicate with our customers and employees. If specific threats are identified, management may communicate those threats directly to employees for heightened awareness. Our cybersecurity program requires employees to review and acknowledge information security and privacy policies annually, complete multiple cybersecurity training courses throughout the year, and participate in mock phishing campaigns regularly.


text: We also have a written Incident Response Plan and conduct tabletop exercises to enhance incident response preparedness. Business Continuity and Disaster Recovery plans are used to prepare for the potential for a disruption in technology we rely on. Employees undergo security awareness training when hired and annually.


text: While to-date we have not experienced a material cybersecurity incident, significant data loss or any material financial losses related to cybersecurity attacks on our systems and those of our customers and third-party service providers, we are under constant threat, and it is possible that we could experience an incident in the future that could have a material adverse effect on our business strategy, results of operations and financial condition. See also Item 1A, Risk Factors – Technology Risks.


text: As a financial institution (or third parties it relies on) we may not be able to fully, continuously, and effectively, implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate, and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: Risk Management Strategy We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: CRYO CELL INTERNATIONAL INC

ticker: CCEL


text: We have begun to conduct risk assessments at least annually to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls and other safeguards we have put in place to manage such risks. Our risk management process also encompasses cybersecurity risks associated with the use of our major third-party vendors and service providers. Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards.


text: We believe we have allocated adequate resources related to our cybersecurity risk management processes and have designated our Chief Information Officer with the responsibility of managing the cybersecurity risk assessment and mitigation process with the oversight of the Chief Financial Officer responsible for the consolidated financial statements for the year ended November 30, 2024. As part of our overall risk management program, we provide cybersecurity training to employees in high-risk.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks arising from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole.


text: Our Chief Information Officer is primarily responsible for assessing and managing material risks from cybersecurity threats on a day-to-day basis.


text: As required by Item 106 of Regulation S-K, the following sets forth certain information regarding our cybersecurity strategy, risk management and governance.

companyName: Bumble Inc.

ticker: BMBL


text: Risk management and strategy Cybersecurity risk management is an important and rapidly evolving part of our overall risk management efforts. We believe we are a particularly attractive target as a result of the types and volume of personal data and content on our systems and the evolving nature of our products and services. Our products and services reach millions of users and involve the collection, storage, processing, and transmission of large amounts of data. In addition, our business and operations span numerous geographies around the world, involve hundreds of employees, contractors, vendors, developers, partners, and other third parties, and rely on software and hardware that is highly technical and complex. We maintain an information security program that is comprised of policies and controls designed to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated, and we discover vulnerabilities in our program. We continuously work to enhance our information security program and risk management efforts.


text: Our Information Security Management System ("ISMS"), the foundation of our security framework, is designed to protect critical assets (including our users' personal information) and assess, identify, manage and mitigate material risks from cybersecurity threats.


text: The ISMS is applicable to all individuals and third parties providing services to the Company and is informed by multiple industry-recognized standards and frameworks, including the International Organization for Standardization ("ISO") standards for information security management systems, the U.S. National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and the Payment Card Industry ("PCI") Data Security Standard ("PCI-DSS"). It leverages the guidance of ISO 27001 in its design and operation, with policies intended to align to the requirements of ISO 27001 and follow the technical guidance of the appropriate NIST SP 800-53 Security and Privacy Controls standards where applicable. We review our security policies and procedures at least once annually, as well as in connection with significant enterprise-wide changes, such as technical or structural changes in our business or regulatory changes, and our policy content is continuously updated to account for a shifting threat landscape and to incorporate emerging best practices. We are a PCI-DSS Level 1 Merchant and are independently assessed against the PCI-DSS standard annually by an external PCI Qualified Security Assessor. Pursuant to the ISMS, we continuously monitor cybersecurity threats and strive to preemptively identify vulnerabilities. Our vulnerability management program operates on multiple layers of vulnerability discovery, such as third-party software component analysis, static and dynamic security testing, continuous infrastructure vulnerability scanning, cloud infrastructure scanning, independent third-party penetration testing, and a public bug bounty scheme. Our threat detection capabilities include automated 24/7 detection and alerting with automated response protocols designed to support rapid analysis and enrichment for security analysts who are guided by a formally documented Incident Response Plan in the event of a breach, as more fully described below.


text: Since our commencement of operations, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. Past or future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional information about these risks, see "Item 1A. Risk Factors" in this Annual Report.

companyName: 26North BDC, Inc.


text: The ISMS also provides for ongoing processes, tools and methods to bolster our cybersecurity defenses. We provide training to all of our employees, which includes annual information security awareness education, delivery of monthly cybersecurity updates, and simulated phishing exercises. We also host a live, third-party tabletop exercise annually for information security incident response for key individuals, including senior management and other senior leaders of the Company. Additional security features that we have in place that are intended to protect our systems and data from cyber-attacks include: physical and digital access controls, multifactor authentication for domain sign-on, corporate mobile device management, and tools to detect malicious emails and other suspicious activity.


text: Finally, the ISMS incorporates an Incident Response Plan, which outlines the procedures that we use to investigate and respond to cybersecurity events and alerts, an Incident Response Policy, which sets out high-level principles and requirements that apply to cybersecurity incident response, and a Business Continuity Plan, which sets out high-level steps in protecting the services, assets and employees of the Company during an event that disrupts business continuity. The Incident Response Plan includes clearly defined roles and responsibilities, including guidance for reporting up the chain to senior management and, where appropriate, to the Audit Committee and the Board. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. The Incident Response Plan comprises four high-level phases: identification and investigation of a cybersecurity incident (including suspected personal data breaches); containment to lessen any ongoing harm; eradication of the root cause; and, post-recovery, supplementation of the cybersecurity incident record with lessons learned in order to improve our incident response capabilities. The Business Continuity Plan defines the procedures to be followed if there is a critical failure that results in operations at one of our corporate offices being suspended, as well as the procedures to be followed if there is a critical failure of our services or underlying hosting infrastructure that results in significant degradation of a service provided, with an aim to operate at existing service levels throughout the duration of the incident.


text: When engaging third-party critical service providers, we conduct security assessments before engagement and require them to implement comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. As part of such security assessment, we ask the third-party service provider to complete a privacy and security questionnaire, through which we can assess the service provider's security capabilities and maturity, and to provide us with evidence of penetration testing and reports.


text: While we do not believe that, as of the date of this Form 10-K, we have experienced a cybersecurity threat or incident, including as a result of any previous cybersecurity incident, that has materially adversely affected our business strategy, results of operations or financial condition, the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security incidents of these types, and we may not be able to implement effective preventive measures against such security incidents in a timely manner. For more information on risks to us from cybersecurity threats, see Part I, "Item 1A—Risk Factors—Risks Related to Information Technology Systems."


text: We have integrated the process of cybersecurity risk management, including oversight of the ISMS, into our broader risk management framework. The Board has broad oversight of risk management related to us and our business while delegating certain specific risk oversight responsibilities to its committees. The Board oversees our risk management activities through a combination of processes, including direct engagement with management. The Board has determined that the Audit and Risk Committee shall review our compliance with legal and regulatory requirements as well as the effectiveness of our risk management processes. As part of this oversight, the Audit and Risk Committee reviews the guidelines, policies, and practices that govern how senior management handles our exposure to cyber- and privacy-related risks.


text: Our Chief Information Security & Trust Officer ("CISO") leads our cybersecurity program across the Company and oversees the ISMS. He is supported by our Information Security team, which includes the first responders to cybersecurity incidents. Our CISO provides quarterly updates to the Audit and Risk Committee, as well as an annual report to the Board, regarding the Company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies, while maintaining the confidentiality, integrity, and availability of information, including user information under our custody. There are also scheduled monthly meetings where, among others, our CISO, Head of Privacy and a representative of the Sponsor attend, in order to discuss our cybersecurity program, including evaluating the implementation of additional controls, processes, policies, and procedures, as appropriate, as well as any notable security incidents, if any. Our CISO joined the Company in April 2024, and has over 20 years of experience in the field of cybersecurity.


text: The Company recognizes the critical importance of maintaining the safety and security of its systems to protect its customers, maintain its reputation, and preserve the value of the Company and data and therefore have an enterprise-wide risk management framework for overseeing and managing cybersecurity and related risks. The process is supported by both management and its Board of Directors.

companyName: BANCFIRST CORP /OK/

ticker: BANF


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, antimalware functionality and access controls, which are evaluated and improved through vulnerability assessments, audits and cybersecurity threat intelligence.


text: The Company relies heavily on sensitive information to run daily operations and deliver products and services. To protect the availability, integrity, and confidentiality of sensitive information and sensitive infrastructure, the Board of Directors requires the Company develop and implement a comprehensive Information Security Program, which focuses on the confidentiality, availability and security of information and systems. The Information Security Program defines the strategy that the Company uses to protect and secure its systems and media that process and maintain sensitive information. The program details the governance, management, operations, and assurance of the program, and seeks to identify, prevent and mitigate cyber threats and to respond effectively to cyber threats when they occur.


text: The cybersecurity function, is led by the Company's Chief Information Officer ("CIO"), who reports to The Company's Chief Operating Officer ("COO"). The Chief Information Security Officer ("CISO") reports to the CIO and generally is responsible for management of cybersecurity risk and the protection and defense of the Company's networks and systems. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including threat assessments and detection, mitigation technologies, cybersecurity training, incident response, insider threats and regulatory compliance.


text: The Company has not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to its business or operations. Nevertheless, there are no assurances the Company will not experience such an incident in the future. Such incidents, whether or not successful, could result in the Company incurring significant costs related to, for example, rebuilding its internal systems, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, risk of customers moving relationships with the Company to another institution, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually and receive reports on incidents that exceed certain thresholds and updates on responses thereto. The Information Security Committee is directly responsible for oversight of risks related to cybersecurity. The Board receives reports on information security and cybersecurity from the Information Security Committee at least four times a year.


text: Risk Management and Strategy The Company continuously seeks to identify threats, vulnerabilities, and cybersecurity risks on information assets. Threats are identified through experience, regulatory alerts, information sharing, third party vendors, internal and external security assessments, and industry periodicals.


text: The risk assessment process identifies areas that are required to be protected and determine if adequate controls are used to safeguard the Company against threats and vulnerabilities. Adjustments required to adhere to regulatory changes are a regular function of the assessment process as well as changes to technologies, processes, and other factors. From the analyses, any additional controls are identified, prioritized and implemented.


text: Security Controls and Continuous Monitoring Security controls and design are critical to mitigating risks. The Company works to protect its computing environments and products from cybersecurity threats through multi-layered defenses and applies lessons learned from its defense and monitoring efforts to help prevent future attacks. The Company utilizes data analytics to detect anomalies and monitor for possible cyber threats. The Company's Cybersecurity Operations Center provides comprehensive cyber threat detection and response capabilities and maintains a 24x7 monitoring system which complements the technology, processes and threat detection techniques the Company uses to monitor, manage and mitigate cybersecurity threats. From time to time, the Company engages third party consultants or other advisors to assist in assessing, identifying and/or managing cybersecurity threats. The Company's Internal Audit function also conducts information technology and cybersecurity reviews and assessments.


text: Threat Intelligence The Company considers threat intelligence from third party sources to strengthen systems and network preparedness for cybersecurity risks. The Company uses associations, such as the Financial Services Information Sharing and Analysis Center ("FS-ISAC"), to stay informed of threat information.


text: Third Party Risk Assessments The Company conducts information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties, and its standard terms and conditions contain contractual provisions requiring certain security protections.


text: Incident Response and Recovery Planning The Company has established comprehensive incident response and recovery plans and continues to regularly test and evaluate the effectiveness of those plans. The Company's incident response and recovery plans address and guide its employees, management and the Board on its response to a cybersecurity incident.


text: Training and Awareness The Company provides awareness training to its employees to help identify, avoid and mitigate cybersecurity threats. All employees with network access participate annually in required training, including spear phishing and other awareness training. The Company also periodically conducts walkthrough exercises with management and other employees to practice cyber incident response.


text: Cybersecurity Risk Management and Strategy The Fund is externally managed by the Advisers and has no employees or internal information systems. Thus, the Fund relies on the Advisers, BlackRock, Inc. ("BlackRock") as well as the custodian and other service providers to protect the Fund's information from cybersecurity threats. The Fund's chief compliance officer (the "CCO") oversees the Fund's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board of Trustees. The CCO and the Advisers also review key Fund service providers' compliance and risk management policies and procedures related to cybersecurity matters, evaluate such service providers' use of information systems, which have the potential to subject the Fund to information technology vulnerabilities, and receive reports from the Fund's service providers regarding any cybersecurity threats and incidents.

companyName: BlackRock Private Credit Fund


text: Specifically, the Fund's relies on the enterprise risk management ("ERM") framework of BlackRock for the Fund's cybersecurity risk management and strategy. The Board of Trustees of the Fund periodically receives reports from BlackRock and from the Advisers regarding BlackRock's cybersecurity program. Key aspects of the ERM framework are summarized below.