text: Incident Response and Recovery Planning. Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: Apollo Infrastructure Co LLC


text: The ISP, together with related risk and compliance resources, is designed to proactively manage the risk of threat from cybersecurity incidents through (i) implementing protocols to take cybersecurity considerations into account in adopting and onboarding our technology resources, (ii) monitoring IT controls to better ensure compliance with cybersecurity and other related legal and regulatory requirements, (iii) assessing adherence by critical and material third parties we partner with to ensure that the appropriate risk management standards are met, (iv) ensuring essential business functions remain available during a business disruption, and (v) regularly developing and updating response plans to address potential IT or cyber incidents should they occur. AB's security, risk and compliance resources are designed to prioritize IT and cybersecurity risk areas, identify solutions that minimize such risks, pursue optimal outcomes and maintain compliance standards. We also rely on AB's ISP to maintain an operation security function that has a real time response capability that triages potential incidents and triggers impact mitigation protocols.

companyName: AB Private Credit Investors Corp

secItem: Item 1C


text: Additionally, we rely on AB and the Adviser to utilize third parties to conduct periodic cybersecurity assessments, including assessments impacting the Fund, and AB's internal audit function includes certain cyber risk audits as part of any overall risk audit. We rely on AB to review the recommendations and findings from those assessments and audits and implement corrective and other measures as appropriate and as may be relevant to the Fund. AB's cybersecurity processes rely predominantly on internal resources, but also include important third party resources for certain matters, including the aforementioned assessments as well as our continuous cybersecurity threat monitoring and initial incident reporting system.


text: As part of the ISP that is applicable to the Fund, AB also performs cyber risk assessments on the Fund's critical and material third party vendors during onboarding and periodically thereafter.


text: During the reporting period, we have not had a cybersecurity incident that has materially affected, or was reasonably likely to materially affect, the Fund, including our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition, including as discussed in "Item 1A Risk factors – The failure in cyber security systems, as well as the occurrence of events unanticipated in the Fund's disaster recovery systems and management continuity planning could impair its ability to conduct business effectively," although we do not currently believe that such a result is reasonably likely.


text: Cyber Risk Governance The Board provides strategic oversight over the Fund generally and has delegated oversight on cybersecurity matters to the Fund's Audit Committee, including oversight of risks associated with cybersecurity threats. AB's CISO, the Adviser's Chief Compliance Officer and the Fund's Chief Compliance Officer periodically report to the Audit Committee, which in turn reports to the Board on the status of AB's ISP, cybersecurity risks, risk management policies and risk assessment initiatives. Such reports particularly emphasize any material risks concerning the Fund.


text: The Chief Compliance Officer of the Fund oversees the Fund's risk management function generally and relies on the Adviser's Chief Compliance Officer to assist with assessing and managing material risks from cybersecurity threats. The Adviser's Chief Compliance Officer has 12 years of experience in the financial services industry, and during such time has acquired relevant experience overseeing and actively managing cybersecurity and information security programs for financial services companies with complex information systems. The Fund's Chief Compliance Officer has been responsible for the general oversight function as Chief Compliance Officer to the Fund for 3 years and has worked in the financial services industry for 18 years, during which the Fund's Chief Compliance Officer has gained expertise in assessing and managing risk applicable to the Fund.

stage1Category: Management Role

stage1Method: unanimous


text: Management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, including through the receipt of notifications from service providers and reliance on communications with ISP personnel of the Adviser and AB.


text: The Trust does not have any material internal operations of its own that face material cybersecurity threats and is not a regulated financial institution subject to mandatory cybersecurity compliance under New York law (including, without limitation, the New York Code, Rules and Regulations), and therefore has not adopted any cybersecurity risk management program or formal processes for assessing or monitoring cybersecurity risk. However, the Trust does depend on the digital technologies of the Corporate Trustee and third parties, including EMI, Sony/ATV and their respective affiliates' information systems, infrastructure and cloud applications and services. Any sophisticated and deliberate attacks on, or security breaches in, the systems, infrastructure or cloud that benefit the Trust, including those of the Corporate Trustee and third parties, could lead to corruption, misappropriation or miscalculation of the gross royalty income arising from the Catalogue (or calculation of the Contingent Portion related thereto) and/or the Trust's assets, proprietary information and sensitive or confidential data. Because of the Trust's reliance on the technologies of the Corporate Trustee and third parties including EMI, Sony/ATV, their respective affiliates, the Trust also depends upon the personnel and the processes of such parties to protect against cybersecurity threats arising from their own operations in the ordinary course of their respective businesses. The Trust does not employ any operating personnel and has not contracted for the development of processes of its own for the purpose of data security protections and as such may not adequately protect against, or investigate and/or remediate any vulnerability to, cyber incidents. To the best knowledge of the Trustees, as of December 31, 2023, risks from cybersecurity threats, including any previous cybersecurity incidents, have not materially affected the Trust, but it is possible that any of these occurrences, or a combination of them, could have material adverse consequences on the Trust, including its results of operations or financial condition.

companyName: MILLS MUSIC TRUST

ticker: MMTRS

stage1Category: Strategy Integration

stage1Method: majority


text: Cyber Risk Management and Strategy We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of the Investment Manager and other third-party service providers. The Investment Manager manages our day-to-day operations and has implemented the Investment Manager's Information Security Program ("ISP") that applies to the Company and its operations.

companyName: AB Commercial Real Estate Private Debt Fund, LLC


text: We rely on the digital technology of the Investment Manager to conduct our business operations and engage with our clients and business partners. The technology that our Investment Manager, clients, and business partners rely upon becomes more complex over time as do threats to our business operations from cyber intrusions, denial of service attacks, manipulation and other cyber misconduct. Information Security is an ongoing process of exercising due care that is designed to protect corporate, client and employee information and systems from unauthorized access, destruction, disclosure, disruption and modification of use.


text: Through a combination of security, risk and compliance resources, the Investment Manager implements information security through a dedicated ISP that is intended to identify, assess and manage material risks from cybersecurity threats applicable to the Company, and which includes a focus on safeguarding information and assets from cyber threats, engaging in cyber threat monitoring and responding to actual or potential cyber incidents. Our ISP is led by the Investment Manager's Chief Information Security Officer ("CISO") who actively partners with the Investment Manager's Chief Compliance Officer and Chief Risk Officer and, in turn, the Company's Board and Secretary. Ultimately, we rely on the Investment Manager's full enterprise risk framework, which includes the ISP, information technology, business continuity, resiliency and cybersecurity risk, in combination with a broader risk management team, including the Investment Manager's Chief Security Officer.


text: The Investment Manager's CISO, with assistance from internal and external resources, is responsible for implementing and providing oversight of the ISP that applies to the Company. The ISP employs a defense-in-depth strategy: an information assurance concept in which multiple layers of security controls are distributed throughout an operating environment. The concept manages risk with diverse defensive strategies, so that if one layer of defense fails, another layer of defense will attempt to compensate. The ISP features cybersecurity policies, standards and guidelines, committee governance, training, access controls and data controls.


text: The ISP, together with related risk and compliance resources, is designed to proactively manage the risk of threat from cybersecurity incidents through (i) implementing protocols to take cybersecurity considerations into account in adopting and onboarding our technology resources, (ii) monitoring IT controls to better ensure compliance with cybersecurity and other related legal and regulatory requirements, (iii) assessing adherence by critical and material third parties we partner with to ensure that the appropriate risk management standards are met, (iv) ensuring essential business functions remain available during a business disruption, and (v) regularly developing and updating response plans to address potential IT or cyber incidents should they occur. The Investment Manager's security, risk and compliance resources are designed to prioritize IT and cybersecurity risk areas, identify solutions that minimize such risks, pursue optimal outcomes and maintain compliance standards. We also rely on the Investment Manager's ISP to maintain an operation security function that has a real time response capability that triages potential incidents and triggers impact mitigation protocols.


text: Additionally, we rely on the Investment Manager to utilize third parties to conduct periodic cybersecurity assessments, including assessments impacting the Company, and the Investment Manager's internal audit function includes certain cyber risk audits as part of any overall risk audit. We rely on the Investment Manager to review the recommendations and findings from those assessments and audits and implement corrective and other measures as appropriate and as may be relevant to the Company. The Investment Manager's cybersecurity processes rely predominantly on internal resources, but also include important third party resources for certain matters, including the aforementioned assessments as well as our continuous cybersecurity threat monitoring and initial incident reporting system.


text: As part of the ISP that is applicable to the Company, the Investment Manager also performs cyber risk assessments on the Company's critical and material third party vendors during onboarding and periodically thereafter.


text: During the reporting period, we have not had a cybersecurity incident that has materially affected, or was reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition, including as discussed in " Item 1A. Risk factors – A failure in cyber security systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning could impair our ability to conduct business effectively," although we do not currently believe that such a result is reasonably likely.


text: Cyber Risk Governance The Board provides strategic oversight over the Company generally, including oversight of risks associated with cybersecurity threats. The Investment Manager's CISO and the Company's Secretary periodically report to the Board on the status of the Investment Manager's ISP, cybersecurity risks, risk management policies and risk assessment initiatives. Such reports particularly emphasize any material risks concerning the Company.


text: Third-Party Risk Management. Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems.

stage1Category: Third-Party Risk


text: The Secretary of the Company relies on the Investment Manager's Chief Compliance Officer to assist with assessing and managing material risks from cybersecurity threats. The Investment Manager's Chief Compliance Officer has 12 years of experience in the financial services industry, and during such time has acquired relevant experience overseeing and actively managing cybersecurity and information security programs for financial services companies with complex information systems. The Company's Secretary has been responsible for the general oversight function as Secretary to the Company since its inception and has worked in the financial services industry for 10 years.


text: Management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with ISP personnel of the Investment Manager.


text: As a blank check company, we do not have any operations and our sole business activity has been to search for and consummate an initial business combination. However, because we have investments in our Trust Account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, the management team will report to the Board of Directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: TortoiseEcofin Acquisition Corp. III

stage1Category: Risk Management Process


text: We are a SPAC with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: Global Technology Acquisition Corp. I

stage1Category: None/Other


text: The Trust does not have a board of directors; therefore, the Trustee is responsible for oversight of the Trust's risks from cybersecurity threats.

companyName: CROSS TIMBERS ROYALTY TRUST

ticker: CRT

stage1Category: Board Governance


text: The Trustee has dedicated personnel that are responsible for assessing and managing the Trust's cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee's information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. External partners are a key part of the Trustee's cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee's overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third-party vendor, of the Trustee's cyber risk management program.


text: Other, non-technical protocols include securing of documents and work areas that could contain personal, non-public information and independent verification of information changes by outside vendors.


text: risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust's business, financial condition, results of operations, or cash flows. See Item 1A. Risk Factors—The Trust may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.


companyName: HUGOTON ROYALTY TRUST

ticker: HGTXU


text: The Trustee has dedicated personnel that are responsible for assessing and managing the Trust's cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee's information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: External partners are a key part of the Trustee's cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.


text: risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust's business, financial condition, results of operations, or cash flows. See Item 1A. Risk Factors – The Trust may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.


text: Cybersecurity Risk Management and Strategy As an externally managed company, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Operating Manager, an indirect subsidiary of Apollo. Apollo determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for us and other affiliated entities managed by Apollo, and we rely on Apollo for assessing, identifying and managing material risks to our business from cybersecurity threats.


text: Apollo's Board of Directors is involved in overseeing Apollo's risk management program, including with respect to cybersecurity, which is a critical component of Apollo's overall approach to enterprise risk management (" ERM "). Apollo's cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas:


text: Governance. As discussed further under the heading "Cybersecurity Governance," Apollo's Board of Directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer (" CISO ") and the Chief Information Security Officer of Athene Holding Ltd. (" AHL's CISO "), a subsidiary of Apollo, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, and also receive support, as appropriate, from our executive officers and other representatives of the Operating Manager and its affiliates.


text: Collaborative Approach. Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by Apollo management, in consultation with our management and our Board as applicable, in a timely manner.


text: Technical Safeguards. Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence.


text: Apollo engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. Apollo regularly engages third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to Apollo's risk management function, and Apollo adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews.


text: To our knowledge, cybersecurity threat risks have not materially affected our company, including our business strategy, results of operations or financial condition.


text: Cybersecurity Governance The AGM Board of Directors' oversight of Apollo's cybersecurity risk management is supported by the audit committee of the AGM Board of Directors (the " AGM audit committee "), the AAM Global Risk Committee (" AGRC "), the Operational Risk Forum (the " ORF "), the Cybersecurity Working Group and management. The AGM Board of Directors, the AGM audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from Apollo's risk management professionals, AGM's Chief Security Officer (" CSO "), its CISO, and other members of Apollo's management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from Apollo's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM's board of directors and/or the AGM audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM Board of Directors or the AGM audit committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from Athene's CISO, at least annually.


text: AGM's CSO holds an undergraduate degree in Management Information Systems and Business Administration, which he received magna cum laude. He has over 25 years of cyber-related experience, having served in various roles in technology and cybersecurity, including as Head of IT Risk Management, Executive Director of IT & Risk Compliance, and Global IT Risk Evaluation Lead at large financial institutions and consulting firms. He was also previously AGM's CISO for nearly eight years. AGM's CISO holds a master's degree in Business Information Systems and has served in various roles in information technology and information security for over 25 years across a number of large financial institutions, including as Director, Cybersecurity and Risk.


text: The AGM CISO, in coordination with the Apollo Technology and ERM teams, works collaboratively across Apollo to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of Apollo's cybersecurity risk management program, multidisciplinary teams throughout Apollo are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the AGM audit committee or AGM Board of Directors, as appropriate.


text: As part of the risk management oversight (including oversight of cyber risks) of the Company's Board, the Board will regularly interact with, and receive reports from, management of the Company, the Operating Manager, Apollo, and other service providers. The Company's Board is expected to receive presentations and reports on cybersecurity risks from AGM's CSO or CISO, at least annually, addressing a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Apollo's peers and third parties. Additionally, Apollo and other service providers are expected to periodically report to management as it relates to the Company's cybersecurity practices.


text: Apollo's cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to the Company's management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to the Company, the Operating Manager, and evaluation of the adequacy of the Company's cybersecurity program (as coordinated through the Operating Manager and Apollo), including risk mitigation, compliance and controls.


text: Cybersecurity Risk Management and Strategy We are dedicated to protecting the integrity, confidentiality, and availability of our data, infrastructure and operating systems. As part of our commitment to safeguarding our operations against cybersecurity threats, we employ a comprehensive strategy for the assessment, identification, and management of cybersecurity risks. We engage a third-party CIO consulting firm and a managed services provider, which work together to provide wide-ranging services including risk assessments, threat detection, monitoring and response strategies, security audits and cybersecurity services, tools and training. An enterprise firewall; Implementation of Multi-Factor Authentication (MFA); Adherence to the Zero Trust model; Utilization of Managed Detection and Response (MDR); Endpoint Detection and Response (EDR) technologies;

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face material cybersecurity threats. However, we do depend on the digital technologies of third parties, including information systems, infrastructure and cloud applications and services, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.

companyName: Direct Selling Acquisition Corp.


text: We are a special purpose acquisition company with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any.

companyName: Four Leaf Acquisition Corp

ticker: FORL


text: On April 28, 2023, we identified a payment of $54,300 was incorrectly made to an unauthorized payee as a result of a phishing attack. Our management team, at the direction of the board of directors, investigated the matter and concluded that the phishing attack was an isolated incident perpetrated by an external source. With the assistance of our bank, we were ultimately able to recover all of these funds on June 29, 2023. As a result of this phishing attack, we have implemented additional controls related to vendor verification and additional review procedures of each payment made by several authorized individuals.

stage1Category: Incident Disclosure


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating prospective acquisition candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Target Global Acquisition I Corp.

ticker: TGAAF


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Invest Acquisition Corp


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying, evaluating suitable acquisition transaction candidates and completing the merger with our target acquisition companies. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: AltEnergy Acquisition Corp

ticker: AEAE


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. However, because we have investments in our Trust Account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Investcorp AI Acquisition Corp.

ticker: IVCAF


text: We are a special purpose acquisition company with no business operations. Since the IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not believe that we currently face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since the IPO.

companyName: INTEGRATED RAIL & RESOURCES ACQUISITION CORP


text: 24x7 Security Operations Center (SOC); and Employment of Security Information and Event Management (SIEM) systems to continuously monitor our network and respond to threats in real time.


text: Risk Assessment Procedures: We conduct periodic risk assessments to identify potential cybersecurity threats and vulnerabilities within our IT infrastructure. These assessments are conducted using various software tools and methodologies that enable us to evaluate our systems critically and comprehensively. Our risk assessment process includes the analysis of: Hardware and software configurations; Network and data access protocols; Encryption standards; and Compliance with relevant industry and regulatory standards.


text: Threat Identification: We utilize advanced threat detection tools and services that continuously monitor our network for signs of unauthorized access, anomalies, and potential breaches. Our third-party cybersecurity provider is equipped with sophisticated detection technologies that help to swiftly identify even the most subtle signs of compromise. We focus on: Real-time monitoring of our networks; Regularly updated intrusion detection systems (IDS);


text: Deployment of endpoint detection and response (EDR) solutions; and Utilization of threat intelligence platforms to stay abreast of emerging threats.


text: Threat Management: Upon identification of a potential threat, our managed service provider's dedicated incident response team takes immediate action to mitigate any adverse impacts. Our threat management procedures include: Immediate isolation of affected systems to prevent the spread of threats; Application of appropriate remediation measures, such as patches and software updates; Conducting a thorough investigation to understand the breach's nature and scope; and Implementing enhancements to prevent future occurrences.


text: Our incident response plan provides a concise strategy of how we will respond to an incident, including who will respond and their roles and responsibilities, the facilities that are in place to help with the management of the incident, how decisions will be taken with regard to our response to an incident, how communication will be handled both internally and externally, and defining what will happen once the incident is resolved and how we can learn and improve from the situation.


text: Integration into Overall Risk Management: Our cybersecurity risk assessment processes are fully integrated into the broader risk management framework. Cybersecurity is positioned as a core component of our risk management strategy, with direct reporting to our President and COO, who is guided by our third-party CIO firm. The CIO firm provides strategic direction on policy, procedures and best practice. The synergy between cybersecurity and risk management ensures a resilient posture against emerging cyber threats.


text: Engagement of Third Parties: These providers are selected based on stringent criteria for cybersecurity expertise, particularly their capability to implement and manage NIST and CMMC protocols.


text: Third-Party Service Provider Oversight: Our oversight processes include comprehensive due diligence checks for any new third-party service provider and continuous monitoring of our existing managed service provider and CIO firms' activities. We have established protocols for communication and incident response that align with our managed service provider's operations, and industry best practice, ensuring swift action in the face of cybersecurity threats. Furthermore, a scheduled series of meetings has been established to procure updates and deliberate upon cybersecurity strategy with our contracted third-party providers.


text: Impact of Cybersecurity Risks Material Effects from Cyber Threats: To date, our operations and financial condition have not been materially affected by cybersecurity threats, due in part to our proactive measures such as employee security training programs and advanced threat detection and response capabilities. Our defensive strategies have successfully mitigated the risks of cyber incidents.


text: Potential Risk Exposure: While we have not experienced significant disruptions from cyber threats, we recognize the evolving nature of cyber risks. We continually evaluate the likelihood of potential cybersecurity incidents that could materially impact our strategic direction, operational efficacy, and financial stability. Our investment in training, alongside our sophisticated SOC, SIEM, and Zero Trust architecture, positions us to identify and address potential cybersecurity challenges promptly.


text: Cybersecurity Governance Our executive team is actively involved in overseeing our cybersecurity operations to ensure that they meet industry standards. The executive team provides regular updates to the board of directors – specifically the audit committee – on the status of our cybersecurity efforts, including any potential risks, threats or incidents.


text: The President and COO, with guidance from our third-party managed services provider and CIO consulting firm, manages our cybersecurity risk management and strategy process. Collectively, our consultants have 50+ years' experience in the cybersecurity industry in various roles.


text: Management of material risks from cybersecurity threats is integrated into the Company's overall risk management processes and is monitored as an enterprise risk. The Company's Board of Directors (the "Board"), with the input of management, oversees the Company's internal controls and processes, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats.

companyName: MARINEMAX INC

ticker: HZO


text: Processes for Informing the Board: The audit committee is regularly informed about cybersecurity risks through quarterly briefings from the President and COO. These briefings include risk assessment reports, incident response updates, changes to the cybersecurity landscape, and other relevant information. In the case of a cybersecurity incident that meets reporting thresholds, the audit committee will be promptly notified and will receive continual updates until the situation is remedied.


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any.

companyName: Berenson Acquisition Corp. I


text: Cybersecurity Risk Management Strategy and Governance Overview The Trust and the Fund do not have any officers, directors or employees. The Sponsor is responsible for the oversight and overall management of the Trust and the Fund. The Sponsor is a wholly owned subsidiary of Franklin Resources, Inc. ("FRI"). FRI maintains global, firm-wide policies and procedures governing matters relating to crisis management, corporate continuity, business continuity planning and disaster recovery, enterprise business resilience, and corresponding risk mitigation processes and systems in these areas (collectively referred to as the "Global Corporate Continuity Program").

companyName: Franklin Templeton Holdings Trust

ticker: FGDL


text: The Global Corporate Continuity Program is generally overseen by the Business Recovery Governance Committee ("BRGC"). BRGC has developed certain policies and principles in implementing the program. The executive officers of the Sponsor perform certain functions with respect to the Trust and the Fund that, if the Trust or the Fund had directors or executive officers, would typically be performed by them, including receiving reports regarding the Global Corporate Continuity Program. In line with the Global Corporate Continuity Program, the Sponsor or its delegate: (1) regularly conducts a business impact analysis; (2) develops, exercises and maintains a viable and actionable Business Continuity Plan specifically tailored to the Sponsor in light of the nature and scope of its business; and (3) completes annual testing of the Business Continuity Plan. Material exceptions to this policy and risk events and related mitigation/corrective measures are reported to the Sponsor's Governance Oversight Committee. As appropriate, the Sponsor or its delegate will coordinate with FRI's relevant risk management and disaster recovery-related committees to review risk monitoring and mitigation strategies as contemplated under the Global Corporate Continuity Program at least annually, and more often if there are significant internal or external changes affecting these risks as pertains to the Sponsor's business and its Business Continuity Plan.


text: FRI has adopted the National Institute of Standards and Technology's ("NIST") cybersecurity framework as its security outline. The program is reviewed annually. Using the NIST framework as a guide, FRI's cybersecurity program is organized around the following program domains:


text: Identify critical assets, data, systems and capabilities, cybersecurity strategy and governing elements, threats and cybersecurity risks Protect assets (data, systems, networks, personnel, etc.) from external or internal malicious actors and failed practices Detect anomalies and security events through environments monitoring, analysis, remediation, and reporting. Engage outside vendors to periodically test the network infrastructure and software applications against known vulnerabilities and to ensure the use of a best practice security program Respond to incidents regardless of source or causality Recover through planning, improvements and communications (external and internal)


text: Conduct after-action evaluation to identify what went well, what did not go well and improve FRI's systems after an issue FRI employs third-party firms to assess its cybersecurity posture, conduct penetration testing, and forensic analysis. FRI maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact FRI's business in the event of a cybersecurity incident affecting those third-party systems. Third-party risks are included within FRI's NIST framework, and risk identification and mitigation are supported by FRI's Global Corporate Continuity Program. FRI also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.


text: Assessment of Cybersecurity Risks As of March 31, 2024, cybersecurity risks have not materially affected the Trust or the Fund's ability to achieve its investment objective, results of operations or financial condition. However, future incidents could have a material impact on our ability to achieve the investment objective, results of operations, or financial condition.


text: As part of our overall risk management, we have implemented a Data Security and Cybersecurity Program (the "DSCP") which sets policy expectations, ensures broad coverage over information technology risks, integrates the Information Security and Information Technology Risk Management Framework into our broader risk management systems, establishes clear roles and governance, and aligns control expectations to the National Institute of Standards and Technology ("NIST"). Under the DSCP, we have processes for identifying, assessing, escalating and managing technology and cybersecurity risk. The DSCP employs various controls and policies to secure our operations and information, which include monitoring, reporting, managing and remediating cybersecurity threats and incidents.

companyName: GENWORTH FINANCIAL INC

ticker: GNW


text: With the guidance of the Audit & Risk Management Committee, our Board is responsible for our risk management framework, including our strategy, policies, procedures and systems with respect to cybersecurity and information technology risks associated with us and our supply chain, suppliers and service providers. Our management team has developed and implemented a risk management program that includes cybersecurity risks as a risk category. Management has primary responsibility for supervising internal staff and external consultants assisting with cybersecurity matters, including those that assist management in staying informed about cybersecurity risks and incidents. Management updates the Committee on our cyber risk management program, and the Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Tamboran Resources Corp

ticker: TBN


text: Key elements of our risk management program relating to cybersecurity include: implementing risk assessments designed to help identify material risks, including risks arising from cybersecurity threats to our critical systems and information; engaging external cybersecurity consultants to assess and assist with aspects of our security processes; and maintaining insurance coverage related to cybersecurity matters. Currently, our management team's experience includes over 50 years combined experience in leadership roles at public companies. We are investing in additional resourcing and cybersecurity measures as we grow.


text: We have not experienced any material risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including controls, systems and processes that we have or will in the future implement, will be fully implemented, complied with or effective in protecting our systems and information. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See our risk factor titled "Our business could be negatively affected by security threats and disruptions, including electronic, cybersecurity or physical security threats, incidents and other disruptions."


text: Risk Management and Strategy We have implemented and maintain an information security program designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data including intellectual property, clinical trial participant and patient-related data, and confidential information that is proprietary, strategic or competitive in nature. We believe our information security program is appropriate for a company of our size and stage of development, taking into account our operations and risks.

companyName: Benitec Biopharma Inc.

ticker: BNTC


text: Mechanisms, controls, and technologies designed to prevent or mitigate system intrusion or data loss, theft, misuse, or other security incidents or vulnerabilities and maintain a stable and secure information technology environment.


text: Information security policies, network and device security, encryption standards, risk management, as well as security tools such as malware protection and secure authentication tools.


text: We conduct ongoing monitoring of critical systems for any compromised or potentially compromised accounts, and conduct regular trainings for our employees and senior management on cyber and information security.


text: The Audit Committee of our Board of Directors oversees and reviews the Company's cybersecurity risks and the steps management has taken to protect against threats to the Company's information systems and security. The senior leadership team, including our Executive Director and Chief Executive Officer, provides periodic reports to our Board and the Audit Committee, as applicable.


text: To date, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management Program Overview As cybersecurity threats rapidly evolve in sophistication and become more prevalent, especially with the increasing use of artificial intelligence ("AI") technology, we have implemented a cybersecurity risk management program as part of our oversight, evaluation and mitigation of enterprise-level risks. Our cybersecurity risk management program leverages a combination of processes, technologies and personnel with expertise in cybersecurity to comply with applicable regulations and detect and respond to cyber-attacks, data breaches, security incidents, and compromises of personal information, as well as to regularly and promptly inform management and our Board of Directors of any significant cybersecurity risks and developments.

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA


text: Key features of the DSCP include access controls, security training, system security testing, dedicated security personnel, security event monitoring, and when necessary, consultation with third-party data security experts.


text: Our cybersecurity risk management program is led by our global Chief Information Security Officer ("CISO"), who is directly responsible for establishing cybersecurity strategies and structures and managing ongoing cybersecurity risk management activities through our information security office, which is responsible for the day-to-day identification, monitoring and management of cybersecurity risks. Our CISO reports directly to our global Chief Information Officer ("CIO"). Our CISO has significant experience in managing cybersecurity risks at major global companies in the pharmaceutical and defense industries. Our CISO regularly meets with the CIO to provide updates on cybersecurity matters. Our CIO updates our executive management on a regular basis to share cybersecurity related matters and discuss strategies to proactively manage cybersecurity threats. Our CISO and CIO brief our Audit Committee on our cybersecurity and risk management programs.


text: Our information security office is supported by a team consisting of personnel with experience and expertise in cybersecurity risk management strategies, execution and operations, with domain expertise in cloud services security, infrastructure and operational technology security, cybersecurity incident response, and tactical governance risk compliance.


text: Our CISO and CIO are also members of our information and security governance group, led by our CIO, which is comprised of executive and senior leadership from a variety of functions, including information security, corporate security, legal, finance, human resources, internal audit and compliance, as well as members of Teva's global situation room ("GSR"). Additionally, our CISO, CIO and other members of our information security office may, from time to time, consult and coordinate with other Teva departments and members of management to manage cybersecurity risks, promote cybersecurity awareness and implement cybersecurity incident responses.


text: In addition, management has worked, and expects to continue to work, with third-party service providers, as appropriate, to assess, identify and manage cybersecurity risks. Management also conducts periodic and on-demand assessments of our cybersecurity risk management program with expert service providers to ensure it complies with and meets current ISO 27001 standards. As part of its cybersecurity program, Teva conducts periodic tabletop exercises to assess its cybersecurity incident response process.


text: As part of its overall risk oversight function, our Audit Committee, which is comprised entirely of independent directors, oversees cybersecurity risks in connection with overseeing our overall enterprise risk management system. Management, including our CISO and CIO, provide updates on our cybersecurity risk management program and cybersecurity matters to the Audit Committee, and also reports to the Board of Directors as necessary. These updates and reports include updates on Teva's cybersecurity risks and threats, the status of projects intended to strengthen its information security systems, assessments of the information security program (including remediation, mitigation, and management of identified vulnerabilities), and the emerging threat landscape.


text: As part of our cybersecurity risk management program, we maintain industry standard procedures and policies, which are reviewed and revised periodically, and certified to comply with ISO 27001 standards, to both proactively assess, identify and manage potential cybersecurity risks and respond to any actual cybersecurity threats and incidents. Such procedures and policies include: actively monitoring our information technology systems to ensure compliance with applicable legal and regulatory requirements; engaging third-party consultants and other service providers to monitor and, as appropriate, respond to cybersecurity risks; requiring our service providers and our business partners who connect directly to our information technology systems to comply with our cybersecurity standards and due diligence processes and be subject to our non-disclosure and other confidentiality agreements that include cybersecurity-related terms; providing and analyzing specialized industry sector intelligence on cybersecurity threats; regularly testing our cybersecurity systems and disaster preparedness, including our back-up information technology systems; developing and updating incident response plans to address potential cybersecurity threats; and maintaining and training our personnel on cybersecurity incident reporting procedures. Teva engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to obtain current threat intelligence, collaborate on security enhancements, and evaluate and improve the effectiveness of its information security program.


text: Cyber Threats and Incident Response In the ordinary course of our business, we collect and store confidential data, including intellectual property, proprietary business information and personally identifiable information (including of our employees, customers, suppliers and business partners). We rely extensively on information technology systems, including some systems that are managed by third-party service providers, to securely process, store and transmit such confidential data in order to conduct our business. These systems include programs and processes relating to internal and external communications, ordering and managing materials from suppliers, collecting, processing and storing data produced by our clinical trials and other research and development initiatives, converting materials to finished products, shipping products to customers, processing transactions, processing payments to employees and vendors, calculating sales receivables, generating our financial results for each reporting period, summarizing and reporting results of operations, and complying with information technology security compliance and other regulatory, legal or tax requirements. In addition, as cybersecurity attacks may become increasingly complex as they are enhanced or facilitated by the emergence of new technologies such as AI used to identify and target new vulnerabilities in our information technology systems or those of our customers, third-party vendors and other business partners, we are taking measures to manage these risks by utilizing new tools and capabilities, including AI.


text: We have not been materially impacted by risks from cybersecurity threats and as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, there can be no assurance that Teva will not be materially affected by such risks in the future. Our systems and networks have been, and are expected to continue to be, the target of increasingly advanced and evolving cyber-attacks and cybersecurity incidents in the future may adversely impact our business, financial condition and results of operations, and we are continuing to actively monitor such threats. For more information, see "Item 1A, Risk Factors—Risks related to our general business and operations—Significant disruptions of our information technology systems could adversely affect our business" and "Item 1A, Risk Factors—Risks related to our general business and operations—A data security breach could adversely affect our business and reputation."


text: In the event that we experience a cybersecurity incident, we have a cybersecurity incident response playbook that sets forth the applicable processes, roles, engagements, escalations and notifications to be executed in order to promptly respond to such threats. Depending on its nature and scale, a cybersecurity threat may be managed within our information security office, escalated to our CISO and CIO, or escalated to our management, and Audit Committee and Board of Directors, as appropriate. In certain instances, our GSR may be initiated and will collectively manage Teva's response to a crisis on a corporate level. The GSR is comprised of members from our various business units and regions, including senior leadership from a variety of functions, such as information security, legal, finance, human resources, communications and compliance.


text: We carry insurance that provides protection against the potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover or be sufficient to cover all losses or claims that may result from a cybersecurity incident.


text: Risk Management and Strategy We have established security practices and safeguards designed to help identify and protect against intentional and unintentional misappropriation or corruption of our information technology systems, data, and operational continuity. We regularly conduct risk assessments to identify potential cybersecurity threats, which include evaluating the likelihood and potential impact of these threats, identifying system and network vulnerabilities, and assessing the effectiveness of our existing controls. As part of our overall cybersecurity program, we engage specialized third-party vendors for certain cybersecurity functions including, but not limited to, incident response, penetration testing, and security operations center monitoring of our information technology environment. Identified risks are documented and communicated to the relevant stakeholders. Upon identification and assessment of risks, we develop and implement what we believe are appropriate measures to manage these risks, which may involve enhancing security controls, implementing new technologies, training employees, or changing business processes. We maintain change management processes, monitoring practices, and data protection measures to mitigate cybersecurity risks and continuously test our systems for potential threats. Such processes and practices to assess, identify, and manage cybersecurity incidents are integrated into our overall enterprise risk assessment process.

companyName: WATSCO INC

ticker: WSO


text: A dedicated team at our corporate headquarters, which is led by our Director of Data Security ("DDS") and composed of the Chief Technology Officer ("CTO") and representatives from risk management, legal, internal audit, and finance departments, is responsible for assessing and managing our cybersecurity risks and data protection practices. The Audit Committee oversees the measures taken by this team to monitor material risks associated with cybersecurity threats, a role crucial to maintaining a robust and effective cybersecurity risk management approach. The DDS and CTO provide formal briefings to the Audit Committee on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, and other areas of importance at least once a year, with the Board of Directors receiving updates periodically. Regular discussions on enterprise risks are held between the Audit Committee, Board of Directors, and senior management.


text: Our DDS has more than 20 years of expertise in the information technology sector, with 11 years specifically dedicated to cybersecurity. This experience has fostered a thorough comprehension of cyber threat landscapes, defense strategies, and security technologies.


text: We have identified information technology and cybersecurity risk as some of the most significant risk types to our business. Related to these identified risk types, we have classified our top risks and report them to both senior management and the risk committee of Genworth Financial's Board of Directors, which in turn reports to the Board of Directors. For additional information regarding the risks associated with these matters, see "Item 1A—Risk Factors."


text: Risk Management and Strategy Genworth's risk management framework recognizes the significant operational risk, including risk of losses, from cybersecurity incidents and the importance of a strong cybersecurity program for effective risk management.


text: Management Committee ("RMC"), which is responsible for the oversight of the Corporation's overall risk framework, and assists the Board in the monitoring, review and approval of the policies that measure, limit and manage the Corporation's risks, including cybersecurity risk. The RMC holds periodic meetings in which management provides overview of Popular's cybersecurity threat risk management incident status.

companyName: POPULAR, INC.

ticker: BPOP


text: Through a cross-functional team, we assess and mitigate risks associated with our third-party providers and have processes in place to regularly monitor and evaluate cybersecurity risks, threats and incidents associated with the use of third-party providers, as well as monitoring rights, as appropriate. Our information security team, overseen by our Chief Information Security Officer ("CISO"), conducts annual information security awareness training for employees involved in our systems and processes that handle customer data. We also conduct periodic cybersecurity awareness training with management and the Board of Directors, including cybersecurity preparedness exercises. In addition, the DSCP includes an incident response plan, which coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to assess the materiality of the incident, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal reporting and other obligations and mitigate reputational damage. We also carry insurance that provides protection against certain losses arising from a cybersecurity incident.


text: Additionally, we have procedures set forth in the DSCP for reporting and responding to potential cybersecurity incidents as well as determining applicable disclosure requirements, including timely incident reporting. For example, as disclosed in our Form 8-K filed on February 29, 2024, after being notified of the MOVEit Cybersecurity Incident, we, together with PBI, promptly launched an investigation to determine whether and to what extent personal information had been unlawfully accessed as a result of that incident. We determined that approximately 2.5 million to 2.7 million of our policyholders' or other customers' personal information, including social security numbers, was exposed to and obtained by the threat actor as a result of the MOVEit Cybersecurity Incident. We do not believe the MOVEit Cybersecurity Incident has had any impact on any of our information systems, including our financial systems, and there has not been any material interruption of our business operations. While we are continuing to measure the impact of remediation expenses and other potential liabilities, neither this incident, nor other known cybersecurity threats, has had or is reasonably likely to have a material adverse effect on our business strategy, results of operations or financial condition.


text: See "Item 1A—Risk Factors—Our computer systems and those of our third-party service providers have in the past failed or been compromised and may in the future fail or be compromised, including through cybersecurity breaches; we may experience issues from new and complex information technology methodologies such as artificial intelligence; and unanticipated problems could materially adversely impact our disaster recovery systems and business continuity plans, any of which could expose confidential information such as personal information of our customers or employees, damage our reputation, impair our ability to conduct business effectively, result in enforcement action or litigation, and materially adversely affect our business, financial condition and results of operations."


text: Our Board of Directors recognizes the importance of maintaining the privacy and security of customer information, as well as the availability and integrity of our systems, and consequently dedicates meaningful time and attention to the oversight of cybersecurity risk. In light of these risks, our Board of Directors is actively engaged in the oversight of the Company's information technology, which includes periodic briefings on cybersecurity threats and participation in cybersecurity preparedness exercises. Furthermore, under its charter, the Board's risk committee has primary responsibility for information technology risk oversight, including as it relates to cybersecurity and data security matters. In this capacity, the risk committee oversees the Company's processes for identifying, assessing and managing technology and cybersecurity risk, including a risk-based escalation process, which requires that the risk committee be notified by management and, as necessary, receive regular briefings on the matter, and work with management, including Genworth's CISO and Chief Risk Officer ("CRO"), to assess and manage the risk and implement the Company's response to the incident, as appropriate.


text: Genworth's CISO and CRO, both members of management, support the cybersecurity risk oversight responsibilities of the Board and the risk committee and involve applicable management personnel in cybersecurity risk management. The risk committee receives periodic reports from the CISO and CRO on the Company's technology and cybersecurity risk profiles, information security program and key cybersecurity initiatives. Additionally, the CISO and CRO follow a risk-based escalation process to notify the risk committee outside of the regular reporting cycle when they identify actual or potential substantive cybersecurity risks or issues.


text: Genworth's CISO is an information technology and security professional with 24 years of experience and 12 years of service at Genworth. In his 24 years of experience, he has held roles in information technology infrastructure administration, information technology infrastructure, security consulting and security administration. He received a Bachelor of Science Degree in Business Administration from Regent University and is a Certified Information Systems Security Professional (CISSP).


text: Genworth's CRO has served in information technology and risk management leadership roles for over twenty years, including oversight of enterprise risk management and operational risk, as well as oversight for financial reporting systems, operational and technology platforms, and testing and quality assurance programs. He received a Bachelor of Science Degree in Decision Support Systems from Virginia Polytechnic Institute (Virginia Tech) and graduated from the Tuck Global Executive Leadership Program through Dartmouth in 2020. For more information about our CRO, see "Part III—Item 10—Directors, Executive Officers and Corporate Governance."


text: Cybersecurity Risk Management and Strategy operations are managed by Blackstone Infrastructure Strategies Associates L.P. (the "General Partner") subject to certain oversight rights held by the Board of Directors. The General Partner has delegated BXINFRA's portfolio management function to Blackstone Infrastructure Advisors L.L.C. (the "Investment Manager"). The General Partner and the Investment Manager are individually and collectively referred to as the "Sponsor." Our executive officers are senior Blackstone professionals and our General Partner and Investment Manager are both subsidiaries of Blackstone. As such, we are reliant on Blackstone for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Blackstone has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Blackstone Infrastructure Strategies L.P.


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by BXINFRA, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, new hire and annual employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.


text: Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as those established by the National Institute of Standards and Technology and Center for Internet Security, as guidelines. Further, Blackstone engages in cybersecurity incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cybersecurity incident response processes. Blackstone's Chief Security Officer (the "CSO") and members of Blackstone's senior management, Legal and Compliance, Technology and Innovations ("BXTI") and Global Corporate Affairs participate in these exercises. Learnings from these tabletop exercises and any cybersecurity events Blackstone experiences are reviewed, discussed, and incorporated into its incident response processes as appropriate. In addition to Blackstone's internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to analyze data on the interactions of users of Blackstone information technology resources, including Blackstone employees, and conduct penetration tests and scanning exercises to assess the performance of Blackstone's cybersecurity systems and processes.


text: Blackstone has a comprehensive Security Incident Response Plan (the "IRP"), designed to inform the proper escalation (including, as appropriate, to our senior management) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a Security Incident Response Team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually by members of BXTI and Blackstone's Legal and Compliance.


text: Blackstone maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to identify, track and treat cybersecurity risks at the firm, and integrates these processes into the firm's overall risk management practices described above. Blackstone's CSO periodically discusses and reviews cybersecurity risks and related mitigants with its enterprise risk committee and incorporates relevant cybersecurity risk updates and metrics in the semi-annual enterprise-wide risk management report.


text: Blackstone has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors, including those of companies sponsored by Blackstone such as BXINFRA. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of Blackstone data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Blackstone may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing its requirements and industry best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Blackstone also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data.


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Blackstone in managing these risks, see "—Item 1A. Risk Factors — Cyber Security and Operational Risk" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Blackstone has a dedicated cybersecurity team, led by Blackstone's CSO, who works closely with Blackstone senior management, including Blackstone's Chief Technology Officer ("CTO"), to develop and advance the firm's cybersecurity program and strategy, which applies to BXINFRA.


text: Blackstone's CTO is a Senior Managing Director and the head of BXTI. Blackstone's CTO has over 23 years of information security, technology and engineering experience, including having previously served as the Chief Technology and Chief Innovation Officer at a large financial institution. Blackstone's CTO is responsible for all aspects of technology across Blackstone, advises Blackstone's investment teams and acts as a resource to portfolio companies on technology-related matters.


text: BXTI conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The CSO and CTO are responsible for the review of Blackstone's cybersecurity framework annually as well as on an event-driven basis as necessary. The CSO and CTO also review the scope of Blackstone's cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Blackstone's information and systems.


text: BXINFRA's Board of Directors and its Audit Committee are responsible for understanding the primary risks to our business. The Audit Committee is responsible for reviewing BXINFRA's and the Sponsor's IT security controls with management and evaluating the adequacy of BXINFRA's and the Sponsor's IT security program, compliance and controls with management.


text: Blackstone's CSO will report to BXINFRA's Board of Directors and/or Audit Committee periodically on cybersecurity matters, including risks facing BXINFRA and the Sponsor and, as applicable, certain incidents. In addition to such periodic reports, BXINFRA's Board of Directors and/or Audit Committee will receive periodic reports and/or updates from management on the primary cybersecurity risks facing BXINFRA and the Sponsor and the measures we and the Sponsor are taking to mitigate such risks. In addition to such reports, the Board of Directors and/or Audit Committee will receive updates from management regarding changes to BXINFRA's and the Sponsor's cybersecurity risk profile or certain newly identified risks.


text: Cybersecurity Risk Management and Strategy operations are managed by Blackstone Private Equity Strategies Associates L.P. (the "General Partner") subject to certain oversight rights held by the Board of Directors. The General Partner has delegated BXPE's portfolio management function to Blackstone Private Investments Advisors L.L.C. (the "Investment Manager"). The General Partner and the Investment Manager are individually and collectively referred to as the "Sponsor." The executive officers are senior Blackstone professionals and our General Partner and Investment Manager are both subsidiaries of Blackstone. As such, we are reliant on Blackstone for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Blackstone has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Blackstone Private Equity Strategies Fund L.P.


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by BXPE, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, new hire and annual employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.


text: Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as those established by the National Institute of Standards and Technology and Center for Internet Security, as guidelines. Further, Blackstone engages in cybersecurity incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cybersecurity incident response processes. Blackstone's Chief Security Officer (the "CSO") and members of Blackstone's senior management, Legal and Compliance, Technology and Innovations ("BXTI") and Global Corporate Affairs participate in these exercises. Learnings from these tabletop exercises and any cybersecurity events Blackstone experiences are reviewed, discussed, and incorporated into its incident response processes, as appropriate. In addition to Blackstone's internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to analyze data on the interactions of users of Blackstone information technology resources, including Blackstone employees, and conduct penetration tests and scanning exercises to assess the performance of Blackstone's cybersecurity systems and processes.


text: Blackstone has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors, including those of companies sponsored by Blackstone such as BXPE. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of Blackstone data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Blackstone may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing its requirements and industry best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Blackstone also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data.


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Blackstone in managing these risks, see "— Item 1A. Risk Factors — Cyber Security and Operational Risk" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Blackstone has a dedicated cybersecurity team, led by Blackstone's CSO, who works closely with Blackstone senior management, including Blackstone's Chief Technology Officer ("CTO"), to develop and advance the firm's cybersecurity program and strategy, which applies to BXPE.


text: Blackstone's CSO and CTO have extensive experience in cybersecurity and technology, respectively. Blackstone's CSO is a Senior Managing Director in BXTI and is responsible for all aspects of cyber and physical security across Blackstone. He has over 25 years of information security, technology and engineering experience, including having previously led the international security organization at a large credit bureau.


text: The Board of Directors and the Audit Committee are responsible for understanding the primary risks to our business. The Audit Committee is responsible for reviewing BXPE's and the Sponsor's IT security controls with management and evaluating the adequacy of BXPE's and the Sponsor's IT security program, compliance and controls with management.


text: Blackstone's CSO will report to the Board of Directors and/or Audit Committee periodically on cybersecurity matters, including risks facing BXPE and the Sponsor and, as applicable, certain incidents. In addition to such periodic reports, the Board of Directors and/or Audit Committee will receive periodic reports and/or updates from management on the primary cybersecurity risks facing BXPE and the Sponsor and the measures we and the Sponsor are taking to mitigate such risks. In addition to such reports, the Board of Directors and/or Audit Committee will receive updates from management regarding changes to BXPE's and the Sponsor's cybersecurity risk profile or certain newly identified risks.


text: Cybersecurity Risk Management and Strategy Cybersecurity risks and data protection are key components of our long-term strategy and enterprise risk management program and are integrated into our overall risk management systems and processes. We maintain processes for assessing, identifying and managing material risks from cybersecurity threats, and we routinely invest in the development and implementation of essential cybersecurity systems, infrastructures and processes to protect the security and integrity of our systems, networks, databases and proprietary information. Key areas of our cybersecurity risk management processes and strategy currently include:

companyName: MAGNACHIP SEMICONDUCTOR Corp

ticker: MX


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of the Investment Advisor and other third-party service providers. The Investment Advisor manages our day-to-day operations and has implemented a cybersecurity program that applies to us and our business.

companyName: Palmer Square Capital BDC Inc.

ticker: PSBD


text: Ongoing Evaluation and Assessment of Systems and Procedure : We monitor compliance with regulatory, industry and evolving data privacy requirements and update our cybersecurity risk management program from time to time as appropriate. We also continuously monitor our information security systems and processes on an ongoing basis to identify and remediate cybersecurity threats and vulnerabilities that could be exploited to adversely impact our business operations. To better preemptively identify risks and vulnerabilities in our security systems, we perform penetration testing for security controls using external third-party tools and encourage vulnerability reporting within our organization.


text: Cross-Collaboration and Coordination : Cybersecurity risks related to our business, privacy and compliance issues are identified and managed through a multifaceted approach, including third-party monitoring, internal and external IT security audits and reviews by relevant committees.


text: Third-Party Service Providers : We engage leading third-party product and service providers to assist us with our cybersecurity risk management. We use an Information Prevention and Data Loss Prevention System on networks and endpoints, which is designed to prevent unauthorized access to or transfer of sensitive data. We also use centrally managed antivirus systems for blocking illegal software to detect and remove malware and illegal software from devices in real time. In particular, we use a Managed Security Service provider for Security Information and Event Management services for matters such as firewall management, intrusion detection and prevention, vulnerability management and incident response.


text: Cyber Incident Response Plan : We maintain a comprehensive cyber incident response plan that sets forth the applicable processes, roles, engagements, escalations and notifications to promptly respond to a cybersecurity incident. This plan covers steps to be taken upon the detection of a cybersecurity incident detection, review by relevant committees, identification of damages, recovery process, post-incident analysis and the introduction of improvement measures. Such incident responses are managed in a timely manner by a dedicated team and overseen by relevant organizations, including IT, finance, legal and compliance.


text: Security Awareness Training for Personnel : We provide comprehensive employee training on cybersecurity awareness, confidential information protection and simulated phishing attacks.


text: Review of Third-Party Risks : We routinely conduct risk and compliance assessments of third-party service providers prior to exchanging any sensitive data or integrating with any key third-party provider.


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats, including any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats (including any previous cybersecurity incidents) that could be reasonably likely to materially affect us, please refer to our Risk Factors discussion under the heading 'We may be subject to disruptions, breaches or cyber-attacks of our secured networks and information technology systems that could damage our reputation, harm our business, expose us to liability and materially adversely affect our results of operations' in Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance In line with our overall risk management governance structure, management is responsible for the day-to-day management of cybersecurity risks while the Company's Board of Directors and its Risk Committee actively and continuously provide oversight.


text: Our Risk Committee oversees the Company's management of key risks including those arising from cybersecurity threats. Our management team reports to the Risk Committee on a quarterly basis, presenting their assessment of key enterprise risks, including cybersecurity. The topics include trends in cyber threats and the initiatives designed to strengthen our security systems and enhance the cyber readiness of our organization. Additionally, at least annually, our management team and our Chief Information Security Officer ("CISO") update the members of the Risk Committee and the Board of Directors on existing and new cybersecurity risks, status of risk mitigation efforts, cybersecurity incidents, if any, and the progress of key information security initiatives.


text: In 2020, we established the Information Security Steering Committee (the "IS Steering Committee"), a management-level and cross-functional committee, led by our Chief Executive Officer, and comprised of our Chief Compliance Officer, Chief Financial Officer, CISO, Chief Privacy Officer and relevant teams including Information Security, HR, Compliance & Internal Audit and Legal. The IS Steering Committee holds quarterly meetings, during which they review and take action on a wide range of topics, including cybersecurity threat matters such as prevention monitoring, detection mitigation and remediation of cybersecurity incidents.


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: PIMCO Capital Solutions BDC Corp.


text: Our CISO leads a dedicated Information Security team in charge of cybersecurity matters. Collectively, the members of our Information Security team have over 35 years of relevant experience in various roles involving information technology, information security, compliance and systems. Also, our Information Security team oversees compliance with our cybersecurity framework, facilitates cybersecurity risk management activities, assists with the review and approval of policies, and oversees the security awareness program. At least annually, our Information Security team and CISO update the members of the Risk Committee and the Board of Directors on compliance and risk matters. The Information Security team also reports to the IS Steering Committee on a quarterly basis. We invest in ongoing cybersecurity training for our Information Security team.


text: We rely extensively on various information systems and other electronic resources to operate our business . In addition, nearly all our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking, and accounting systems, use their own information systems and electronic resources. Any of these systems can be compromised, including through the employees, customers, and other individuals who are authorized to use them, and bad actors who use a sophisticated and constantly evolving set of software, tools, and strategies to do so. Moreover, the nature of our business as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue. For additional information see "Item 1A. Risk Factors—Operational Risks."

companyName: Princeton Bancorp, Inc.

ticker: BPRN


text: Accordingly, we have long devoted significant resources to assessing, identifying, and managing risks associated with cybersecurity threats, including: in-house team dedicated to information and cybersecurity, responsible for conducting regular evaluations of our information systems, existing controls, vulnerabilities, and potential enhancements; tools for continuous monitoring capable of detecting and aiding in the response to cybersecurity threats in real-time;


text: conducting thorough due diligence on our third-party service providers, evaluating their cybersecurity practices, and requiring contractual commitments from them to implement specific cybersecurity measures;


text: collaboration with third-party cybersecurity experts who perform periodic penetration testing, vulnerability assessments, and other procedures to pinpoint potential weaknesses in our systems and processes; and regular cybersecurity training sessions for our staff.


text: This information security program is a key part of our overall risk management system, which is administered by our Information Security Officer . The program includes administrative, technical and physical safeguards to help ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of our bu sine sses and geographic locations.