text: We have developed policies and processes for assessing, identifying, and managing material risk from cybersecurity threats informed by industry-recognized standards. We have integrated these processes into our overall risk management systems and programs. Our cybersecurity program includes, among other things: procedures to assess material risk from cybersecurity threats, protocols to monitor any potential unauthorized access to, or conducted through, our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein, mechanisms to safeguard network infrastructure, mandatory employee training on information security, and assessing the sufficiency of existing policies, procedures, systems, controls and other safeguards in place to manage such risks. As part of our risk management process, we have engaged and expect to continue to engage third party experts to help identify and assess risks from cybersecurity threats. Our risk management process is also designed to address cybersecurity risks associated with our use of third-party service providers, and includes procedures such as reviewing security audits and controls of these providers during the onboarding process.

companyName: indie Semiconductor, Inc.

ticker: INDI


text: In connection with these risk assessments, we design, implement and maintain reasonable safeguards to minimize the identified risks and address identified gaps in existing safeguards, update existing safeguards as necessary and monitor the effectiveness of our safeguards.

secItem: Item 1C


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including as a result of any previous cybersecurity incidents) that have materially affected our business strategy, our results of operations or our financial condition, but there can be no guarantee that we will not experience a cybersecurity incident in the future. We can give no assurance that we have detected or protected against all cybersecurity threats or cybersecurity incidents.

stage1Category: Strategy Integration

stage1Method: unanimous


text: For further discussion of cybersecurity risks, please see our Risk Factors discussion under the heading, "Risks Related to Our Intellectual Property, Technology and Cybersecurity. "

stage1Category: None/Other


text: Our Board of Directors (the "Board") has oversight responsibility over the Company's strategy and risk management, including material risks related to cybersecurity threats. The Audit Committee of the Board (the "Audit Committee") oversees the management of systemic risks, including cybersecurity, in accordance with its charter. The Audit Committee receives periodic reports from management concerning our significant cybersecurity threats and risks and the processes we have implemented to address them, and engages in discussions with management regarding the Company's significant risk exposures and the measures implemented to monitor and control these risks. These discussions include a review of our cybersecurity-related risk assessment and risk management policies.


text: Management, in coordination with our information technology department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management, along with our information technology department, is responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate cybersecurity incidents to members of management depending on the circumstances. Our information technology department works with management, including the Chief Operating Officer and Chief Financial Officer, to help mitigate and remediate cybersecurity incidents of which they are notified. Our information technology department, led by our director of information technology, includes individuals with over 20 years of prior work experience in various roles involving security, compliance, systems and risk management implementation. In addition, our incident response processes include procedures for reporting material cybersecurity incidents to the Audit Committee for material cybersecurity incidents.


text: Cybersecurity Governance and Oversight Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's ongoing activities related to our cybersecurity risk management program, using outside specialists where deemed necessary.

companyName: Mersana Therapeutics, Inc.

stage1Category: Board Governance


text: Cybersecurity Risk Management and Strategy We have designed and maintain a cybersecurity risk management program that is integrated into our overall enterprise risk management program and with other related functions, such as information technology, or IT, system architecture and vendor management; that leverages best practices and standards and that is designed to assess, identify and manage risks from cybersecurity and other information security threats. As part of this program, we periodically evaluate risks from cybersecurity threats as part of our broader risk management activities and as a component of our internal control system. In the course of our evaluation, we consider risks that may be associated both with our internally managed IT systems and key business functions and with sensitive data operated or managed by third-party service providers, vendors and collaborators with whom we engage.

stage1Category: Risk Management Process


text: We use the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF, as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. We have designed and assessed our program based on the NIST CSF. This does not imply that we meet any particular technical standards, specifications or requirements.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches.


text: Key aspects of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, and information; • dedicated personnel principally responsible for managing our cybersecurity risk assessment processes, our security controls and our response to cybersecurity incidents; • the conduct of regular exercises and tests of our own systems to help discover potential vulnerabilities; • the use of external service providers, where appropriate, overseen by our IT team, to assist with assessing our systems; monitoring cybersecurity threats, including the proactive identification of vulnerabilities in our systems with threat intelligence, and our defenses against cyberattacks;and providing timely cybersecurity threat alerts; • new-hire, annual and ad hoc cybersecurity awareness training for our employees, incident response personnel and senior management; • a cybersecurity incident response plan, or the Response Plan, that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process, overseen by our IT team, for key service providers, vendors and collaborators, including a due diligence process that involves the completion of security questionnaires and risk assessments, as appropriate, on third parties who maintain material data or information to help us evaluate and verify third party information security capabilities.

stage1Method: majority


text: Our Response Plan sets forth our response protocol for cybersecurity threats and cybersecurity events and incidents and is maintained by our cybersecurity incident response team, or CSIRT, which reviews the Response Plan on at least an annual basis. The CSIRT is comprised of IT department leaders, under the supervision of our Vice President, Chief Accounting Officer, who reports to our Senior Vice President, Chief Operating Officer and Chief Financial Officer, as well as members of our executive team and other senior management. Our Response Plan is designed to provide a framework for how we identify, evaluate, escalate, respond and recover in the event of a data security breach and designates personnel who are responsible for these functions. Our IT team, utilizing the support of external vendors and software products, evaluates security alerts received from various sources, and any alert or threat that the CSIRT identifies as a cybersecurity incident is promptly evaluated and escalated in accordance with the Response Plan for further assessment. Upon confirmation that a cybersecurity incident has occurred, our CSIRT will establish an incident response team, which may include representatives from our internal departments, as well as internal or external legal counsel or other external cybersecurity consultants or service providers. The CSIRT aims to develop a coordinated response strategy, including with respect to risk containment, notification processes, system restoration, incident documentation and assessment, data preservation and forensic analysis.


text: Our Response Plan is designed to ensure that cybersecurity incidents that have had or are reasonably likely to have a material effect on our business strategy, financial condition, and results of operations are promptly escalated to relevant executive officers, including our Senior Vice President, Chief Legal Officer, for further assessment of potential materiality and, if appropriate, notification to other members of our senior management team, the chairperson of the audit committee of our board of directors, or the Audit Committee, and the full board of directors, as needed, and preparation and dissemination of public disclosure.


text: Based on an assessment using the previously described cybersecurity risk management program, we do not believe that there are currently any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition to date. However, we, our collaborators and our third-party vendors and service providers may in the future be the target of cybersecurity threats, any of which could have a material adverse effect on our business. For a description of the cybersecurity risks we face and potential related impacts on us, see "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Our executive team, including our Senior Vice President, Chief Operating Officer and Chief Financial Officer and our Senior Vice President, Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The executive team has primary responsibility for our overall cybersecurity risk management program. Our Senior Vice President, Chief Operating Officer and Chief Financial Officer supervises our Vice President, Chief Accounting Officer, who leads the operational oversight of our company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare our company and our internal cybersecurity personnel and retained external cybersecurity advisors to address cybersecurity risks. Our Vice President, Chief Accounting Officer and the internal cybersecurity personnel under his supervision collectively have experience in cybersecurity, information security, data protection, privacy, regulatory compliance and risk management within complex and international business verticals, such as pharmaceuticals/biotechnology, technology, telecommunications and financial services, and hold several related third-party certifications related to information systems management and security.

stage1Category: Management Role


text: Our executive team is informed about and monitors the prevention, detection, evaluation, mitigation, and remediation of key cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external advisors engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use and mobile security. This training and compliance program functions to educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: As a defense contractor developing advanced technologies, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly capable adversaries, including nation state actors that target the defense industrial base and other critical infrastructure sectors. Our customers, suppliers, subcontractors and joint venture partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations.

companyName: Leonardo DRS, Inc.

ticker: DRS


text: We recognize that cybersecurity is critical to the success of our business. We regularly contract with the U.S. government on programs classified for national security purposes. To adequately safeguard classified and controlled unclassified information, our Cybersecurity Program operates across the enterprise, strongly supported and overseen by our management and the Board. Employees are regularly trained on potential cyber threats and are expected to maintain a high level of cybersecurity awareness.


text: Our Cybersecurity Program Our Cybersecurity Program includes the following four core components: Cyber Operations; Cyber and Information Technology Governance and Compliance; Classified Information Systems; and Cyber/Supplier Risk Management.


text: • The Cyber Operations team is responsible for maintaining prevention, detection, and response capabilities in a defense-in-depth infrastructure. The prevention, detection, and response capabilities leverage various tools and services. The Cyber Operations team is engaged to provide timely incident response and works to minimize adverse impacts to our operations. • The Cyber and Information Technology Governance and Compliance team works to align the Company's cyber approach to requirements such as NIST 800-171, CMMC, and other information technology general controls. The Cyber and Information Technology Governance team develops Company policies designed to reduce, manage, and mitigate cyber risks. • The Classified Information team maintains the Company's classified information systems and works closely with the Company's Industrial Security team to help the Company meet the requirements laid out by the DoD for classified systems. • The Cyber/Supplier Risk Management team collaborates with the Company's supply chain function to identify and work with critical suppliers to reduce cyber risk and minimize or eliminate collateral impacts.


text: As a defense contractor, we must comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement related to adequately safeguarding controlled unclassified information and reporting cybersecurity incidents to the DoD. We have implemented cybersecurity policies and frameworks based on industry and governmental standards to align closely with DoD requirements, instructions and guidance.


text: We also participate and support multiple threat-sharing communities including the National Defense Information Sharing and Assessment Center, the defense industrial base Cybersecurity Program, and the National Defense Cyber Alliance. Participating in these communities allows us to collaborate with our Defense Industrial Base sector peers, government agencies, information sharing and analysis centers, and cybersecurity associations. The Cybersecurity Program staff also maintains regular contact with the Federal Bureau of Investigation for sharing of threat information.


text: Third-party assessment findings are logged in our internal audit system and tracked until mitigated and/or remediated. These assessments are documented and reviewed with the Company's Chief Executive Officer and Chairman, Chief Operating Officer, Chief Information Officer, General Counsel, as well as the Government Security Committee ("GSC") of the Board. Both the Internal Audit team and the Chief Information Security Officer are responsible for reporting any material assessment findings to their respective Board committees.


text: Our Board oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Chief Information Security Officer, regularly briefs our Board through the GSC depending on the nature and severity of the business impact. The Chief Information Security Officer also provides the GSC with an update on the Company's risk management process and the risk trends related to cybersecurity at least annually. The Audit Committee maintains oversight of material risk mitigation recommendations identified by third-party assessors and receives reports as assessments occur. Cyber assessments are performed no less than annually. The full Board retains oversight of cybersecurity because of its importance and the heightened risk in the defense industry.


text: The Cyber Program is organized under our Chief Information Security Officer. The current Chief Information Security Officer has extensive information technology and program management experience and has served for over a decade in our corporate information security organization. He has a Masters in cybersecurity from Valparaiso University. Additionally, he has both Certified Information Systems Security Professional-Information Systems Security Management Professional ("CISSP-ISSMP") and Certified Information Systems Auditor ("CISA") certifications, and is also a recognized Information Technology Infrastructure Library ("ITIL") expert. The Chief Information Security Officer reports to the Executive Vice President, General Counsel & Secretary with oversight by the Board of Directors. Over the course of the last decade, our management team has gained extensive experience investing in, providing oversight of, and setting the strategy for our cybersecurity program. Prior to joining DRS, our Chief Executive Officer oversaw the development of the DoD cybersecurity strategy while serving as Deputy Secretary of Defense from 2009 to 2011.


text: While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that materially affected or is reasonably likely to materially affect our business strategy, results of operations, or financial condition, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, writing down inventory value, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant program delays and reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. See Part I, Item 1A, "Risk Factors—Risks Related to Our Business—We are susceptible to a security breach, through cyber-attack, cyber-intrusion, insider threats or otherwise, and to other significant disruptions of our IT networks and related systems, or those of our customers, suppliers, vendors, subcontractors, partners, or other third parties" in this Annual Report.


text: Risk Management and Strategy We recognize the importance of maintaining an integrated cybersecurity risk management system and view our responsibility for cybersecurity management as an enterprise risk, where we have adopted proactive and defensive safeguards. We maintain layered processes that place responsibility for management and mitigation of cybersecurity risks at both the management and Board level, which is modeled after the National Institute of Standards and Technology's cybersecurity framework, as more fully described below.

companyName: Hilton Grand Vacations Inc.

ticker: HGV


text: We have not previously experienced a cybersecurity incident that has materially affected HGV, including our business strategy, results of operations, or financial condition. However, we cannot be certain that we will not experience such an incident in the future. For information on risks we face from cybersecurity threats, see "Our increasing reliance on information technology and other systems subjects us to risks associated with cybersecurity. Cyber-attacks or our failure to maintain the security and integrity of company, employee, associate, customer, or third-party data could have a disruptive effect on our business and adversely affect our reputation and financial performance" in Item 1A. Risk Factors.


text: Management Level Governance Our cybersecurity efforts are led by the Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO"). The CISO has primary management-level responsibility for assessing and managing our cybersecurity program. The CISO reports to the CTO, who provides regular feedback to other members of the management team on managing material risks from cybersecurity threats.


text: Our CISO has over 25 years of experience in the field of cybersecurity. His background includes extensive experience as a technology consultant. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies.


text: Our SVP, Global Operations is responsible for monitoring the prevention, mitigation, detection, and remediation of cybersecurity incidents and reports the same to the Audit Committee of the Board each quarter. The Audit Committee has been delegated the responsibility for fulfilling the Board's oversight responsibilities regarding cybersecurity risk.

companyName: Silvaco Group, Inc.

ticker: SVCO


text: Our CTO has extensive experience designing, developing, and utilizing technology products for security operation center services. His technical responsibilities spanned product security, privacy controls, data protection, and identity management. He has also overseen security operations, incident response, threat hunting, security intelligence, analytics, and technical fraud functions and worked with legal response teams at numerous companies, including serving as a Managing Director of a cybersecurity firm. He has advised chief information officers and consulted for boards of directors on cybersecurity related issues and attacks.


text: Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program on information security. He is also responsible for keeping HGV apprised of the latest developments in cybersecurity, including potential threats and innovative risk management techniques. We believe this ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions designed to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Board Level Governance The Audit Committee has primary Board-level responsibility for oversight of our cybersecurity and data protection risks. and serves as a liaison between management and the full Board. The Audit Committee receives regular reports from our CTO and CISO regarding the primary cybersecurity risks facing HGV, and the steps management is taking to mitigate such risks. The CISO and the CTO provide comprehensive briefings to the Audit Committee on a regular basis, generally at least once per quarter. These briefings include: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity incidents, if applicable; and • Compliance with regulatory requirements and industry standards.


text: The Audit Committee also reviews our cybersecurity management strategy and initiatives on a regular basis with our CTO and CISO. Both the Audit Committee and Board will promptly be made aware of any significant cybersecurity incident, as specified in our cybersecurity incident response plan.


text: Third-Party Engagement Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors, to periodically evaluate and test our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, with the intention of keeping our cybersecurity strategies and processes at the forefront of industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements. The cybersecurity program also involves performance of tabletop exercises to test our incident response plan.


text: Third-Party Oversight We maintain processes in place to oversee, identify, and mitigate risks from cybersecurity threats related to third-party service providers, including conducting thorough security assessments of third-party service providers before onboarding. We also maintain ongoing compliance monitoring to oversee evolving cybersecurity risks. We generally include minimum information security requirements in our agreements with third-party service providers to address cybersecurity risks.


text: We are committed to combating the threat of cyber-attacks and to securing our business through our information security programs and developing a deep understanding of cybersecurity risks, vulnerabilities, mitigations, and threats. We have a global cybersecurity process applicable to all subsidiaries and business lines.

companyName: NEWMARK GROUP, INC.

ticker: NMRK


text: Risk Management and Strategy Our global cybersecurity processes form the comprehensive framework we utilize for planning, performing, managing, assessing, and improving our security controls as they relate to cybersecurity, and form part of our overall risk management system. We aim to conduct our cybersecurity program in accordance with currently recognized global policies and standards for cybersecurity and information technology. These processes are managed by our cybersecurity team headed by our CISO and CIO and supported by our business continuity teams.


text: We conduct periodic internal and external vulnerability audits and assessments and penetration testing and provide periodic cybersecurity training to employees. These measures include regular phishing simulations, annual general cybersecurity awareness training and data protection training. We also participate in industry-specific cybersecurity roundtables and professional groups to ensure we remain abreast of industry-wide cybersecurity developments and best practices and thereby enhance our threat identification processes and responses as necessary. Additionally, when engaging with and utilizing third-party vendors and partners for our business, we conduct various oversight assessments, including due diligence and periodic monitoring to identify potential cybersecurity threats associated with our conducting business with such vendors and partners and to ensure any corresponding risk exposure aligns with our business requirements and risk tolerances.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas that we evaluate and address on a regular basis based on a risk-weighted determination.

companyName: System1, Inc.

ticker: SST


text: We maintain an incident reporting and escalation process in the event of any observed, detected, or suspected events that we believe may qualify as a cybersecurity incident. Risks are identified based on a four-tier system, and tiers are assigned based on the service impact, user impact, financial impact, and security impact that a threat may pose. Our processes include steps to recover our systems and information through established and tested system recovery plans and business continuity plans, each based on the appropriate response associated with the corresponding tier of the identified threat. Our incident response process includes steps to notify key incident management team members who are responsible for communicating with regulatory and other governmental authorities about cybersecurity events as applicable and as required by law. We determine the materiality of such incidents based upon a number of factors including if the incident had or may have a material impact on our business strategy, results of operations, or financial condition. This process involves a review of the nature of the incident by our cybersecurity team as well as other members of management and employees with specialized technology or financial knowledge, including our CISO, CIO, and CFO, as applicable. In the event of a material breach, we have a process for escalation to appropriate members of our senior management, and, where appropriate, to our Board and Audit Committee. These groups also collaborate in determining the appropriate response to such events and disclosure of any material breach.


text: We engage third parties from time to time that assist us in the identification, assessment, and management of cybersecurity risks. We also engage cybersecurity specialists to complete assessments of our cybersecurity processes, program and practices, including our data protection practices, as well as to conduct targeted attack simulations. The feedback from these assessments and guidance from external specialists informs our overall risk management system and the development and improvement of our processes to mitigate cybersecurity risks throughout the Company.


text: Disaster Recovery Our processes address disaster recovery concerns. We operate most of our technology from dual-primary data centers in the cloud, with one located in the Eastern U.S. region and the other in the Western U.S. region. Either site alone is capable of running all of our essential systems. In addition, we maintain technology operations in East Asia, the Western U.S. and the South Central U.S. regions. Replicated instances of this technology are maintained in our Eastern U.S. region. All regions are built and equipped to best-practice standards of physical security with appropriate environmental monitoring and safeguards. Failover for the majority of our systems is automated.


text: Board Governance and Management Our global cybersecurity processes are managed primarily by our CISO, whose experience includes approximately 20 years of service in roles relating to assessing, managing and providing oversight for cybersecurity risks at public and private entities, our CIO, whose experience includes managing the technology professionals and processes at public commercial real estate advisors, and our CFO, whose experience includes risk management and specialized financial knowledge. Pursuant to the Audit Committee charter, the Audit Committee oversees the management of the Company's risk management process, including the identification, prioritization, assessment and management of risks related to cybersecurity. While our Board and Audit Committee members have broad experience in risk management and in some cases technological expertise relating to cybersecurity, our CISO and CIO and management teams handle cybersecurity threat management. The CISO and CIO provide the Board and Audit Committee periodic reports regarding the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of our information security program, and any issues associated with the emerging threat landscape. In addition, the CISO provides periodic reports to our executive officers, members of the boards of certain of our regulated entities internationally and other members of our senior management as appropriate. Material events and updates are reported to the full Board and Audit Committee annually and on an ad hoc basis where warranted based on the level of materiality of any such incidents as determined by the incident reporting and escalation process led by our CISO and CIO. Our processes are regularly evaluated by internal and external experts, with the results of those reviews reported to senior management and, where appropriate, the Board and Audit Committee.


text: Although we believe risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition to date, they may in the future, and we continue to closely monitor risks from cybersecurity threats. For additional information on the impact of cybersecurity matters on us, see "Risks Related to Our Business—Risks Related to Our IT Systems and Cybersecurity" in Part I, Item 1A, Risk Factors of this Annual Report on Form 10-K.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and data. We design and assess our program based on the International Organization for Standardization ("ISO") 27001 framework and other applicable industry standards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use such standards, including ISO 27001, as a guide to help us identify, detect, assess, and manage reasonably foreseeable cybersecurity risks and threats relevant to our business.

companyName: FuboTV Inc.

ticker: FUBO


text: Our cybersecurity risk management program is supported by both management and our Board of Directors, and is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


companyName: BGC Group, Inc.

ticker: BGC


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: • risk assessments designed to help identify reasonably foreseeable material risks from cybersecurity threats to our critical systems, information, products, services, and our broader enterprise IT environment, which are then used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our management team and Audit Committee on a quarterly basis; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • periodic assessment and deployment of security tools and technical safeguards designed to protect our information systems from reasonably foreseeable cybersecurity threats; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • controls designed to identify, detect, assess and manage reasonably foreseeable cybersecurity threats associated with our use of key third-party service providers, suppliers and vendors with respect to our critical systems and data based on our assessment of how critical they are to our operations and respective risk profile.


text: We have not identified any cybersecurity threats, including as a result of prior incidents, that as of the date of this Annual Report have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risk from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information regarding the risks we face from cybersecurity threats, please see Part I, Item 1A. "Risk Factors—Risks Related to Privacy, Consumer Protection and Cybersecurity."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Audit Committee") oversight of cybersecurity risks, including the oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management and our internal cybersecurity personnel, including our Senior Director of Cybersecurity, on our cybersecurity risks. In addition, management updates the Audit Committee, when it deems appropriate, regarding cybersecurity incidents it considers to be significant. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.


text: Our management team, including our Chief Financial Officer, Chief Legal Officer and Chief Technology Officer, is responsible for assessing and managing our material risks from cybersecurity threats, and has primary responsibility for our overall cybersecurity risk management program. The management team has broad experience in overseeing and managing enterprise risk, governance and compliance functions, and supervises both our internal cybersecurity personnel, including our Senior Director of Cybersecurity who reports directly to our Chief Financial Officer, and external cybersecurity consultants retained from time to time, in each case who have broad cybersecurity experience and expertise, including in threat assessments and detection, mitigation technologies, training, incident response, cyber forensics, insider threats and regulatory compliance.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us from time to time to review and assess our cyber programs and policies; and alerts and reports produced by security tools deployed in our IT environment. In addition, our Chief Financial Officer, Chief Technology Officer and Chief Legal Officer are members of our internal Cybersecurity Governance Committee, chaired by the Senior Director of Cybersecurity, a management committee comprised of leadership from primary corporate functions including Finance, Human Resources, Information Technology, Engineering, Internal Audit and Legal, which meets quarterly to drive alignment on security decisions across the Company, including reviewing security performance metrics, identifying security risks, and assessing the status of approved security enhancements.


text: We are committed to combating the threat of cyber-attacks and to securing our business through our information security programs and developing a deep understanding of cybersecurity risks, vulnerabilities, mitigations, and threats. We have a global cybersecurity process applicable to all subsidiaries and business lines.


text: Risk Management and Strategy Our global cybersecurity processes form the comprehensive framework we utilize for planning, performing, managing, assessing, and improving our security controls as they relate to cybersecurity, and form part of our overall risk management system. We aim to conduct our cybersecurity program in accordance with current recognized global policies and standards for cybersecurity and information technology. These processes are managed by our cybersecurity team headed by our CISO and CIO and supported by our business continuity teams.


text: We maintain policies and processes for assessing, identifying, and managing risks from cybersecurity threats, and have integrated these policies and processes into our overall risk management strategy. Our cybersecurity program is informed by standards established by the National Institute of Standards and Technology (NIST) and the Center for Internet Security (CIS).

companyName: Absci Corp

ticker: ABSI


text: Board Governance and Management Our global cybersecurity processes are managed primarily by our CISO, whose experience includes approximately 20 years of service in roles relating to assessing, managing and providing oversight for cybersecurity risks at public and private entities, our CIO, whose experience includes managing the technology professionals and processes at public and private financial services companies, beginning in December 2024, our global CIO, whose experience includes approximately 40 years of service in financial services and technology, and our CFO, whose experience includes risk management and specialized financial knowledge. Pursuant to the Audit Committee charter, the Audit Committee oversees the management of the Company's risk management process, including the identification, prioritization, assessment and management of risks related to cybersecurity. While our Board and Audit Committee members have broad experience in risk management and in some cases technological expertise relating to cybersecurity, our CISO and CIO and management teams handle cybersecurity threat management. The CISO and CIO provide the Board and Audit Committee periodic reports regarding the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of our information security program, and any issues associated with the emerging threat landscape. In addition, the CISO provides periodic reports to our executive officers, members of the boards of certain of our regulated entities internationally and other members of our senior management as appropriate. Material events and updates are reported to the full Board and Audit Committee annually and on an ad hoc basis where warranted based on the level of materiality of any such incidents as determined by the incident reporting and escalation process led by our CISO and CIO. Our processes are regularly evaluated by internal and external experts, with the results of those reviews reported to senior management and, where appropriate, the Board and Audit Committee.


text: Although we believe risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition to date, they may in the future, and we continue to closely monitor risks from cybersecurity threats. For additional information on the impact of cybersecurity matters on us, see "Item 1A — Risk Factors — Risks Related to Our IT Systems and Cybersecurity."


text: Disaster Recovery Our processes address disaster recovery concerns. We operate most of our technology from U.S. and U.K. primary data centers. Either site alone is typically capable of running all of our essential systems. Replicated instances of this technology are maintained in our redundant data centers. Our data centers are generally built and equipped to best-practice standards of physical security with appropriate environmental monitoring and safeguards.


text: We conduct annual disaster recovery training exercises for each primary data center where failover procedures are tested against defined Recovery Time Objectives (RTOs).


text: Cybersecurity Risk Management and Strategy Our enterprise risk management program is designed to identify, measure, monitor and control all significant risks across various aspects of our company. Cybersecurity risk management processes are integrated into this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer ("CISO") is primarily responsible for our cybersecurity program and is a key member of the risk management function, reporting directly to the Chief Risk Officer ("CRO") and to the Enterprise Risk Committee of our Board of Directors.

companyName: BANC OF CALIFORNIA, INC.

ticker: BANC


text: Our objective for managing cybersecurity risk is to maintain appropriate layers of safeguards to protect information systems from possible threats and to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. Our information security program is designed in accordance with industry frameworks, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and is periodically reviewed and updated at least annually and upon significant changes to our operating environment. Our program includes the following key elements: • Systems Safeguards. We adopt the "trust by design" framework when designing new products, services and technology. We employ a variety of administrative, preventative and detective controls and tools designed to monitor, detect, block, and provide alerts regarding suspicious and unauthorized activity and to report on suspected advanced persistent threats. • Incident Response. We maintain an Incident Response Plan ("IRP") that provides a documented framework for responding to actual or potential cybersecurity incidents. The IRP is coordinated through the CISO and key members of management and addresses roles, responsibilities, and communication and contract strategies in the event of a compromise, including analysis of reportable events in accordance with applicable legal and compliance requirements. • Collaboration. We engage cybersecurity experts and third-party specialists to perform regular assessments of our infrastructure, software systems and network architecture. We also leverage internal and external auditors and independent external partners to periodically review our processes, systems and controls, including with respect to our information security program, to assess their design and operating effectiveness. • Education and Training. We have regular and ongoing security education and training for employees, practical exercises that simulate actual cyber-attacks, and recovery and resilience tests. • Third-Party Risk Management. We maintain a third-party risk management program designed to identify, assess and manage cybersecurity risks associated with external service providers, contractors and vendors.


text: To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations, or financial conditions. Our internal systems, processes, and controls are designed to mitigate and minimize potential losses resulting from cyber-attacks, however, there can be no assurance that our cybersecurity risk management program will be fully effective in protecting the confidentiality, integrity and availability of our information systems and our solutions. For further discussion of risks from cybersecurity threats, see Item 1A. Risk Factors in the section titled "We are subject to certain risks in connection with our use of technology."


text: Our Board of Directors considers cybersecurity risk as part of its risk management function and has delegated to the Enterprise Risk Committee oversight and governance of the technology program and the information security program, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The Enterprise Risk Committee reviews our cybersecurity risk profile on a quarterly basis. Additionally, our CISO and our Chief Information Officer provide quarterly reports to the Enterprise Risk Committee regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes.


text: The Information Technology and Information Security sub-committee is a sub-committee of the management level Enterprise Risk Management Committee and is represented by managers within various departments and includes the CISO, the Chief Technology Officer ("CTO"), and the Chief Information Officer ("CIO") and other key departmental managers from throughout the entire company. This sub-committee meets quarterly to provide oversight of the technology management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. Meetings with key team leaders occur as required and in accordance with the IRP in order to facilitate timely informing and monitoring efforts. The Company's Executive Leadership Team meets monthly with the CISO, CIO, and CTO and reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at various meetings and responses to any actions taken to/from the Enterprise Risk Committee on a quarterly basis or more frequently as may be required by the IRP.


text: Our CISO has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management and is accountable for managing our enterprise information security department and developing and implementing our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, client, vendor and employee education and awareness, and business continuity and disaster recovery. The department, as a whole, consists of information security professionals with varying degrees of professional education, certifications and experience.


text: Risk Management and Strategy As a healthcare provider, cybersecurity, data protection, safeguarding patient information and the integrity of our information systems is of the utmost priority. We have developed and maintain a Cybersecurity and Data Protection Program which aligns with industry-standard frameworks and applicable regulatory requirements, integrates with our overall risk management process, and aims to ensure cybersecurity concerns are a requisite element for decision-making at all levels of our business.

companyName: RadNet, Inc.

ticker: RDNT


text: RadNet's Cybersecurity and Data Protection Program assesses, identifies and manages threats to our information systems and evaluates cybersecurity risks associated with our vendors and third-party partners. We are focused on detecting, preventing and responding to cyber threats, maintaining the privacy and protection of sensitive information, and maintaining the durability and resiliency of our information and data processing systems.


text: Our approach to designing, operating and measuring the effectiveness of our program leverages experienced internal resources, industry-recognized cybersecurity consultants, assessors, healthcare and industry-specific cybersecurity working groups and threat-intelligence platforms, federal law enforcement and CISA partnerships. We use these resources and partnerships, along with our internal expertise, to develop specialized insights pertinent to our business's cyber-risk, and tailor our cybersecurity strategy to best safeguard our systems and data.


text: We staff an internal cybersecurity team and maintain a third-party managed security operations center which in-concert provide 24x7x365 real-time detection and response. These teams are always connected and routinely respond to perceived threats within minutes. Time to detect and respond metrics are continuously evaluated for opportunities to enhance our program.


text: Cyber-awareness training and testing is a key component of RadNet's Cybersecurity and Data Protection Program. Every employee is required to complete cyber-related training (including third-parties who access our systems) and successfully complete testing throughout the year in addition to monthly phishing tests. Furthermore, we require all system users to complete annual Patient Privacy and Patient Data Breach training and testing to meet RadNet compliance standards.


text: In addition, the Board receives regular updates via the Chair of the Risk and Sustainability Committee and various management committees, including the ORCC, Group internal audit, Group Risk and Group internal controls, and annual updates from the Global CISO and CIO on the state of cybersecurity across the Group. The Board is also notified of any relevant issues or incidents which have occurred or are reasonably likely to occur.

companyName: Flutter Entertainment plc

ticker: FLUT


text: We benchmark and evaluate our Cybersecurity and Data Protection Program and data protection maturity against the NIST Cybersecurity Framework and the HIPAA Security Rule. Consistent with these frameworks, our program includes recurring third-party assessments and a vendor risk management program. Our vendor risk management program conducts security assessments to determine a risk profile of potential vendors and third-party partners and integrates ongoing monitoring and periodic re-assessments to ensure compliance with RadNet's security standards. RadNet's Vendor Risk Management Team works closely with RadNet Legal, Compliance and Operations teams to address data safety, compliance and legal requirements for each of our vendor/partner engagements.


text: We continuously evaluate the practical effectiveness of our cyber-defenses both internally and externally using a combination of technology-based assessments and recurring third-party audits. Our Critical Incident Response Team periodically conducts cyber-focused tabletop exercises using scenarios drawn from observations of risk indicators and from threat intelligence reports of real-world incidents affecting our industry. Outcomes and insights from tabletop exercises are used to enhance RadNet's Incident Response Plan which is architected following NIST guidelines and reviewed annually and updated periodically as needed.


text: Our program's overall maturity and operational readiness are regularly evaluated internally by RadNet IT Governance and Compliance teams and by independent expert auditors using the NIST's Cybersecurity Framework. Our program, and the results of the evaluation and testing efforts, are regularly reviewed by our senior management and members of our Board of Directors.


text: Cybersecurity threats, including previous cybersecurity incidents, have not materially affected our business strategy, results of operations, or financial condition. However, cybersecurity threats have the potential to interrupt our operations or cause significant financial hardship. Our risks associated with cybersecurity threats are set forth under "Risk Factors" in Part I, Item 1A in this report.


text: RadNet is committed to appropriate cybersecurity governance and oversight. Our Cybersecurity and Data Protection Program is the principal responsibility of our Chief Information Officer and Chief Information Security Officer, each of whom have over 20 years of experience in information systems, including cybersecurity training and experience. Additionally, RadNet's CIO and CISO work closely with our executive management, legal and compliance leaders, and meet regularly to discuss cybersecurity matters and risks.


text: Our Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity and information security risks. Our Audit Committee of our Board of Directors regularly reviews our technology and cybersecurity program and effectiveness, and internal audits of our program. Our Audit Committee also receives regular cybersecurity updates and education on a broad range of topics, including: • current cybersecurity landscape and emerging threats; • status of ongoing cybersecurity initiatives and strategies; • incident report and learnings from any cybersecurity events; and • compliance with regulatory requirements and industry standards.


text: Risk Management and Strategy The Company employs a comprehensive, cross-departmental approach to continuously assess, identify, and manage potential cybersecurity risks. Our cybersecurity risk management program involves collaboration between our employees, the information technology ("IT") security team, which is led by our Chief Information Security Officer ("CISO"), the Information Security Steering Committee ("ISSC"), which is chaired by our CISO and comprised of executive and senior representatives from key corporate functions as overseen by the Board of Directors, primarily through the Audit Committee. The Company's cybersecurity policies, standards, processes, and practices are integrated into the Company's overall risk management program and we regularly consider cybersecurity risks in the context of material risks to the Company.

companyName: STEVEN MADDEN, LTD.

ticker: SHOO


text: Our cybersecurity risk management program categorizes cybersecurity risks into five areas: identify, protect, detect, respond, and recover. We regularly assess the cybersecurity threat landscape, employing a layered cybersecurity strategy that emphasizes prevention, detection, and mitigation through a variety of technical and operational measures. As a part of our cybersecurity risk management program, our information security program is tailored to address identified risks, while aligning with pertinent business requirements.


text: We foster a shared responsibility for the Company's cybersecurity with all of our employees, conducting periodic phishing simulation campaigns and providing regular, mandatory cybersecurity training to enhance awareness and readiness against potential cyber threats. Certain roles require additional role-based, specialized cybersecurity training, such as tabletop exercises to ensure proactive preparation and effective coordination in the event of a security incident. We engage a third-party to conduct annual tabletop exercises in order to rehearse our incident response plan, as well as to identify and prioritize opportunities for improvement within our cybersecurity program and associated security controls, through a customized simulation specifically tailored to our current environment, processes, and procedures. To protect our data and information systems, we maintain Company-wide cybersecurity policies and procedures regarding encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and internet, social media, email, and wireless device usage. Our IT security team reviews and updates such policies and procedures to adapt to evolving cybersecurity landscapes, industry best practices, and regulatory and statutory updates. Our CISO conducts thorough reviews of these updates to ensure their continued relevance and effectiveness in safeguarding the Company's assets and business interests.


text: We continually seek to update our IT security, encompassing end-user training, layered defenses, critical asset identification and protection, enhanced monitoring and alerting, and engagement with third-party experts to evaluate the efficacy of our security measures. We engage reputable third parties to assist in the monitoring, protection, detection, and potential remediation of cybersecurity threats and incidents. We also regularly evaluate cybersecurity risks associated with our use of third-party service providers, conducting an annual review of hosted applications and assessing their cybersecurity preparedness. Risks from cybersecurity threats, including as a result of previous cybersecurity events encountered by the Company and known events encountered by third parties with a connection to the Company, have not materially affected, and are not currently viewed as reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.


text: Our CISO is primarily responsible for the assessment and management of the Company's material cybersecurity risks and the related cybersecurity risk management policies and procedures. Our CISO oversees our cybersecurity risk management and information security programs and provides quarterly status reports to the ISSC and the Audit Committee. Our CISO possesses over 25 years of experience in various technology, cybersecurity operations, and engineering roles, holds a bachelor's degree in computer information science and a master's degree in technology management, earned a CISO Certificate from Carnegie Mellon University, and is ISC2 CISSP certified.


text: Other key members of management assist our CISO in the oversight of cybersecurity risk management through their membership in the ISSC, which is chaired by our CISO and is comprised of our Chief Executive Officer, Chief Financial Officer, Chief Information Officer, General Counsel, President of Direct-to-Consumer, and Global Digital, Privacy Counsel, and our Vice President of Internal Audit. The ISSC reviews and discusses comprehensive quarterly and annual reports from our CISO and the IT security team in order to provide cooperation, collaboration, and consensus driven information security guidance to the IT department and the Company.


text: We have also established an Incident Response Team (the "IRT"), which is composed of individuals from our various IT and managerial functions and consults with members of internal departments, as needed, to identify and assess security incidents, including the impact and severity of such incidents. Upon the identification of a security incident, the IRT performs an impact analysis and then determines the appropriate course of action, which may include escalation to the ISSC. Upon consultation with the ISSC and consideration of the relevant risks, the IRT will determine whether the incident should be communicated to the Audit Committee of the Board of Directors.


text: Board of Directors The Audit Committee of the Board of Directors has responsibility for oversight of information and cybersecurity risks and assessment of cyber threats and defenses, and it oversees management to ensure that the processes designed, implemented, and maintained with respect to such risks are functioning as intended and adapted when necessary to respond to changes in our strategy, as well as emerging risks. Given the importance of information security and cybersecurity to our stakeholders, our Audit Committee reviews quarterly reports from our CISO regarding the Company's cybersecurity strategies for mitigating known risks, any newly identified risks, existing projects, and key performance insights and engages in discussions with management based on such reports and other recent developments.


text: We have a thorough process for identifying, assessing, and managing cybersecurity risks within our broader risk management framework. We gather insights from external experts and internal threat intelligence teams for our cybersecurity risk management program. A dedicated team oversees cybersecurity risk management, led by professionals with deep expertise, including our Vice President, Cybersecurity and Information Security Officer. Our executive leadership, supported by our cybersecurity team, oversees our enterprise risk management and regularly considers cybersecurity and other material risks.

companyName: BIOLIFE SOLUTIONS INC

ticker: BLFS


text: Within our cybersecurity risk management system, our incident management team tracks and logs privacy and security incidents across the Company and third-party service providers. Significant incidents undergo review by a cross-functional group, with immediate escalation for potentially material incidents. We consult with outside counsel as needed, with final decisions made by senior management.


text: The Audit Committee oversees cybersecurity risks and incidents, ensuring compliance with disclosure requirements and cooperation with law enforcement. Senior management regularly updates the committee on cyber risks and any material incidents.


text: While our business strategy and financial condition have not been materially affected by cybersecurity risks, we cannot guarantee future immunity. For more details, refer to Item 1A Risk Factors in our Annual Report on Form 10-K.


text: The secure processing, maintenance and transmission of sensitive data, including confidential and other proprietary information about our business and our employees, customers, suppliers and business partners, is important to our operations and business strategy. As a result, cybersecurity, data classification and data protection are key components of our long-term strategy.

companyName: QXO, Inc.

ticker: QXO


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risk s. Members of the Board regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: American Strategic Investment Co.

ticker: NYC


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from cybersecurity incidents in a timely manner. Our security operations team ("SOT"), which is comprised of internal security professionals and reports to the Chief Information Officer ("CIO"), has first line responsibility for our cybersecurity risk management processes as they relate to day-to-day operations. Our audit and compliance team ("ACT"), which is comprised of a team lead and the CIO, has second line responsibility and works in partnership with our executive leadership team ("ELT") and other internal teams to coordinate efforts, priorities and oversight. Our ACT assesses cybersecurity threats and risks based on probability and potential impact to key business systems and processes. Threats and risks that can cause major damage or service impact that the ACT considers high are incorporated into our overall risk management program. The ACT develops a mitigation plan for each identified high threat and risk and reports its progress with respect to mitigation of such threats and risks to the Technology Risk Management Committee, which is part of our ELT and consists of both management-level employees and members of the Board; such high-level cybersecurity threats and risks are tracked as part of our overall risk management program.


text: We collaborate with third parties to assess the effectiveness of our cybersecurity incident prevention and response systems and processes as our SOT deems necessary or appropriate. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity threats and risks, as well as to support associated mitigation plans when necessary. Our System and Organization Controls (SOC) Type 2 audit, completed in September 2024, attests to the effectiveness of our security and risk management controls. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities critical to our ongoing business operations, including those that perform cybersecurity services.


text: We sponsor a multi-faceted security awareness program that includes regular, mandatory trainings for our personnel on data protection and malware detection, policy and process awareness, periodic phishing simulations and other kinds of preparedness testing including disaster recovery exercises.


text: We maintain a cross-functional cybersecurity incident response plan with defined roles, responsibilities and reporting protocols. This plan, which we evaluate and test on a regular basis, focuses on responding to and recovering from any significant cybersecurity incident as well as mitigating any impact from such incidents on our business. Generally, when a cybersecurity incident or suspected cybersecurity incident is identified, the SOT would escalate the issue to the ACT for initial analysis and guidance. In the event of a significant cybersecurity incident, the ELT would typically be tasked with preparing an initial response. The ELT, with support from the ACT, would be responsible for determining whether a particular cybersecurity incident (alone or in combination with other factors) triggers any reporting or notification responsibilities under applicable law or regulation or pursuant to any contractual obligation.


text: The ACT, in consultation with the ELT and other members of senior management, updates its strategy at least annually to account for changes in our business strategy, legal and regulatory developments across our geographic footprint and further developments in the cybersecurity threat landscape. In addition, we periodically engage a third-party provider to conduct an external assessment of our cybersecurity program. The results of this assessment, which are reported to the Board, assist us in determining whether any further changes to our existing policies and practices are warranted.


text: As indicated above, we engage third-party providers to assist us with our cybersecurity risk management and strategy. Some of these providers provide us with ongoing assistance (such as threat monitoring, mitigation strategies, updates on emerging trends and developments and policy guidance) while we engage others to provide targeted assistance (such as security and forensic expertise) as needed. Prior to exchanging any sensitive data or integrating with any key third-party provider, we assess their cybersecurity fitness against our risk posture and request changes as we deem necessary.


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the headings "General Risks – We could be affected by cyberattacks or beaches of our information systems, any of which could have a material adverse effect on our business" and "General Risks – A failure of our information technology infrastructure, information systems, networks or processes may materially adversely affect our business" in this Annual Report.


text: Our CISO leads our cybersecurity team and is generally responsible for management of cybersecurity risk and the protection and defense of our networks and systems. Our CISO has 30 years of experience serving in various roles related to cybersecurity and information security. The SSC, chaired by our CISO, is comprised of executive level representatives from our IT, legal, enterprise risk management and internal audit teams and is responsible for oversight, evaluation and coordination of activities related to safeguards, security risk, controls, remediation activities, policy governance and other related security program activities.

companyName: Dine Brands Global, Inc.

ticker: DIN


text: Cybersecurity Risk Management and Strategy We are a global bioscience company dedicated to healthy aging. In the ordinary course of our business, we may collect, process, store and transmit proprietary, confidential and sensitive information, including personal information (including health information), intellectual property, trade secrets, and proprietary business information owned or controlled by ourselves or other parties. We use our data centers and our networks, and those of third parties, to store and access our proprietary business and other sensitive information. We rely upon third parties service providers and technologies to operate critical business systems to process confidential and personal information in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, employee email, and other functions. We have established cybersecurity risk management policies and procedures aimed at safeguarding the confidentiality, integrity, and availability of our critical systems and information, including those involving third-party service providers. Further, we are actively working to enhance our policies and procedures into a more comprehensive cybersecurity risk management program, our current measures are designed to address cybersecurity risks effectively. Our cybersecurity risk management policies and procedures include the Incident Management Plan.

companyName: Niagen Bioscience, Inc.

ticker: NAGE


text: We design and assess our policies and procedures based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF framework). This does not imply that we follow or meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. For example, we periodically perform independent third-party security audits and assess potential risks.


text: Our cybersecurity risk management policies and procedures are integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: –risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: –a security team, led by our Vice President of IT (VP of IT), principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) responses to cybersecurity incidents;


text: –the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and designed to anticipate cyber-attacks and prevent breaches; –cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: –a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and –a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function. In connection with the Audit Committee's oversight of the Company's risk management, the Audit Committee reviews with management, as appropriate, the Company's cybersecurity risk exposure and the steps management has taken to monitor or mitigate such exposure, including reviewing risk assessments from management with respect to our information technology systems and procedures, and overseeing our cybersecurity risk management processes. In addition, management will update the Audit Committee and the full Board, as necessary, regarding cybersecurity incidents that we may experience.


text: Our management team, including our VP of IT, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management policies and procedures and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's cybersecurity risk management is led by our VP of IT, who has experience across technology-enabled growth, information security, infrastructure, operations and compliance.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy The secure collection, maintenance, processing and transmission of confidential and sensitive information, including personal data, is a critical element of our operations. We rely on encryption and authentication technology licensed from third parties in an effort to securely transmit certain confidential and sensitive information, including credit card numbers. Our information technology and other systems, and those of our third-party service providers, that collect, maintain, process and transmit customer, employee, service provider and business partner information are susceptible to increasing threats of continually evolving cybersecurity risks.


text: Third-party supply risk is managed by functional teams for the Group. Our third-party risk management process ensures that we evaluate relevant third-party cybersecurity controls through a cybersecurity questionnaire. Risks are identified and assessed, and we include security addendums to our contracts where applicable. We have worked to develop and further implement our supplier-risk framework to help us to manage our suppliers more holistically across the lifecycle. In addition, we have an external third-party threat intelligence service that monitors the dark web and other intelligence sources to provide real-time threat information to the Group and for selected critical suppliers. This information is a proactive position on cyber threats. The intelligence is acted upon and disseminated to the relevant functional teams for action and information.

stage1Category: Third-Party Risk


text: We have an established cyber risk appetite, framework and policies to support risk-based decisions on where and how to allocate security resources. The management of cybersecurity related risks is integrated into our overall enterprise risk management process. Risks are regularly identified, assessed, monitored and reported on to ensure that we are able to allocate security resources appropriately. Risks get reported at divisional, executive and Board risk committees.


text: We are regularly audited by various internal and external bodies that validate compliance with regulatory requirements and industry standards. We perform periodical internal assessments of the design and operating effectiveness of our cybersecurity controls, including penetration testing. Dedicated cyber teams in each division and at the Group level perform assurance activities against the Flutter cyber risk and control framework. A dedicated, independent IT internal audit team performs several audits each year on a risk-based approach to key and changing cyber risks. Internal audit's audit plan frequently covers cyber domains such as: patch and vulnerability, cyber threat management, security incident management, access management, network security, data loss prevention and business continuity planning. Agreed improvements are tracked through to completion.


text: We have specialist security teams available 24/7 located in key locations to respond to security incidents should they occur. We maintain cyber insurance to further reduce the consequences of certain types of incidents, and we disclose material incidents to relevant regulatory bodies. We have third-party providers who provide real-time and proactive threat and intelligence and retainer services that assist in forensics and incident support alongside retained legal counsel services.


text: As cybersecurity threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities.


text: At this time, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. That said, as discussed more fully under "Item 1A. Risk Factors," the sophistication of cyber threats continues to increase, and we cannot assure that our systems and processes will be successful, that we will be able to anticipate or detect all cyberattacks or other breaches, that we will be able to react to cyberattacks or other breaches in a timely manner or that our remediation efforts will be successful.


text: Role of Management The Group Chief Information Security Officer ("Global CISO") is responsible for the Group's cyber strategy and policies and supporting risk, assurance and reporting processes. Our Global CISO has over 20 years of extensive experience in cyber security domains and in senior leadership roles in the financial, media and government sectors. In addition, there are divisional directors of information security who are supported by over 250 cybersecurity specialists employed across Flutter to support the implementation of our cyber strategy.


text: We have established an Operational Risk and Compliance Committee ("ORCC"), which includes our Chief Financial Officer, Chief Legal Officer, Chief Operating Officer, Chief Information Officer ("CIO"), and Group directors across all functional teams. This committee, which meets monthly, oversees how risk and compliance standards are operationalized and enforced throughout the Group, including the implementation of risk mitigation activities where required. Areas that the ORCC covers, among others, include the Group's cybersecurity risk and control environment and the enterprise risks and control environment of technology and legal risks.


text: Role of the Board Our Board is primarily comprised of US nationals. The Risk and Sustainability Committee of the Board, is responsible for the review and oversight of issues related to the key technology risks facing the Company, including, but not limited to, the Company's programs, policies, practices and safeguards for information technology, data privacy and protection, cybersecurity and fraud, identification, assessment, monitoring, mitigation and the overall management of those risks, and the Company's cyberattack incident response and recovery plan. The Risk and Sustainability Committee receives standing quarterly updates from the Global CISO and CIO on, among other things, our divisional and Group-wide cyber risks, divisional progress on cyber initiatives, external insights, incident updates and post incident reviews, our cyber strategy and our views of the emerging threat landscape.


text: Network and Infrastructure Security: We employ a range of technical measures to secure our network and infrastructure, including firewalls, intrusion detection and prevention systems, and vulnerability assessments. We also use encryption to protect data both in transit and at rest.

companyName: BlueOne Card, Inc.

ticker: BCRD


text: The Fund depends on and engages various third parties and service providers, including suppliers, custodians, transfer agents, administrative agents, fund administrators and other third parties to source, make and manage its investments. Accordingly, the Fund's business is dependent on the communications and information technology ("IT") systems that it shares with the Advisers and their ultimate parent company, TIAA, which further relies upon the systems of third-party IT service providers to TIAA. TIAA has established a cybersecurity program across its enterprise, which applies to certain of its affiliates, including the Advisers and the Fund. When identifying and overseeing risks from cybersecurity threats associated with its use of third-party service providers, the Fund further relies upon the expertise of risk management, legal, information technology, and compliance personnel of TIAA. TIAA conducts onboarding and ongoing due diligence of certain of the Fund's key third-party service providers to identify and oversee risks from cybersecurity threats associated with the Fund's use of such entities.

companyName: Nuveen Churchill Private Capital Income Fund


text: Cybersecurity Program Overview TIAA has instituted an enterprise cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to TIAA and its affiliates, which applies to the Fund and the Advisers. Cyber risk management is integrated into TIAA's overall risk management program and involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Fund relies. TIAA relies on its internal subject matter experts and external experts, as needed, including, but not limited to, cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes applicable to the Advisers, the Fund and other affiliates of TIAA.


text: TIAA actively monitors the current cyber threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Fund and the Advisers in connection with their day-to-day operations. TIAA's cybersecurity leadership team are responsible for maintaining and overseeing the overall state of TIAA's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting TIAA and its affiliates, including the Fund, the Advisers and their respective third-party service providers.


text: TIAA's cybersecurity team, including its Chief Information Security Officer, is responsible for assessing and managing material risks from cybersecurity threats to the TIAA organization, including the Fund and the Advisers. TIAA's Chief Information Security Officer and cybersecurity leaders have significant expertise in in this area, including in IT and cybersecurity engineering, and have cybersecurity leadership experience in other major financial institutions.


text: Management of the Fund is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, including through the receipt of notifications from third party service providers and reliance on communications with cybersecurity, risk management, legal, IT, and/or compliance personnel of TIAA.


text: Oversight of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Fund is assessed on an ongoing basis, as well as how such risks could materially affect the Fund's business strategy, operational results, and financial condition. Cybersecurity risk remains heightened to the financial industry, including the Fund, and a failure in or breach of our systems or infrastructure, or those of a material third party or service provider, could cause disruption and adversely impact the Fund's operations. TIAA and the Advisers continue to invest in the cybersecurity program to protect against emerging threats, including threats against third parties and service providers. The Fund has not experienced any material cybersecurity incident, and the Fund is not aware of any cybersecurity risks that are reasonably likely to materially affect its business.


text: TIAA's management team periodically reports to the Fund's management on cybersecurity matters, primarily through presentations. Such reporting will include updates on TIAA's cybersecurity program as it relates to the Fund, the external cybersecurity threat environment, and TIAA's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on TIAA's preparedness, prevention, detection, responsiveness and recovery with respect to cybersecurity incidents.


text: The Board has the primary responsibility for overseeing and reviewing the guidelines and policies with respect to risk assessment and risk management, including cybersecurity. The Board receives periodic updates from the Fund's management regarding TIAA's cybersecurity program, information on current threat landscape and risks from cybersecurity threats and cybersecurity incidents impacting the Fund.


text: The Board of Directors is responsible for overseeing overall risk management for the Company. The Audit Committee receives reports from the CISO regarding the cybersecurity program. The presented topics include, but are not limited to, the status of ongoing cybersecurity initiatives, incident reports and compliance with industry standards. Members of the Board of Directors also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our Chief Technology Officer oversees our cybersecurity policies and processes and will provide periodic briefings to the Chief Executive Officer, the Audit Committee and/or the Board of Directors as needed regarding any material cybersecurity risks or activities, including any recent cybersecurity incidents and related responses.

companyName: Verde Clean Fuels, Inc.

ticker: VGAS


text: Risk Management and Strategy The primary objective of our security program is to prevent, detect and respond to security risks and threats to protect the confidentiality, integrity and availability of our information systems and our sensitive data. Our cybersecurity program approach is risk-based, using continuous threat modeling to help us identify, track and measure our progress to reduce security risk based on three pillars: • Prevention, through planning and designing solutions to implement security controls. The security functions that support prevention efforts are aligned with security architecture, strategy and risk management activities; • Detection and response activities, which enable us to discover and respond to cybersecurity events in a timely manner. When a potentially damaging or threatening cybersecurity event is detected, our security operations team, focused on delivering detection and response services, executes the appropriate cybersecurity incident response plan; and • Governance and compliance, through cross-functional engagement, good operational hygiene and consistent discipline. Ongoing stakeholder collaboration, communications and training within a well-defined policy framework aligned with industry standards is foundational for strong governance and effective compliance. As part of the policy framework, operating procedures are kept up-to-date to reflect the current state of execution and to drive investment and iterative improvements in the highest priority areas of the security program. See Governance below for additional detail.


text: Our program framework and foundation are based on common security standards and frameworks, including ISO/IEC 27001/2:2022 and NIST Cyber Resiliency Framework and Model, in alignment with PCI DSS, privacy laws and regulatory requirements.


text: Our information and cybersecurity policy, standards, strategy, roadmap and processes are aligned with industry-recognized security risk management framework and practices, including detailed tasks, plans and initiatives, which are reviewed and updated periodically, and at least annually. Our program also incorporates incident response plans and notification protocols, to assess and manage security incidents and threats, including their materiality.


text: Our cybersecurity program uses layered security defenses, cyber resiliency and automation capabilities for our security functions and operations. Our cybersecurity roadmap outlines and defines the security initiatives, projects and tasks. Security investments and projects are discussed by the Security Steering Committee ("SSC").


text: We engage with a range of third-party cybersecurity service providers, assessors and auditors to evaluate and enhance the effectiveness of our cybersecurity program. Services provided by these third parties include 24/7 security logging, network and endpoint monitoring, vulnerability scanning, penetration testing, security incident response tabletop exercises and security and compliance posture assessments. Vendor security monitoring is an important component of our cybersecurity program to ensure our vendors are securing and protecting our critical infrastructure, data, and information, integrated with our contract management process, including security addenda and vendor security risk assessments for new contracts and annual vendor security risk assessments for critical vendors.


text: Our security incident response plan provides guidelines and requirements for reasonable and consistent responses to security incidents to limit damage while preserving the confidentiality, integrity and availability of Company systems and information, and reducing recovery time and cost, including but not limited to, escalation of security incidents to appropriate team members for investigation and response and documenting the required steps for investigation and remediation taken during the security incident response. We perform an annual tabletop exercise led by third-party security experts with participation from executive management and technical internal teams.


text: Our employees and vendor partners are also trained to report any security events to the cybersecurity team, who will escalate and notify the legal team, senior executives, and Board of Directors as needed.


text: As of the date of this report, we are not aware of any actively exploited security risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: Our cybersecurity risk management program is informed by legal and regulatory requirements and considerations. Cybersecurity risks are included as an integral part of our broader Enterprise Risk Management ("ERM") program and reviewed regularly by internal stakeholders comprised of a cross-functional team to assess the risk level and strength of our mitigation strategies. Our cybersecurity risk assessment is performed regularly throughout the year, and may include: • Regular cybersecurity program, risk and incidents reporting to the Board of Directors; • Regular cybersecurity risk reporting to the Enterprise Risk Committee, which includes the Company's Chief Executive Officer, Chief Financial Officer, Senior Vice President, Legal, General Counsel & Secretary, Internal Audit, Chief Information Officer and Chief Information Security Officer ("CISO"); and • Routine Security Steering Committee meetings with members from the Company's cybersecurity, ERM, Information Technology ("IT"), internal audit and legal teams.


text: Cybersecurity Risk Management and Strategy We understand the importance of assessing, identifying, and managing risks associated with cybersecurity threats. Cybersecurity processes designed to assess, identify and manage risks from cybersecurity threats have been incorporated into our operations as a part of our overall risk assessment process.

companyName: Ocugen, Inc.

ticker: OCGN