text: The Company relies on third-party vendor solutions to support its operations; many of these vendors have access to sensitive and proprietary information. We exercise a detailed vendor due diligence evaluation during the onboarding and periodically review vendors with access to sensitive Company data. The Company requires contracts with third parties to incorporate industry and regulatory standard clauses requiring reporting to the Company of the occurrence and mitigation of cybersecurity threats and incidents as well as to maintain adequate levels of cybersecurity insurance coverage.


text: In the event of a cyber incident, the Company created and maintains a Business Contingency Program. This program provides guidance to prepare, detect, analyze, remediate and recover business operations with the least impact to the Company and its customers.

companyName: LINKBANCORP, Inc.

ticker: LNKB

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and other developing cybersecurity practices.

companyName: Strategic Storage Trust VI, Inc.

ticker: SGST


text: Cybersecurity Governance The Company has established an Information Security Committee consisting of the Chief Operations & Technology Officer, Chief Risk Officer, and department representatives across multiple functional areas of the Company to focus on cybersecurity strategic and tactical delivery, policy oversight, monitoring of key cybersecurity risk indicators, and the assessment and management of cyber risk threats. The Committee is assisted by a Virtual Chief Information Security Officer (the "vCISO") which is provided by a contracted third-party security firm. The Committee's activities support the overall protection of data and information assets of the Company in accordance with the Information Security Program, regulatory requirements and Federal Financial Institutions Examination Council guidance. The Committee submits a quarterly report, together with the minutes of its meetings, to the Enterprise Risk Management Committee of the Board of Directors.

stage1Category: Management Role

stage1Method: majority


text: The Chief Operations & Technology Officer, among other duties, is responsible for the security and integrity of infrastructure, applications and databases and coordinates security implementations, monitoring and enforcement in conjunction with the vCISO and our risk management department. Our Chief Operations & Technology Officer has over 25 years of relevant experience in information technology and information security, building and leading technical organizations of various sizes, including in the banking industry. The vCISO has 15 years of information technology and security-based experience, and holds certifications relevant to cybersecurity, including CMMC CCP (Certified Cybersecurity Maturity Model Certification Professional) and CISSP (Certified Information Systems Security Professional). During the first quarter of 2025, the Company hired an Information Security Manager who is a CISSP-certified cybersecurity professional with over 20 years of experience in information technology, security engineering, and risk management. The Information Security Manager has also been added to the Information Security Committee mentioned above.


text: The Board of Directors receives periodic training related to cybersecurity and annually reviews comprehensive risk assessments of the Company's information technology, privacy and cybersecurity programs. The Board of Directors formally approves the Company's cybersecurity policies and program annually, and more frequently if material changes are adopted. Oversight of the Company's Information Security Program has been delegated to the Enterprise Risk Management Committee of the Board of Directors. The Enterprise Risk Management Committee reviews comprehensive risk assessments of the Company's information technology, privacy, and cybersecurity programs annually and receives quarterly reports on the effectiveness and overall performance of the cybersecurity program and provides a report of the same to the full Board of Directors.

stage1Category: Board Governance


text: The Company engages external independent parties to perform independent audit engagements, as well as other assessments of the Company's information security and third-party risk management program and information systems. Material findings and recommendations arising from these assessments are reported to the Audit Committee of the Board of Directors.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our SafetySmart platform ("Information Systems and Data").

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: Our information security and engineering functions, led by our Vice President of Operational Engineering, help identify, assess and manage the Company's cybersecurity threats and risks. These teams identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our industry's risk profile using various methods including, for example manual and automated tools (including firewalls and endpoint protection); subscribing to and analyzing reports and services that identify cybersecurity threats; conducting scans of our environment; evaluating threats reported to us and coordinating with law enforcement concerning certain threats as may be appropriate; conducting threat assessments of both internal and external threats; conducting risk, threat and vulnerability assessments to identify vulnerabilities; working with third parties to conduct testing and tabletop exercises; and using external threat intelligence feeds.


text: Depending on the environment and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response and detection policy and processes; vulnerability management processes; a secure software development lifecycle policy and change management procedures; business continuity plans; penetration tests; encrypting certain data; using network security controls; segregating and maintaining access controls over certain data; asset management and tracking; training our employees; and maintaining cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified in the Company's risk register; (2) the information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and network and cellular communications providers. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including for example, conducting risk assessment of certain vendors, providing our vendors with a security questionnaire or reviewing their SOC report, reviewing the vendor's written information security program in certain circumstances, conducting audits of our vendors as may be needed, and requiring certain technical controls of our vendors through contractual obligations.

stage1Category: Third-Party Risk


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risks titled "If our information technology systems or data, or those of third parties with whom we work, are or were compromised, our solutions may be perceived as not being secure, our customers may be harmed and we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation or mass arbitration demands; fines and penalties; disruptions of our business operations; reputation harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."

stage1Category: None/Other


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of Operational Engineering. Our Vice President of Operational Engineering has over thirty years of experience in information technology and information security management and oversees our operational engineering component, which includes our information security function, IT, networking, cloud operations, and development operations teams.


text: Our Vice President of Operational Engineering is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Executive Officer, Chief Financial Officer, and the Vice President of Operational Engineering. Those members of management work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes includes members of management reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from the Chief Financial Officer concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy As part of our strategy to cease deploying capital into new opportunities in order to focus on supporting our existing ownership interests and maximizing monetization and other strategic opportunities to enable us to return value to our shareholders, we eliminated our internal management of technology and cybersecurity and outsourced this function to a third-party service provider. Our third-party service provider monitors and tests our safeguards, including through the use of automated tools and manual processes, such as vulnerability scanning, penetration tests, and assessments of our technology infrastructure, and offers training to our employees on these safeguards, including through phishing tests and other processes.

companyName: Horizon Kinetics Holding Corp

ticker: HKHC


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. The Company's Audit Committee annually reviews with management the Company's operational risk exposure and the steps management has taken to monitor and control these exposures.


text: Incident Response and Recovery Planning We have established comprehensive incident response and recovery plans and continue to evaluate the effectiveness of those plans. Our incident response and recovery plans address — and guide our response to — a cybersecurity incident.


text: The Trust does not have a board of directors, so the Trustee is responsible for oversight of the Trust’s risks from cybersecurity threats. The Trustee has dedicated personnel that are responsible for assessing and managing the Trust’s cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee’s information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. External partners are a key part of the Trustee’s cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.

companyName: SAN JUAN BASIN ROYALTY TRUST

ticker: SJT


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee’s overall risk management process. The Trustee maintains robust cybersecurity protocols, including but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third-party vendor, of the Trustee’s cyber risk management program.


text: Other, non-technical protocols include securing of documents and work areas that could contain personal, non-public information and independent verification of information changes by outside vendors.


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust’s business, financial condition, results of operations, or cash flows. See Item 1A. “Risk Factors – Cybersecurity Risks.”

stage1Category: Strategy Integration


text: We take a comprehensive approach to cybersecurity and prioritize the security and integrity of our data, including those of our customers and other stakeholders, as a top priority. Our board of directors (in particular our audit committee) and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant resources to implement and maintain security measures to meet regulatory requirements and stakeholder expectations, and we intend to continue to make appropriate investments to maintain the security and integrity of our data. There can be no guarantee that our established policies, standards, processes and practices will be properly followed in every instance or that they will be effective at mitigating all cybersecurity threats. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from cybersecurity threats, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business, results of operations, or financial condition.


text: Risk Management and Strategy Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management process and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards and best practices. Our cybersecurity program in particular focuses on the following key areas: collaboration, risk assessment, technical safeguards, incident response and recovery planning, third-party risk management, education and awareness, and governance.


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our board of directors in a timely manner.


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known security vulnerabilities, and other external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes. Our board of directors and members of management, as appropriate, are presented with any updates we make due to our risk assessment.


text: Third-Party Risk Management We have implemented processes designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in our risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual certifications of our policies as well as periodic security training to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: Our board of directors delegated to our audit committee oversight of cybersecurity and other information technology ("IT") risks. Our audit committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the audit committee as necessary regarding any significant cybersecurity incidents.


text: Our Sponsor's IT team, led by its Chief Information Officer, is responsible for assessing and managing our significant risks from cybersecurity threats and has primary responsibility for our risk management process and overall cybersecurity risk management program. This team includes in-house personnel devoted to these efforts, as well as a third-party IT firm, and they collectively have extensive knowledge of the technologies and applications we have adopted to address our cybersecurity risk.


text: In addition, our Sponsor's Chief Information Officer supports our company by staying informed about and monitoring efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management and Strategy As an externally managed company, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Operating Manager, an indirect subsidiary of Apollo. Apollo determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for us and other affiliated entities managed by Apollo, and we rely on Apollo for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Apollo Asset Backed Credit Co LLC


text: The Apollo Global Management, Inc. ("AGM") Board of Directors is involved in overseeing Apollo's risk management program, including with respect to cybersecurity, which is a critical component of Apollo's overall approach to enterprise risk management ("ERM"). Apollo's cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based, in part, on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance," the AGM Board of Directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. AGM's Chief Information Security Officer ("CISO") and the CISO of Athene, a subsidiary of AGM, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, and also receive support, as appropriate, from our executive officers and other representatives of the Operating Manager and its affiliates. • Collaborative Approach. Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by Apollo management, in consultation with our management and our Board, as applicable, in a timely manner. • Technical Safeguards. Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our Company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.


text: Cybersecurity Risk Management and Strategy We have policies, procedures, and processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats as well as secure our networks and systems. Such processes include procedural and technical safeguards, response plans, and routine review of our policies and procedures to identify risks and improve our practices. Our security incident response plan is designed to help coordinate our response to, and recovery from, any cybersecurity incidents, and includes processes to assess the severity of, escalate, contain, investigate, and remediate such incidents as well as to comply with applicable legal obligations.

companyName: Cue Biopharma, Inc.

ticker: CUE


text: Apollo engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. Apollo regularly engages third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to Apollo's risk management function, and Apollo adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to our Company and an Investment in our Shares—We may face a breach of our cyber security, which could result in exposure of confidential information and adverse consequences to our operations."


text: To our knowledge, cybersecurity threat risks have not materially affected our Company, including our business strategy, results of operations or financial condition.


text: Cybersecurity Governance The AGM Board of Directors' oversight of Apollo's cybersecurity risk management is supported by the audit committee of the AGM Board of Directors (the "AGM audit committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. The AGM Board of Directors, the AGM audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from Apollo's risk management professionals, AGM's Chief Security Officer ("CSO"), its CISO, and other members of Apollo's management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from Apollo's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM's board of directors and/or the AGM audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM Board of Directors or the AGM audit committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from Athene's CISO, at least annually.


text: The AGM CISO, in coordination with the Apollo Technology and ERM teams, works collaboratively across Apollo to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of Apollo's cybersecurity risk management program, multidisciplinary teams throughout Apollo are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the AGM audit committee or AGM Board of Directors, as appropriate.


text: AGM's CSO holds an undergraduate degree in Management Information Systems and Business Administration, which he received magna cum laude. He has over 25 years of cyber-related experience, having served in various roles in technology and cybersecurity, including as Head of IT Risk Management, Executive Director of IT & Risk Compliance, and Global IT Risk Evaluation Lead at large financial institutions and consulting firms. He was also previously AGM's CISO for nearly eight years. AGM's CISO holds a master's degree in Business Information Systems and has served in various roles in information technology and information security for over 25 years across a number of large financial institutions, including as Director, Cybersecurity and Risk.


text: As part of the risk management oversight (including oversight of cyber risks) of the Company's Board, the Board will regularly interact with, and receive reports from, management of the Company, the Operating Manager, Apollo, and other service providers. The Company's Board is expected to receive presentations and reports on cybersecurity risks from AGM's CSO or CISO, at least annually, addressing a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Apollo's peers and third parties. Additionally, Apollo and other service providers are expected to periodically report to management as it relates to the Company's cybersecurity practices.


text: Apollo's cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to the Company's management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to the Company, the Operating Manager, and evaluation of the adequacy of the Company's cybersecurity program (as coordinated through the Operating Manager and Apollo), including risk mitigation, compliance and controls.


text: As part of the ISP that is applicable to the Fund, AB also performs cyber risk assessments on the Fund's critical and material third party vendors during onboarding and periodically thereafter.

companyName: AB Private Credit Investors Corp


text: The Trust does not have a board of directors; therefore, the Trustee is responsible for oversight of the Trust’s risks from cybersecurity threats. The Trustee has dedicated personnel that are responsible for assessing and managing the Trust’s cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee’s information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. External partners are a key part of the Trustee’s cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.

companyName: HUGOTON ROYALTY TRUST

ticker: HGTXU


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee’s overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to, technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third-party vendor, of the Trustee’s cyber risk management program.


text: Other, non-technical protocols include securing of documents and work areas that could contain personal, non-public information and independent verification of information changes by outside vendors.


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust’s business, financial condition, results of operations, or cash flows. See Item 1A. Risk Factors – The Trust may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.


text: The Company's management recognizes the critical importance of monitoring for and properly addressing cybersecurity threats. Our Chief Financial Officer is the executive primarily responsible for identifying and managing risks to the Company from cybersecurity threats. With respect to the Company's information systems, we rely on third-party technology and software providers to manage the cybersecurity risk to which those systems are subject. For elements of cybersecurity risk which fall outside the purview of the third-party technololgy and software providers, our Chief Financial Officer oversees the implementation of additional controls to reduce the likelihood of a cybersecurity incident occurring as well as to reduce the impact of any such incident, should it occur. At least annually, he discusses cybersecurity risk and the Company's mitigation efforts and effectiveness of controls with the Audit Committee of the Board of Directors, which is the committee that has primary responsibility for overseeing our risk assessment and is composed solely of independent directors. The Audit Committee reviews and discusses our cybersecurity risk and reviews the tests of controls performed by consultants that perform the Company's internal audit function. The chair of the Audit Committee may, at his discretion, report to the Chairman of the Board or the full Board of Directors.

companyName: Sotherly Hotels Inc.

ticker: SOHOO


text: As of December 31, 2024, no risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, has materially affected or is reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Although we have implemented controls to protect our data and information systems and monitor our systems on an ongoing basis, such efforts may not prevent material compromises to our information systems in the future, including those that could have a material adverse effect on our business. We maintain cybersecurity insurance coverage to mitigate our financial exposure to certain incidents, and we consult with our consultants that perform the Company's internal audit function regarding opportunities and enhancements to strengthen our policies and procedures.


text: We do not retain any confidential information from our customers. While we have control over our information systems, we do not have control over the information systems of our hotel manager, Our Town, or of our franchisors. Although we set expectations for Our Town and our franchisors, we rely on them to manage the cybersecurity risk to which they are subject. Our hotel manager maintains separate cybersecurity insurance coverage to offset a portion of potential costs incurred from a security breach.


text: We currently do not have a cybersecurity incident response plan with respect to our data and information systems. We rely on our hotel manager and their cybersecurity consultants as well as our franchisors, to maintain cybersecurity incident response plans applicable to their systems and hotel-level systems they manage on our behalf.


text: For additional information about cybersecurity risk, see "Item 1A. Risk Factors - We and our hotel manager rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could harm our business."


text: In response to the complexity and evolving nature of cybersecurity threats, incidents and risks, we engage with a range of third-party experts, including cybersecurity penetration testers, data protection services, security awareness and training, and AI based security services in evaluating and supporting our risk management. Our collaboration with these third parties includes regular independent audits, threat assessments, and consultation on security enhancements. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, we evaluate the security and risk posture of third-party service providers according to the perceived level of risk and benchmarked against industry standard best practices.


text: The Audit Committee of the board of directors provides direct oversight over cybersecurity risk and provides regular updates to the board of directors regarding such oversight. The Audit Committee regularly meets with members of management responsible for data privacy, technology, and information security risks to discuss these risks, risk management activities, incident response plans, best practices, the effectiveness of our security measures, and other related matters.


text: Our Information Technology and Cyber Security Manager, who reports to our Chief Financial Officer, leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Specific cybersecurity related responsibilities of the Information Technology and Cyber Security Manager include overseeing our processes and strategies for the detection, mitigation, and remediation of cybersecurity incidents. Our Information Technology and Cyber Security Manager has over 17 years of experience in information technology and cybersecurity, enabling him to effectively oversee cybersecurity risks and threats. He helped design and implement our initial cybersecurity infrastructure.


text: In an effort to deter and detect cyber threats, we provide all employees, including any part-time employees, with a data protection, cybersecurity, and incident response and prevention training program designed to educate employees on the importance of identifying and reporting all potential data security incidents immediately. The training covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security. We also use technology-based tools to mitigate cybersecurity threats and risks and to bolster our employee-based cybersecurity programs.


text: We do not believe that there are currently any risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks. We maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, and other related breaches.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risk associated with cybersecurity threats. Our external advisor has implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such risks. Our advisor has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: New York REIT Liquidating LLC


text: This cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: As we are fully externally advised, we are reliant on our external advisor's network and risk management program. Our external advisor has elected to engage third-party managed service providers to maintain its network and to manage the monitoring, detection, mitigation, and prevention of cybersecurity threats. These service providers are responsible for managing our advisor's hosted services, all of the computer and computer-related hardware and software they use, and for managing the backup process. Our advisor's primary managed service provider supplies management with monthly updates and activity reports related to network alerts, connectivity issues and help desk tickets.


text: We are subject to risks from cybersecurity threats and incidents. As of December 31, 2024, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition. However, there can be no assurance that the Company will not be materially affected in the future. For additional information regarding risks from cybersecurity threats, refer to Item 1A, "Risk Factors", in this Annual Report on Form 10-K.


text: Investigation. Occurs when the Discovery phase establishes a likelihood that the event is an actionable security incident that warrants further research and analysis. In the Investigation phase, the priority is to swiftly complete an accurate, thorough investigation of the security incident.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: Our Board of Managers (the "Board") considers cybersecurity risk as part of its risk oversight function. In March 2024, the Board delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Audit Committee will receive periodic reports from our Chief Financial Officer on our cybersecurity risks. In addition, our Chief Financial Officer will update our Audit Committee, as necessary, regarding any significant cybersecurity incidents impacting our advisor's information systems. Our Board of Directors will also receive briefings from our Chief Financial Officer on our cybersecurity risk management program as part of our overall business risk updates.


text: Our management, represented by our Chief Financial Officer, oversees the Company's cybersecurity risk management program. Our advisor has elected to engage third-party providers to maintain its network defenses and to manage and assess cybersecurity risk management and strategy for the Company. Our advisor's third-party provider updates our Chief Financial Officer and members of our advisor's management team with any network issues on a monthly basis and makes recommendations for security upgrades as needed. Our Chief Financial Officer takes these recommendations into account in deciding which upgrades to implement. Our Chief Financial Officer will update the Audit Committee quarterly, or more frequently in the case of a significant cybersecurity incident impacting our information systems.


text: Cyber Risk Management and Strategy We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of the Adviser, AB and other third-party service providers. The Adviser manages our day-to-day operations and has implemented AB's Information Security Program ("ISP") that applies to the Fund and its operations.


text: We rely on the digital technology of AB and the Adviser to conduct our business operations and engage with our clients and business partners. The technology that AB, the Adviser, clients, and business partners rely upon becomes more complex over time as do threats to our business operations from cyber intrusions, denial of service attacks, manipulation and other cyber misconduct. Information Security is an ongoing process of exercising due care that is designed to protect corporate, client and employee information and systems from unauthorized access, destruction, disclosure, disruption and modification of use.


text: Through a combination of security, risk and compliance resources, AB implements information security through a dedicated ISP that is intended to identify, assess and manage material risks from cybersecurity threats applicable to the Fund, and which includes a focus on safeguarding information and assets from cyber threats, engaging in cyber threat monitoring and responding to actual or potential cyber incidents. Our ISP is led by AB's Chief Information Security Officer ("CISO") who actively partners with AB's Chief Compliance Officer and Chief Risk Officer and, in turn, the Fund's Adviser, Board and Chief Compliance Officer. Ultimately, we rely on AB's full enterprise risk framework, which includes the ISP, information technology, business continuity, resiliency and cybersecurity risk, in combination with a broader risk management team, including AB's Chief Security Officer.


text: AB's CISO, with assistance from internal and external resources, is responsible for implementing and providing oversight of the ISP that applies to the Fund. The ISP employs a defense-in-depth strategy: an information assurance concept in which multiple layers of security controls are distributed throughout an operating environment. The concept manages risk with diverse defensive strategies, so that if one layer of defense fails, another layer of defense will attempt to compensate. The ISP features cybersecurity policies, standards and guidelines, committee governance, training, access controls and data controls.


text: The ISP, together with related risk and compliance resources, is designed to proactively manage the risk of threat from cybersecurity incidents through (i) implementing protocols to take cybersecurity considerations into account in adopting and onboarding our technology resources, (ii) monitoring IT controls to better ensure compliance with cybersecurity and other related legal and regulatory requirements, (iii) assessing adherence by critical and material third parties we partner with to ensure that the appropriate risk management standards are met, (iv) ensuring essential business functions remain available during a business disruption, and (v) regularly developing and updating response plans to address potential IT or cyber incidents should they occur. AB's security, risk and compliance resources are designed to prioritize IT and cybersecurity risk areas, identify solutions that minimize such risks, pursue optimal outcomes and maintain compliance standards. We also rely on AB's ISP to maintain an operation security function that has a real time response capability that triages potential incidents and triggers impact mitigation protocols.


text: Additionally, we rely on AB and the Adviser to utilize third parties to conduct periodic cybersecurity assessments, including assessments impacting the Fund, and AB's internal audit function includes certain cyber risk audits as part of any overall risk audit. We rely on AB to review the recommendations and findings from those assessments and audits and implement corrective and other measures as appropriate and as may be relevant to the Fund. AB's cybersecurity processes rely predominantly on internal resources, but also include important third party resources for certain matters, including the aforementioned assessments as well as our continuous cybersecurity threat monitoring and initial incident reporting system.


text: During the reporting period, we have not had a cybersecurity incident that has materially affected, or was reasonably likely to materially affect, the Fund, including our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition, including as discussed in "Item 1A Risk factors – The failure in cyber security systems, as well as the occurrence of events unanticipated in the Fund's disaster recovery systems and management continuity planning could impair its ability to conduct business effectively," although we do not currently believe that such a result is reasonably likely.


text: Cyber Risk Governance The Board provides strategic oversight over the Fund generally and has delegated oversight on cybersecurity matters to the Fund's Audit Committee, including oversight of risks associated with cybersecurity threats. AB's CISO, the Adviser's Chief Compliance Officer and the Fund's Chief Compliance Officer periodically report to the Audit Committee, which in turn reports to the Board on the status of AB's ISP, cybersecurity risks, risk management policies and risk assessment initiatives. Such reports particularly emphasize any material risks concerning the Fund.


text: The Chief Compliance Officer of the Fund oversees the Fund's risk management function generally and relies on the Adviser's Chief Compliance Officer to assist with assessing and managing material risks from cybersecurity threats. The Adviser's Chief Compliance Officer has 13 years of experience in the financial services industry, and during such time has acquired relevant experience overseeing and actively managing cybersecurity and information security programs for financial services companies with complex information systems. The Fund's Chief Compliance Officer has been responsible for the general oversight function as Chief Compliance Officer to the Fund for 4 years and has worked in the financial services industry for 19 years, during which the Fund's Chief Compliance Officer has gained expertise in assessing and managing risk applicable to the Fund.


text: Management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, including through the receipt of notifications from service providers and reliance on communications with ISP personnel of the Adviser and AB.


companyName: AB Private Lending Fund


text: As part of the ISP that is applicable to the Fund, AB also performs cyber risk assessments on the Fund's critical and material third party vendors during onboarding and periodically thereafter.


text: During the reporting period, we have not had a cybersecurity incident that has materially affected, or was reasonably likely to materially affect, the Fund, including our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition, including as discussed in "Item 1A Risk factors – Cybersecurity" although we do not currently believe that such a result is reasonably likely.


text: We recognize the importance of securing our data and information systems and have a process for assessing, mitigating, overseeing and managing cybersecurity and related risks. This process is supported by both management and our Board of Directors.

companyName: Ascent Solar Technologies, Inc.

ticker: ASTI


text: The Chief Operations Officer ("COO"), who reports to the CEO, leads our cybersecurity function and is responsible for managing our cybersecurity risk and the protection of our networks, systems, and data. The COO uses both internal and external resources to execute this process including security tools that help prevent, identify, escalate, investigate and resolve security incidents in a timely manner and tools that help prevent unauthorized access. The Company, with the oversight of the COO, also requires all employees to complete an annual cybersecurity training course.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities. The Board of Directors receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually. Additionally, on a quarterly basis, the Audit Committee will receive updates from Management on cybersecurity.


text: Cybersecurity Risk Management and Strategy Our executive team and board of directors recognize that effective cybersecurity risk management is critical to the safety and security of our data, systems, and products and, ultimately, the long-term success of the Company. We have a comprehensive multi-layered cybersecurity risk assessment program, which covers the identification, analysis, evaluation, and management of cybersecurity risks. The program is cross-functional involving the participation and input of internal stakeholders, third-party consultants, and board oversight. The program is reviewed and updated on a semi-annual basis, or sooner if needed.


text: We engage in frequent and comprehensive monitoring of our systems, including network, systems, and application security monitoring integrated into a Security Information and Event Monitoring (SIEM) system. In addition, should a cybersecurity incident occur, our response plan is based on the NIST Special Publication 800-61 Revision 2 Computer Security Incident Handling Guide, and requires the following steps:


text: Discovery. Occurs when a potential security incident is reported. Discovery can be initiated in several ways, including by customer support, employees, business partners, as a result of IT logging and monitoring, or in response to customer or vendor correspondence. Containment is the priority in the Discovery phase.


text: Response. Occurs when a security incident is a confirmed data breach; when a security incident requires the Company to take further action to protect the organization and/or affected parties whose impacted personal information is at risk or has been compromised; or when additional administrative, physical, or technical controls are needed after a security incident. In the Response phase, the priority is to swiftly complete required notifications and other procedures according to applicable law.


text: Closure. Occurs when the Company's incident response steering committee can review the security incident and actions taken to evaluate whether proper investigation and documentation have occurred, and the matter requires no further notice or containment. Root causes and steps to prevent future incidents have been identified.


text: In the Closure phase, the priority is to confirm that all necessary containment, investigation, and response tasks have been completed.


text: Review. Occurs after the event has been resolved. The priority in this phase is to review the investigation/response process and update the above steps based on the lessons learned.


text: We also have processes in place to oversee and identify risks from cybersecurity threats associated with our use of third party service providers. We classify third parties engaged by us based on risk and impact to our business. Classification is broken into tiers as follows:


text: Tier 1. Access to critical infrastructure, data, or services affecting critical infrastructure. Administrative or privileged access to production systems, including hosting or developing systems, applications, websites, software, or SaaS solutions. Tier 2. Non-privileged access to Company applications.


text: Tier 3. No direct system access but may be associated through a partnership or have links hosted or embedded within Company marketing material or websites.


text: Third party risk scores are weighted based on the classification tier and monitored over the course of the year. A change in risk score may trigger an audit for the third party as well as a remediation plan to address any identified gaps, which our information security team oversees in conjunction with the relevant business owner for the third party relationship.


text: While we face a variety of cybersecurity risks, such as phishing attempts, ransomware attacks, account takeovers, fraudulent orders, and unauthorized access attempts, such risks have not materially affected us to date, including our business strategy, results of operations or financial condition, and we do not believe such risks are reasonably likely to have such an effect over the long term. For more information about the cybersecurity risks we face, see "Item 1A – Risk Factors - Our reputation and business may be harmed if our or our vendors' computer network security or any of the databases containing customer, employee, or other personal information maintained by us or our third-party providers is compromised, which could materially adversely affect our results of operations."


text: Cybersecurity Governance Our board of directors has ultimate oversight of our risk management policies and strategies. Our executive leadership team, which is responsible for our day-to-day overall risk management practices, presents to the board of directors on the various material risks to our Company, including risks related to information technology and cybersecurity.


text: The audit committee has formal oversight responsibility for cybersecurity, as delegated by our board of directors, and is responsible for reviewing our policies and procedures with respect to cybersecurity risk assessment and risk management. As part of the board of directors and audit committee's oversight, our Chief Technology Officer ("CTO"), and/or Chief Information Security Officer ("CISO") provide semi-annual updates to the audit committee with respect to cybersecurity incidents, mitigation, threats, risks, and management, which are also communicated to the full board. In addition, a cross-functional committee comprised of key stakeholders throughout the Company meets regularly to review cybersecurity incidents, mitigation, threats, risks, and management.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Information Technology and Facilities Director (the "ITFD"). Our ITFD is a third-party consultant, from whom we have a dedicated resource who specializes in the industry and has over 25 years of experience addressing cybersecurity risks. Our ITFD is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incident s, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. Our CFO oversees the ITFD and briefs our Board on cybersecurity matters, including the nature and design of our cybersecurity program, and threats, events, and program enhancements.

companyName: PLUS THERAPEUTICS, INC.

ticker: PSTV


text: Our CISO, who has extensive cybersecurity knowledge and skills gained from over 25 years of work experience at the Company and elsewhere, is responsible for developing and overseeing matters related to cybersecurity and reports directly to our CTO, who is accountable for the overall information technology and security strategy of the Company. The CISO receives reports on cybersecurity threats from several experienced information security professionals responsible for various parts of the business on an ongoing basis and, in conjunction with our enterprise risk steering committee, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CISO works closely with our legal department to oversee compliance with legal, regulatory and contractual security requirements. Our enterprise risk steering committee is comprised of key stakeholders throughout the Company and works with management and our CISO to (i) identify and review certain cybersecurity risks that we face, including the probability and impact of such risks, and (ii) identify steps needed to eliminate or mitigate such risks. In addition, we have a well-defined cybersecurity incident response plan, as described above. Finally, we have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the audit committee and the board of directors.


text: Cybersecurity Risk Management and Strategy Due to the size of our company, we have not yet developed robust policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We have implemented access controls with respect to our systems, which we monitor regularly and audit annually. Our most sensitive data is stored in offline air-gapped devices. We currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems, including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. We rely on third party providers and outsourced IT services to monitor and address cybersecurity related risks, including installing software for threat protection and malware. Such third party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our board of directors to discuss if deemed necessary or appropriate. Based on the results of our risk assessments, if deemed necessary or appropriate, we take steps to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.

companyName: ASP Isotopes Inc.

ticker: ASPI


text: We intend to work with outside counsel and third party service providers in the near term to further develop our expertise, processes and procedures with respect to cybersecurity protection and our response plan.


text: To date, we have not (to our knowledge) encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Report.


text: Our management team is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from third-party service providers. Management oversees our cybersecurity process on a day-to-day basis, including those described under the heading "Cybersecurity Risk Management and Strategy" above.


text: Our audit committee is tasked with general oversight of our risk management process, including risks from cybersecurity threats. Members of management provide periodic briefings to the audit committee of our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In furtherance thereof, the committee is responsible for monitoring and assessing strategic risk exposure. Our audit committee provides regular updates to the board of directors on such reports.


text: Cybersecurity Program We have implemented a cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of safeguards, such as: password protection; multi-factor authentication; monitoring and alerting systems for internal and external threats; and regular evaluations of our cybersecurity program.


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider. We use a number of means to assess cyber risks related to our third-party service providers, including conducting due diligence in connection with onboarding new vendors. We also seek to include appropriate security terms in our contracts, where applicable as part of our oversight of third-party providers.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats We maintain an incident response program. In the event of a cybersecurity incident, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain a Data Breach Response Policy, which includes an Incident Response Plan ("IRP") in the event of a significant cybersecurity incident. In the event of a significant cybersecurity incident, our Chief Financial Officer ("CFO") will chair an incident response team to handle the incident. Such incident response team will include members of IT, finance (if applicable), legal, communications, human resources and any affected unit or department. IT, along with a designated forensic team, will use the IRP to guide the response.


text: While the Board has overall responsibility for risk oversight, the Board delegated to the audit committee of the Board the responsibility for assisting the Board with cybersecurity disclosure matters. In its oversight role, the Board is expected to specifically consider risks that relate to the reputation of the Company and the general industry in which we operate, including with respect to privacy, information technology and cybersecurity and threats to technology infrastructure.


text: On a regular basis, the CFO reports to the Board on cybersecurity matters, including key risks, the potential impact of those exposures on the Company's business, financial results, operations and reputation and the programs and steps implemented by management to monitor and mitigate risks.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall approach to risk management. Given the nature and size of our Company, we do not have a dedicated enterprise risk function, but our executives regularly consider and evaluate risks to our Company. As part of that risk management process, members of our executive team identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity, and raise them for discussion with other executives, and where it is determined to be appropriate, issues are also raised to the Board for consideration.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected our business strategy, results of operations or financial condition or are reasonably likely to have such a material effect. While we have implemented a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information regarding risks relating to privacy and cybersecurity, see "Item 1A—Risk Factors."


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting and monitoring and detection tools to allow security researchers to assist us in identifying vulnerabilities in our environment before they are exploited by malicious threat actors. We also maintain a third-party security program to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits, and conducting threat and vulnerability assessments. Depending on the environment, we implement and maintain various processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our information system and data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program, employee training, and penetration testing.

companyName: Surrozen, Inc./DE

ticker: SRZN


text: We work with third-party service providers from time to time that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, consulting firms, threat intelligence service providers, and penetration testing firms. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Refer to Item 1A "Risk Factors" in this Annual Report on Form 10-K for additional discussion about cybersecurity-related risks.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our audit committee is responsible for the oversight of risks from cybersecurity threats. Members of our audit committee receive updates on a quarterly basis from senior management, including leaders from our Information Technology team regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are overseen by our Information Technology team. Such individuals have an average of over 20 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the audit committee on any appropriate items. The audit committee holds quarterly meetings and receives periodic reports from management, concerning our significant cybersecurity threats and risk and the processes we have implemented to address them.


text: While everyone at the Company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by the Board, the audit committee of the Board of Directors ("Audit Committee") and senior management. Our cybersecurity risk management program is integrated into our overall enterprise risk management program.

companyName: REGIONAL HEALTH PROPERTIES, INC

ticker: RHEP


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial and other trial participant data ("Information Systems and Data").

companyName: Rani Therapeutics Holdings, Inc.

ticker: RANI


text: The head of our information security team (Svai Sanford, Chief Financial Officer ("CFO")), our information security team and our legal team help identify, assess and manage our cybersecurity threats and risks. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example deploying certain automated tools, subscribing to reports and services that identify certain cybersecurity threats, conducting scans of certain threat environments, evaluating certain threats reported to us, using external intelligence feeds, and conducting vulnerability assessments in certain environments and systems to identify vulnerabilities.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response processes, disaster recovery and business continuity plans, encryption of certain data, network security controls and access controls in certain environments and systems, monitoring certain systems, physical security of certain assets, asset management, employee training, and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the information security team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example threat intelligence service providers and dark web monitoring services.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and clinical data management and processing service providers. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes a review of certain information security measures of certain vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our internal technology systems or sensitive information, or those used by our third-party collaborators, vendors, contractors or consultants, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our management, including our CFO, who oversees our information security team and has over 3 years of experience overseeing such function.


text: Our CFO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. The incident management team helps us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the board of directors for certain cybersecurity incidents. The board receives periodic reports from management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The board also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity and availability of our critical systems and information.


text: Our cybersecurity risk management program includes: • physical, technological and administrative controls intended to support our cybersecurity and data governance framework, including controls designed to protect the confidentiality, integrity and availability of our key information systems and tenant, employee and other third-party information stored on those systems, such as access controls, encryption, data handling requirements and other • cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices; • a defined procedure for timely incident detection, containment, response and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents; • cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services and broader enterprise Information Technology ("IT") environment; • a security team responsible for managing our cybersecurity risk assessment processes and security controls; • the use of external consultants or other third-party experts and service providers, where considered appropriate, to assess, test or otherwise assist with aspects of our cybersecurity controls; • annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information; and • a third-party risk management process that includes internal vetting of certain third-party vendors and service providers with whom we may share data.


text: Additionally, we engage third-party providers to augment our cybersecurity capabilities. These partnerships entail ongoing assistance for threat monitoring and mitigation, as well as targeted support for specialized security expertise.


text: As of December 31, 2024, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For an examination of cybersecurity threats that could potentially have a material impact on us, please refer to Part I, Item 1A., "Risk Factors" –"Cybersecurity incidents or other damage to the information systems and technology of us or our tenants could harm our business" in this Annual Report."


text: With oversight from the Board, the Audit Committee is primarily responsible for assisting the Board in fulfilling its ultimate oversight responsibilities relating to risk assessment and management, including relating to cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including processes and policies for determining risk tolerance, and reviews management's strategies for adequately mitigating and managing identified risks, including risks relating to cybersecurity threats.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats and for our overall cybersecurity risk management program on a day-to-day basis, and supervises both our internal cybersecurity personnel and the relationship with our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our information and cybersecurity policies, processes, and practices. We maintain a Cybersecurity Incident Response Plan that establishes an incident response team led by our Head of Information Technology and describes our response protocol for cybersecurity incidents. To help protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Assessment of cybersecurity threats is included as part of our overall risk management processes.

companyName: IO Biotech, Inc.

ticker: IOBT


text: We have engaged consultants and other third parties to assist in our assessment of risks from cybersecurity threats and to evaluate our cybersecurity prevention and response systems and processes. At times, we may engage third parties to assist in the management and mitigation of a particular threat.


text: We are requiring each of our significant third-party service providers to agree that it will implement and maintain appropriate security measures in connection with their work with us, and promptly report any suspected breach of its security measures that may affect our company.


text: Our board of directors, as a whole and through the Audit Committee, is responsible for the oversight of risk management, including oversight of risks from cybersecurity threats, and discusses with management our major risk exposures, including from cybersecurity threats, their potential impact on us, and the steps we take to manage them.


text: Our IT personnel oversees information technology ("IT") strategy, operations, cybersecurity, compliance, and business applications. They are dedicated to accelerating and scaling our company by implementing innovative technology across the company. Additionally, they are an accomplished IT expert with over 15 years of experience driving transformative change across diverse industries, including manufacturing, financial services, and software as a service.

companyName: Velo3D, Inc.

ticker: VELO


text: Our Head of Information Technology, reporting to our Chief Financial Officer, has day-to-day responsibility for preventing, detecting, mitigating and remediating cybersecurity risks. The individual currently serving in this role has over twenty years of experience in information technology and cybersecurity. Our Head of Information Technology leads an incident response team that includes members of executive management, including members of our legal team, and is charged with assessing and managing material cybersecurity risks, and with notifying our executive management committee and disclosure committee of potential material cybersecurity incidents. Executive management provides updates on our cybersecurity risk profile to our Audit Committee on at least a quarterly basis.


text: Cybersecurity Threats As of the date of this report, we have not identified cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition. We and our third-party service providers have, however, been the target of cybersecurity threats and we expect these threats to continue. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Cybersecurity Program We have implemented a cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of safeguards, such as: password protection; multi-factor authentication; monitoring and alerting systems for internal and external threats; and regular evaluations of our cybersecurity program.

companyName: Alaunos Therapeutics, Inc.

ticker: TCRT


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider. We also seek to include appropriate security terms in our contracts, where applicable as part of our oversight of third-party providers.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats We maintain an incident response program. In the event of a cybersecurity incident, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain an Incident Response Plan, which includes an Incident Response Process in the event of a significant cybersecurity incident. In the event of a significant cybersecurity incident, our head of administration will chair an incident response team to handle the incident. Such incident response team will include members of IT, finance (if applicable), legal, communications, human resources and any affected unit or department. IT, along with a designated forensic team, will use the Incident Response Process to guide the response.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by head of administration and our managed service provider. Our head of administration has over four years of experience addressing cybersecurity risks. Our head of administration is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. Our head of administration oversees the Incident Response Plan and briefs our board of directors on cybersecurity matters, including the nature and design of our cybersecurity program, and threats, events, and program enhancements.


text: In its oversight role, our Board of Directors is expected to specifically consider risks, including with respect to privacy, information technology and cybersecurity and threats to technology infrastructure.


text: On a regular basis, the head of administration reports to our Board of Directors on cybersecurity matters, including key risks, the potential impact of those exposures on our business, financial condition, results of operations, cash flows and prospects, and the programs and steps implemented by our management team to monitor and mitigate risks.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall approach to risk management. Given our nature and size, we do not have a dedicated enterprise risk function, but our management team regularly considers and evaluates risks. As part of that risk management process, our management team identifies, assesses and evaluates risks impacting our operations, including those risks related to cybersecurity, and raise them for internal discussion, and where it is determined to be appropriate, issues are also raised to our Board of Directors for consideration.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any previous cybersecurity incidents that have materially affected our business, financial condition, results of operations, cash flows and prospects or that are reasonably likely to have such a material effect. While we have implemented a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information regarding risks relating to privacy and cybersecurity, see "Item IA—Risk Factors—Risks Related to Our Business."


text: We recognize the critical importance of maintaining the trust and confidence of all our stakeholders. Our Board is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards, processes, and practices are fully integrated into our risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Risk Management and Strategy As one of the critical elements of our overall risk management approach, our cybersecurity program is focused on the following key areas:


text: Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which receives, at a minimum, quarterly reports and presentations from our risk management function, our Information Technology department and other members of management. The Board and Audit Committee also receive prompt and timely information regarding material cybersecurity incidents as described below.


text: Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also executing controls and procedures that provide for the prompt escalation of certain material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such material incidents can be made by management in a timely manner.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans to address our response to cybersecurity incidents, and such plans are tested and reviewed on an as needed basis. Our cybersecurity program includes a dedicated security incident response team (the "SIRT") responsible for identifying, investigating, and mitigating cybersecurity threats. The SIRT follows a well-defined incident response process encompassing intake, investigation, mitigation, and recovery. This process leverages tools for threat detection and utilizes standardized protocols for containment, root cause analysis, and system restoration. By integrating security measures with a robust response process, we aim to minimize the impact of potential cyber incidents.


text: Incident Reporting and Communication: We have established protocols for reporting material cybersecurity incidents to management, stakeholders, and regulatory bodies as required. The Board is promptly informed and receives ongoing updates regarding material cybersecurity incidents as described below.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: We provide annual mandatory training for personnel regarding cybersecurity threats to equip our employees and contractors with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in an annual assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, focused on evaluating the effectiveness of our cybersecurity measures and planning.