text: Board of Directors Oversight Our board of directors established a technology committee (the "Technology Committee") to oversee the risks from cybersecurity threats. The Technology Committee is currently comprised of three independent directors and chaired by Maryann Goebel, who was awarded the CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors (NACD). Our CTO works closely with the Technology Committee to develop the meeting agenda and to prepare the relevant materials for each committee meeting. The Technology Committee typically reviews an updated version of the cybersecurity risk assessment program (described above) at each meeting. The Technology Committee receives and reviews cybersecurity incidents that are reported in accordance with the SIRP and our other procedures. The Technology Committee typically meets on a quarterly basis. The Chairperson of the Technology Committee makes a regular report to our board of directors following each meeting of the Technology Committee. Our board of directors retains ultimate responsibility for the oversight of the major risks inherent in our business, including risks from cybersecurity threats.


text: Management's Role We have established a Security and Privacy Steering Committee to provide governance, oversight and leadership in matters relating to information security and privacy within our business. The Security and Privacy Steering Committee's responsibilities include policy development, risk management, compliance with relevant laws and regulations, incident response, ongoing monitoring and improvement of information security and privacy practices. The Security and Privacy Steering Committee is chaired by the CISO and co-chaired by our Director of Compliance (who serves as our privacy officer). The membership of the Security and Privacy Steering Committee is comprised of individuals from cross-functional teams with expertise and responsibilities in information security and privacy, including representatives from our legal department, our finance department and various units within our technology department. Our CTO also currently serves as a member of the Security and Privacy Steering Committee.

companyName: Repay Holdings Corp

ticker: RPAY

secItem: Item 1C


text: Our CISO is responsible for managing any cybersecurity incidents under the SIRP and coordinating with our senior management. The SIRP includes a process under which senior leaders from our information security, legal and accounting teams will assess the impact and significance of a cybersecurity incident to determine any necessary external notifications or filings. The SIRP also contains parameters regarding the requirements and timing for notifications of certain cybersecurity incidents to our board of directors.


text: Our CISO has served in various roles in information security, information technology and engineering operations for over 25 years. Our CISO holds an undergraduate degree in electronics and communications engineering, and he has attained a professional certification in leadership from a leading graduate school. He also maintains a Certificate Information Systems Security Professional (CISSP) certification from the International Information System Security Certification Consortium (ISC2). Our CTO holds an undergraduate degree in management and information systems, and he has served in various technology roles for over 30 years. Our CTO's prior experience includes serving as the Chief Information Officer and Chief Information Security Officer of a public company and as Chief Technology Officer of a separate public company.


text: Cybersecurity Risk Management and Strategy We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Seer, Inc.

ticker: SEER

stage1Category: Risk Management Process

stage1Method: unanimous


text: We design and assess our program based on recommendations from trusted sources, such as the National Institute of Standards and Technology and the Center for Internet Security, as well as information security standards issued by the International Organization for Standardization, including ISO 27001. In 2024, our cybersecurity systems and processes achieved ISO 27001 certification. We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology (IT) environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for managing the risk inherent to engaging with external service providers, suppliers, and vendors.


text: This team is responsible for assessing potential vulnerabilities and exposures to cybersecurity threats, implementing controls and measures designed to mitigate these risks, and regularly monitoring and updating these policies, to adapt to evolving threats. If an incident arises, the Head of IT notifies our Chief Legal and Compliance Officer, and Chief Financial Officer, who will raise issues to those charged with governance, as appropriate.

companyName: TScan Therapeutics, Inc.

ticker: TCRX


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - If we, or our vendors, partners or customers, experience a significant disruption in our information technology systems or breaches of data security, our business could be adversely affected."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of the cybersecurity risk management program. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives periodic briefings from the Audit Committee on our cybersecurity risk management program.

stage1Category: Board Governance


text: The Audit Committee receives regular reports from our VP of Information Technology on our cybersecurity risks. In addition, our VP of Information Technology updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser potential impact.

stage1Method: majority


text: We have established an internal cross-functional Steering Committee and a leadership committee with the objective of overseeing the cyber security program, incidents, risks and initiatives. The Steering Committee is chaired by our VP of Information Technology and is comprised of leaders from Software Development, Research and Development and Data teams. The Steering Committee oversees the cybersecurity program relevance and effectiveness through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment. Updates from the Steering Committee are provided quarterly to an executive leadership committee, which is chaired by our VP of Information Technology and is comprised of the President and Chief Financial Officer, Chief People Officer, Chief Data Officer, Chief Operations and Product Development Officer and the SVP of Product Development.


text: The IT management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our VP of Information Technology has over 20 years of experience managing global IT operations, including strategy, information security, applications, infrastructure, support and execution.

stage1Category: Management Role


text: Cybersecurity Risk Management and Strategy We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our clients' and our data. We have a global cybersecurity and privacy program to help effectively assess, identify, and manage cybersecurity threat risks. We have developed a list of cybersecurity risks from known threats and our own history to help identify what is most meaningful and potentially impactful to the Company. The cybersecurity and privacy initiatives to address the risks are complex, strategic, and ever evolving. Threats and risks are identified from threat intelligence sources that include our vendors, industry, and government organizations. We continuously monitor and scan the cyber landscape to review evolving threats and risks that may impact us. Information from these various sources are reviewed by our cybersecurity and risk teams to evaluate risks in line with the NIST Cybersecurity Framework. Threat intelligence from other financial institutions and industry consortiums that serve financial institutions, such as the Financial Services Information Sharing and Analysis Center, provides key information on how risks are affecting our industry, with ability to preemptively mitigate emerging threats, as discussed above in Part I, Item 1A of this Form 10-K under the heading Technology and Data Security.

companyName: CRAWFORD & CO

ticker: CRD-A


text: We score cybersecurity risks based on the likelihood and impact on our operations. Such cybersecurity risks are integrated and evaluated as part of the global Enterprise Risk Management ("ERM") program, which is managed by the Senior Vice President General Counsel. The Governance Committee of the Board of Directors maintains oversight of the ERM program and the Audit Committee maintains oversight of the cybersecurity program to ensure risks to the Company are managed within our risk appetite.


text: Our ERM program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process when identifying and assessing material risks. Our ERM team collaborates with internal subject matter specialists, as necessary, to gather insights and report on the most significant risks. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to identify threats and improve our incident response plan.


text: We identify and assess cybersecurity incidents based on multiple factors including information from previous events and incidents. The Cybersecurity Incident Response Team ("CSIRT") categorizes events into four levels of severity with defined requirements to assess criticality. The CSIRT informs both our leadership as well as our SEC Cybersecurity Rules Disclosure Committee ("SCRDC"), Cybersecurity and Privacy Council and the Audit Committee of the Board on matters related to cybersecurity risks that are deemed to materially affect the Company.


text: We perform ongoing cybersecurity awareness training for our employees that reinforces our Global Information Security policies, standards and practices. In addition, employees receive periodic newsletters emphasizing awareness of new cybersecurity threats (e.g., phishing attempts, smishing, pretexting, and deep fakes created by artificial intelligence). This training is mandatory for all employees globally and is supplemented with periodic phishing tests. Additionally, we perform an annual external evaluation of our cybersecurity program using the NIST Cybersecurity Framework.


text: We regularly engage with consultants to review our cybersecurity program to help identify areas for continued focus, improvement and compliance, including review of past cybersecurity incidents in order to address known vulnerabilities. Our processes also address cybersecurity risks associated with third-party service providers, including those with access to our non-public or restricted data, including client data. Third-party risks are also included within our ERM program and are actively reported to the Audit and Governance Committees. Our Third Party Risk Management Program comprises a defined process to identify, assess, and mitigate risks by our third-party suppliers and service providers, specifically including cybersecurity and privacy risks.

stage1Category: Third-Party Risk


text: We are also in the process of simplifying our technology landscape and implementing several new cybersecurity technologies that will help improve the management of cybersecurity risks and threats. In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial (including no related penalties and settlements).


text: Cybersecurity Governance Our global cybersecurity and privacy program is managed by our Chief Technology and Information Security Officer ("CISO"), Vice-President of Global IT Security, Global Chief Privacy Officer ("CPO"), and Chief Information Officer ("CIO"). We have also established a Cybersecurity and Privacy Council, which comprises our senior management team, including our CEO. The Cybersecurity and Privacy Council meets on a quarterly basis with the CISO, CPO and CIO to keep our CFO, General Counsel and other executive leadership informed of cybersecurity activities and new risks and requirements. The objective of this council is to review, discuss, and manage cybersecurity and privacy risks and threats, prioritize risks, monitor risk mitigation progress, advise and update on the evolving legal landscape, as well as provide visibility into ongoing activities and programs.


text: The Board of Directors provides oversight and has designated primary responsibility to the Audit Committee who oversees our information security programs including cybersecurity and is actively involved in monitoring the progress of key cybersecurity initiatives. The CISO manages the cybersecurity program in collaboration with the CIO, CPO, and our business leaders. The CISO provides updates to the Audit Committee quarterly, including progress on the cybersecurity initiatives, risk trends and scores, and any cybersecurity incidents. Executive leadership and the Board of Directors are regularly informed and updated on any potentially material incidents.


text: We also created a SCRDC composed of members from cybersecurity, privacy, legal, audit, and finance teams. This committee's objective is to review and discuss the nature of cybersecurity and privacy incidents and determine impact and materiality.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CISO, CPO, CIO, and VP of Global IT Security. Our security, privacy, and IT leaders have extensive relevant work experience in various roles which includes developing cybersecurity strategy, implementing effective information and cybersecurity programs, and implementing cybersecurity and privacy solutions. These leaders have relevant degrees and certifications, including Certified Information Systems Auditor, Certified Information Systems Security Professional, Fellow of Information Privacy, and Certified Information Privacy Professional. As described above, we have experienced professionals in the key roles of the CISO, CPO, CIO, and VP of Global IT Security. The cybersecurity and privacy offices are responsible for incident reporting and management, which includes cybersecurity threats. The Incident Response team, comprising key cross-functional professionals and stakeholders globally, meets weekly and as needed to identify, respond, contain, and coordinate events where activities threaten the security, confidentiality, integrity, and availability of our information, including client information and information systems.


text: Once an event materially impacts systems or data, these cross-functional professionals and stakeholders evaluate the incident using key factors (e.g., type and scope of information impacted, systems impacted, reputational impact) and promptly inform senior leadership, the Audit Committee and the Board of Directors. Further, we may consult outside counsel or external advisors given the circumstances and situation (e.g., client, controls, location, or regulatory landscape).


text: Risk Management and Strategy Assessing, identifying, and managing cybersecurity related risks are integrated into our overall Enterprise Risk framework, of which one of the objectives is to ensure the confidentiality, integrity, and availability of our information sets through the maintenance of a comprehensive information security program. The program ensures regulatory compliance in alignment with Federal Financial Institutions Examination Council, the Sarbanes-Oxley Act of 2002, and the Gramm-Leach-Bliley Act. One of the key aspects of this program is a risk assessment that is used to identify industry and company-specific risks, measure control effectiveness, identify any gaps that need to be addressed, and linking our controls with applicable policies, standards and guidelines to ensure that responsible parties are aware of their obligations with respect to this program.

companyName: BANK OF HAWAII CORP

ticker: BOH


text: The Board's Audit Committee oversees risks relating to cybersecurity threats and the steps management takes to monitor and control such exposures. In addition to other written policies and procedures, the Company has instituted an Information Security Incident Response Plan ("IRP") which provides a framework to assist the Company in responding to actual or potential cybersecurity incidents. Our IRP includes detailed response procedures to be followed in the event of a cybersecurity incident, which outline steps to be executed from detection to assessment to notification and recovery, including internal notifications to the Audit Committee as appropriate. These incidents may consist of any actual, threatened, suspected, or reported event or occurrence that may affect the confidentiality, integrity, or availability of Company systems or data, or of any such event affecting a third party that may affect Company systems or data. T he objective of the IRP is to facilitate a timely and coordinated enterprise-level response to such incidents to mitigate impact on the Company and its employees, stockholders, customers, business partners, and other stakeholders. The Audit Committee receives regular reporting from senior officers (such as the Chief Information Security Officer and the Director of Risk Management & Insurance) on operational risk and the steps management has taken to monitor and control these risks. Such reporting includes updates on the Company's IRP, the external threat environment, and the Company's programs to address and mitigate the risks associated with the cybersecurity threat environment. The IRP and internal controls around cybersecurity are periodically evaluated by external experts and the results of those reviews are reported to the Audit Committee.

companyName: BRUKER CORP

ticker: BRKR


text: The Company has established a corporate-level global Information Security Incident Response Team ("ISIRT"), which provides a centralized, coordinated response to, and management of, cybersecurity incidents that may present significant risk to the Company's operations, valuation, brand or reputation, employees, and customer or business relationships. The Company's cybersecurity response team is comprised of multiple subject-matter experts, including information technology, cybersecurity and risk management members with a combined experience of well over 60 years. Core members of the ISIRT consist of the Vice President, Financial Operations and Project Management ("Financial Ops"); Senior Vice President, General Counsel, and Corporate Secretary ("General Counsel"); Chief Information Security Officer ("CISO") who reports to the Chief Information Officer ("CIO"); Chief Privacy Officer ("CPO"); Vice President, Corporate Treasurer ("Treasury"); Director, Risk Management & Insurance ("Risk Management"); and Cyber Security Manager ("Information Security"). If a cybersecurity incident warrants activation of the ISIRT, the Company's Financial Ops and the General Counsel will notify, as appropriate, the Company's executive leadership and the Audit Committee. We also engage specialized third-party consultants to proactively support our cybersecurity efforts, which include but are not limited to, application and network security, information risk management, as well as business continuity and disaster recovery.


text: Cybersecurity incidents may occur at, or be reported to, any of the Company's facilities worldwide. The Company has an IT Service Desk which acts as the single point of contact for cybersecurity incident reporting. Employees can notify the IT Service Desk of any event that they observe or is reported to them that may constitute a cybersecurity incident. Once notified, the IT Service Desk team conducts an initial classification and escalates, when needed, to the CISO and other members of ISIRT as per the Company's IRP. Financial Ops, in consultation with the General Counsel, CPO and CISO, decide whether to activate the ISIRT in connection with any escalated incident. When activated, the ISIRT coordinates and directs all aspects of the response, including, as applicable, investigation, containment, business continuity and recovery, remediation, notifications, communications, and post-incident activities with executive leadership, including the CIO, and the Audit Committee and/or Board of Directors, as appropriate in the circumstances. As of December 31, 2024, no identified risk has required activation of the ISIRT.


text: In addition, our third-party service providers play a role in our risk management and strategy as well as with the investigation of cybersecurity incidents. Based upon the assessment of the type of incident and risk presented, the ISIRT engages outside counsel and/or external resources, such as forensic consultants, to conduct or assist with cybersecurity investigations in order to provide advice to the Company. The vendors we engage with are globally recognized companies with expertise in cybersecurity. We conduct due diligence before onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards. The Company also conducts appropriate cybersecurity exercises and training. For example, employees must complete cybersecurity training on at least an annual basis, which educates our employees on the Company's policies and procedures for handling personal data, incident reporting, and avoiding common cybersecurity threats such as phishing attacks.


text: For a discussion of information technology rights that may materially impact us, see Item 1A "Risk Factors—We rely on information technology to support our operations and reporting environments. A security failure of that technology, including with respect to cybersecurity, could impact our ability to operate our businesses effectively, adversely affect our financial results, damage our reputation and expose us to potential liability or litigation."


text: Cybersecurity risk management and strategy Our cybersecurity risk management strategy and processes, which are integrated into our overall risk management process, for assessing, identifying and managing material risks from cybersecurity threats are designed based on established frameworks and standards developed by the National Institute of Standards and Technology ("NIST"). Although this does not mean that we currently meet all technical standards, specifications, or requirements, we use this framework, complemented by insights from internal assessments, to guide the development of policies governing the use of our information assets, access to intellectual property, and the safeguarding of personal information.

companyName: AST SpaceMobile, Inc.

ticker: ASTS


text: We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity defense strategy based on prevention, detection and containment. We employ industry standard measures directly or indirectly related to cybersecurity, such as multifactor authentication, endpoint protection defenses, antivirus protection, encryption standards, restricting access based on business necessity, and remote access monitoring. Our employees undergo regular cybersecurity awareness training, receive guidance on protecting confidential information, and participate in simulated phishing exercises. The training provides employees with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. We engage third parties to conduct penetration testing and evaluate our adherence to industry-standard frameworks. We assess the security framework employed by our third party service providers including their reports on security, availability and confidentiality to assess and identify material risks from cybersecurity threats associated with our use of third party applications. We have also established liaison programs with the Federal Bureau of Investigation ("FBI") and U.S. Cybersecurity & Infrastructure Security Agency ("CISA") to monitor, identify, and counter advanced persistent threats specific to our company and industry. As part of this program, we have an FBI Special Agent assigned as our Liaison Officer who provides us with periodic cybersecurity threat briefings, and also provides counter-threat support on request.


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected or are reasonably likely to materially affect our business strategy, financial condition or results of operations. For further details on cybersecurity risks, please refer to the Risk Factors discussion in Item 1A of this Annual Report, including the discussion under the heading "Cyberattacks impacting our networks or systems may have a material effect on our operations."

stage1Category: Strategy Integration


text: Governance of cybersecurity risk management Our Board of Directors, acting through the Audit Committee, is responsible for overseeing management's implementation and execution of the risk management process, including our cybersecurity risk management strategy and processes. Our Audit Committee reviews and deliberates on our risk assessment and risk management practices, including cybersecurity risks, in collaboration with management.


text: Management bears the responsibility for the day-to-day assessment and management of cybersecurity risks. We have formed a Cyber Security Incident Response Team ("CSIRT") to manage and govern the response to any real or suspected cybersecurity incidents. The CSIRT core team, consisting of the information technology team with substantial relevant experience in designing and managing our information technology infrastructure and system, classifies detected cybersecurity incidents into one of three categories based on potential impact to the functionality of the affected systems, possible or known information involved and recoverability effort. The classification of cybersecurity incidents is designed to allow rapid prioritization, response and escalation. The CSIRT core team engages with third party experts and cross-functional CSIRT members, as required, to manage the cybersecurity incidents. Cybersecurity incidents that are potentially significant or could result in a material impact are reported to the CSIRT Executive team, consisting of designated executives of the Company. The CSIRT Executive team is responsible for the oversight of the cybersecurity incidents and related critical decisions, performing a materiality assessment, overseeing the public disclosure of material cybersecurity matters, engaging law enforcement agencies, including our local FBI Liaison Officer, correspondence with the media, and communicating with our Audit Committee and Board of Directors, as appropriate.


text: As trusted partners to healthcare providers, patients, biopharmaceutical companies, academic and non-profit institutions, business partners and employees, we appreciate the importance of maintaining a comprehensive and trustworthy information security program. Our information security program is fully integrated into our operations, and a hallmark of our program is its cross-functional approach with our internal privacy objectives and stakeholders.

companyName: Adaptive Biotechnologies Corp

ticker: ADPT


text: Our cybersecurity program is based on the ISO 27001 security controls set, and in particular, it focuses on the principles of confidentiality, integrity and availability. We maintain an ISO 27001 certification with a fully integrated set of operational policies and procedures to adhere to the domains of ISO 27001. This includes but is not limited to the organization of information security to assign roles and responsibilities within Adaptive, access control to restrict employees' access to view only that information that is relevant to their roles, information security incident management, and compliance to broadly ensure alignment with applicable laws and regulations. We perform an annual risk assessment conducted by an outside assessor and conduct vendor risk assessments for third party vendors to evaluate how their systems may impact our business in the event of a cybersecurity incident. We also provide annual, mandatory cybersecurity training for employees to equip our workforce with the knowledge to identify and respond to cybersecurity threats, such as phishing attempts.


text: The internal body with executive oversight of our cybersecurity program is our Privacy and Information Security Steering Committee ("PISSC"), which applies a multidisciplinary framework to cybersecurity risks and risk assessment by integrating information security, privacy and human resources expertise, oversight and reporting. The PISSC is made up of our Privacy Officer, Chief Operations Officer (who is also acting as head of our security team), Chief Financial Officer, General Counsel and Chief People Officer and meets on a quarterly basis. Julie Rubinstein, who serves as our Chief Operations Officer, is leading our security team on an interim basis and is supported by a fractional chief information security officer.


text: Cyber Risk Management and Strategy We have developed, implemented, and continue to maintain processes and procedures to identify and mitigate cybersecurity risks across our company (including our offices in Europe). Because we rely on various information technology systems and software programs to operate our business, we have an extensive cybersecurity program designed to protect our properties and confidential data. Our cybersecurity risk management and strategy program includes the following: • implementing the latest software releases and tools (including multi-factor authentication) in a timely manner; • seek to minimize the amount of personal information collected and stored about our employees and seek to avoid any collection and storage of non-financial or contact information from our tenants/borrowers; • constant security monitoring of computers, networks, and cloud-based information assets to detect and respond to cybersecurity risks and threats; • third party internal and external vulnerability assessments and penetration testing; • annual review and audit of cyber controls and procedures; • periodic review of cybersecurity procedures and implementation of new procedures as necessary to adhere to cybersecurity standards set forth by the National Institute of Standards and Technology; • periodic evaluation and review of cybersecurity risks associated with our use of key third-party business partners, vendors, and service providers. Because we do not control the systems or cybersecurity plans put in place by such third parties, and we may have limited contractual protections with such parties, we may be negatively impacted as a result of threats or incidents experienced by such third parties; • security awareness training provided during employee onboarding process and successful completion required at least annually for all employees with passing requirements; • employee anti-phishing campaigns performed at least quarterly; • a cybersecurity incident response plan, which is reviewed annually, but generally consists of a coordinated approach to investigating, containing, documenting, and reporting findings and keeping management and others informed and involved as appropriate; and • a cybersecurity risk insurance policy.

companyName: MEDICAL PROPERTIES TRUST INC

ticker: MPT


text: We have not identified any known cybersecurity threats or incidents within the prior year that have materially affected or are reasonably likely to materially affect us, including our overall business strategy, results of operations, or financial condition. Although we have taken steps to protect the security of our information systems and the data maintained in those systems, there is no guarantee the measures and security we have implemented will be successful in detecting and preventing a cybersecurity incident. Please refer to Item 1A of this Annual Report on Form 10-K for more information regarding additional risks related to cybersecurity and information technology.


text: Cyber Governance Cybersecurity holds a pivotal role in our comprehensive risk management processes and is a key focus for both our Board and management. Our management has primary responsibility for identifying, assessing, and managing our exposure to cybersecurity threats and incidents. However, the Board, led by members of the Risk Committee, oversees the enterprise risk management process, specifically addressing material risks stemming from cybersecurity threats.


text: The Board receives regular updates from the Computer Security Incident Response Team ("CSIRT") to provide insight into significant cybersecurity risks, potential impacts on business operations, and management's strategies for identifying, monitoring, and mitigating these risks. This includes sharing results from assessments or audits of relevant processes.


text: Led by our Director of Information Technology and Security ("Director of IT") with years of experience in Information Technology, our CSIRT, comprising cross-functional professionals, collaborates to execute our cybersecurity risk assessment and management processes by reviewing and assessing cybersecurity initiatives, including the incident response plan, cybersecurity compliance, training, and overall risk management efforts. The collaborative efforts of the Board and our skilled CSIRT team underscore our commitment to effectively addressing and mitigating cybersecurity risks within the organization.


text: Innovex maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") and the Cybersecurity Framework. Innovex has an annual assessment, performed by a third party, of the Company's cyber risk management program against the NIST Cybersecurity Framework. Innovex contracts a Cyber Security Operations Center operating in three locations to provide 24/7 monitoring of its global cybersecurity environment and to coordinate the investigation and remediation of alerts. An annual incident response drill is in place to prepare support teams in the event of a significant incident. Cyber partners are a key part of Innovex's cybersecurity infrastructure. Innovex partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. Innovex engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in Innovex's environment.

companyName: Innovex International, Inc.

ticker: INVX


text: Innovex's VP of IT reports to Innovex's Chief Financial Officer and is the head of the Company's cybersecurity team. The VP of IT is responsible for assessing and managing Innovex's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by Innovex. The Audit Committee of the board of directors oversees Innovex's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The IT department briefs the Audit Committee on the effectiveness of Innovex's cyber risk management program, typically on a semiannual basis. In addition, cybersecurity risks are reviewed by the Innovex board of directors, at least annually, as part of the Company's corporate risk mapping exercise. Innovex faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. Innovex has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on Innovex's business, financial condition, results of operations, or cash flows. See "Item 1A. Risk Factors—Risks Related to Technology Advancement—We are subject to cyber security risks. A cyber incident could occur and result in information theft, data corruption, operational disruption and/or financial loss" and "Item 1A. Risk Factors—Risks Related to Technology Advancement—We have experienced IT system disruptions and cyber attacks in the past, and a failure of our IT infrastructure and cyber attacks could adversely impact us in the future."


text: As a company that collects and retains large volumes of customer and employee data, including payment card numbers and other personally identifiable information, we face significant and persistent cybersecurity risks. The protection and integrity of that data is important to us, which is demonstrated by the significant efforts and investments made to implement various measures to manage the risk of a security breach or disruption.


text: The Board of Directors holds ultimate responsibility for overseeing cybersecurity and information security risks. They dedicate substantial time and attention to this critical area, leveraging the technical expertise of their members. The Board regularly reviews an Enterprise-Wide Risk Report, which includes key cybersecurity risk measures and trends across the Company. Additionally, the Board annually reviews and approves the Information Security Policy and frequently receives presentations from the Chief Information Security Officer ("CISO") on cybersecurity risks, industry trends, and best practices.


text: The Risk Management Committee, which is charged with assisting the Board of Directors in fulfilling its oversight responsibilities related to the Company's enterprise-wide risk management framework, receives an operational risk update at least quarterly that includes a review of cybersecurity and information security risk.


text: The Board of Directors is also responsible for the approval and oversight of the Information Security ("IS") Program. Our CISO, who is designated as the IS Program Coordinator, has over 15 years of relevant information technology, security and program management experience. Under the direction of the CISO, the IS Program focuses on preventing, detecting, and responding to cybersecurity incidents by ensuring the confidentiality, integrity and availability of company information. Central to incident management is the Information Security Incident Response Team, which is responsible for responding expeditiously and effectively to security incidents to minimize risks to the business, customers and consumers. In the event of an incident, we follow the detailed incident response plan, which outlines the steps to be followed from incident identification to mitigation, recovery and notification, including notifying functional areas, regulators, as well as senior leadership and the Board, as appropriate.


text: All of our employees also have a responsibility to protect the privacy of bank confidential and proprietary information. They are required to undergo periodic information security awareness training to ensure a clear understanding of their roles in protecting information assets and to create a security-minded culture.


text: We continue to strengthen the management and oversight of cybersecurity risks through new security system enhancements, policies, testing, identification and reporting. We also engage a third-party to perform penetration testing and ongoing analysis to identify potential vulnerabilities and areas for additional enhancements.


text: We depend on third-party service providers to support our business and operational activities and to help us achieve our strategic goals. However, these third parties can introduce various risks to us and our customers. To mitigate these risks, we have established a Third Party Risk Management framework. This framework equips us with the necessary tools and practices for effective oversight of third-party service providers, ensuring compliance with legal and regulatory obligations, contractual requirements, performance expectations, and our own principles and values.


text: Our vendor risk management practices are robust and include comprehensive risk assessments of suppliers, with a strong emphasis on cybersecurity. We use commercially available services to monitor our vendors, providing security scores for supplier technology services, threat intelligence, financial intelligence, and other cybersecurity-related considerations. Regular reviews are conducted to track changes in our vendors' cybersecurity risk posture, and continuous threat intelligence monitoring helps identify potential cybersecurity incidents involving third parties. We also strive to negotiate appropriate cybersecurity provisions in our vendor contracts.


text: For the 2024 period, we reported no material cybersecurity incidents affecting the confidentiality, integrity, or availability of data or systems. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For further information, see Item 1A. "Risk Factors," including the risk factor titled "An interruption or breach in security of our information systems or those related to merchants and third-party vendors, including as a result of cyber attacks, could disrupt our business, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, or result in financial losses."


text: Risk Management and Strategy We recognize that cybersecurity threats have been increasing in number and severity in the general marketplace and in our industry. In an effort to address the threat landscape, we maintain a cybersecurity risk management strategy that is designed to identify, assess, manage, and address cybersecurity threats that may have a material impact on our business. Our cybersecurity risk management strategy includes various policies and components, including cybersecurity assessments, an incident response plan, evaluation of the security practices of our key vendors, and cybersecurity awareness training for our staff.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to patients and clinical trials ("Information Systems and Data").

companyName: Cyclerion Therapeutics, Inc.

ticker: CYCN


text: We engage a third-party to conduct a cybersecurity risk assessment on an annual basis, which is informed by the National Institute of Standards and Technology, or NIST Cybersecurity Framework. We have established a process for our IT security team to track and quantify known IT security risks and our remediation efforts through a cybersecurity risk register. The IT security team meets periodically to review and update the cybersecurity risk register based on feedback across the organization and the findings contained in our NIST-informed annual cybersecurity risk assessment. The IT security team reports on findings on at least an annual basis to the executive leadership team and the board of directors.


text: We have established a process to review and assess vendors' security posture and practices prior to their onboarding. Vendors that access, store or process our data are required to respond to a cybersecurity questionnaire and provide applicable security audit reports and certifications. Our process also includes contractual requirements to maintain data protection safeguards for vendors that process data on our behalf.


text: We maintain a security awareness training program for employees, which is provided through digital microlearning assignments. We also provide additional mandatory trainings, including phishing training, throughout the year.


text: We maintain a Written Information Security Program, or WISP, that defines our organization's cybersecurity policies and procedures. This covers all aspects of cybersecurity, including but not limited to risk management, third party security assessments, security awareness training, acceptable use, endpoint security, patch management, log management, backup and recovery.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected, and we do not believe they are reasonably likely to materially affect, our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our and our third-party vendors' information systems. For more information about the cybersecurity risks we face, see the risk factor entitled "Cyber-attacks or other failures in our telecommunications or IT systems, or those of our collaborators, CROs, third-party logistics providers, distributors or other contractors or consultants, could result in information theft, data corruption and significant disruption of our business operations" in Item 1A- Risk Factors.


text: Governance of Cybersecurity Risks Our board of directors is responsible for the general oversight of cybersecurity risks and is informed of key updates to our cybersecurity processes by relevant members of our executive leadership team on at least an annual basis.


text: Our executive leadership team meets with our Head of Global Information Technology, along with other members of our IT security team as needed, to discuss cybersecurity matters, such as the emerging cybersecurity threat landscape, significant developments to our cybersecurity processes, and our cybersecurity risk assessments. Senior management is thus kept abreast of the cybersecurity posture and potential risks facing our company. Our cybersecurity incident response process is designed to proactively triage, contain, investigate, mitigate and correct all incidents at the direction of the Head of Global Information Technology. Critical incidents are assessed for materiality, and escalated to the executive leadership team for awareness, direction and approval as needed. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, as needed, to provide oversight and guidance on critical cybersecurity issues.


text: Our IT security team, led by the Head of Global Information Security, Governance and Architecture ("Head of Global ISGA"), is responsible for managing and directing the day-to-day information security strategy of the organization, including oversight of our cybersecurity tools, controls and strategies to protect organization assets, networks and data. The Head of Global ISGA reports to our Head of Global Information Technology. The Head of Global ISGA routinely reports on cybersecurity risks, projects, and initiatives to the Head of Global Information Technology, who regularly reports to executive management and the audit committee on these matters as described above.


text: The Head of Global ISGA maintains a Certified Information Systems Security Professionals, or CISSP, certification and has more than two decades of IT security management experience. The IT security team is supported by external vendors that provide managed services for network support, security operations and other IT areas as needed. Our IT security team also meets regularly with our Global Privacy Committee, which oversees our Enterprise Data Protection Program, to coordinate on cybersecurity initiatives and strategy related to protection of personal data.


text: We recognize the importance of maintaining the trust and confidence of the patients we serve, our business partners, employees and our shareholders and are committed to protecting the confidentiality, integrity and reliance of our business operations and systems. Effective data protection practices, including responsible stewardship of our intellectual property and the secure processing, storage, maintenance and transmission of critical information by us and other third parties with whom we do business is vital to our operations.

companyName: Wave Life Sciences Ltd.

ticker: WVE


text: The board of directors receives regular reports from management concerning our cybersecurity risk management program. The board also receives various summaries and/or presentations related to cybersecurity threats, risks and mitigation.


text: Our cybersecurity practices, policies, and standards are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") (NIST SP 800-53), the Center for Internet Security ("CIS"), along with adopting best practices from Control Objectives for Information and Related Technologies ("COBIT") and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents if they occur.


text: Cybersecurity Risk Management and Strategy We may face risks related to cybersecurity, such as unauthorized access, cybersecurity attacks and other security incidents, which could adversely affect our business and operations. To identify and assess material risks from cybersecurity threats, we maintain a robust cybersecurity program to ensure our systems are effective and prepared for information security risks and have integrated these processes into our overall risk management systems and processes. We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST, CIS, and COBIT, as well as by engaging experts to attempt to infiltrate our information systems. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools, services and capabilities, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling, disaster recovery and business continuity planning activities, red team testing, mandatory training for our employees, and tabletop exercises to inform our risk identification and assessment.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our vendors, CROs, suppliers and/or manufacturers who may have access to patient and employee data or our systems. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct continuously through third-party risk management tools.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: As part of the above processes, we regularly engage with consultants and other third parties, including a bi-annual review of our cybersecurity program by an independent Qualified Security Assessor.


text: In the last three fiscal years, we have no t experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches, cybersecurity threats, loss of data and other disruptions could compromise sensitive information related to our business, prevent us from accessing critical information or expose us to liability, which could adversely affect our business and our reputation," in Item 1A. Risk Factors, which disclosures are incorporated by reference herein.


text: Cybersecurity Governance Our Board is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our Board delegates to the Audit Committee oversight of certain aspects of our risk management process, including risks related to information technology, data privacy and cybersecurity.


text: At least quarterly, our Audit Committee receives an update from management of our cybersecurity threat risk management and strategy processes, including recent cybersecurity incidents and related responses, cybersecurity testing, activities of third parties, and other similar matters. Our cybersecurity risk management and strategy processes are led by our Data Security Officer, Data Privacy Officer, Chief Financial Officer and General Counsel. Such individuals have collectively over 50 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications.


text: Our Audit Committee is encouraged to regularly engage in conversations with management on cybersecurity-related news and events and discuss any updates to our cybersecurity risk management and strategy programs. Management is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. We have processes in place to ensure that our Audit Committee shall receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Risk Management and Strategy The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents.

companyName: Dave Inc./DE

ticker: DAVE


text: Our officers and our IT vendors help identify, assess and manage our cybersecurity threats and risks. We manage, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: through the use of automated tools, including but not limited to tools for monitoring, geolocation, remote wiping, threat detection, intrusion detection and prevention (including through the use of machine learning, a form of artificial intelligence), patch management, distributed denial of service (DDoS) protection and forensics; conducting (directly or through third parties) regular audits and threat assessments for internal and external threats; subscribing to reports and services that identify cybersecurity threats; analyzing reports of threats and actors; conducting vulnerability assessments to identify vulnerabilities; evaluating our and our industry's risk profile; conducting tabletop incident response exercises; and evaluating threats reported to us.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plans and procedures, disaster recovery/business continuity plans, risk assessments, implementation of security standards and certifications, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, vendor risk management program, employee training and penetration testing.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program, and members of our management team and IT consultants work together to prioritize our risk management processes, mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and report regularly to our board of directors on cybersecurity matters.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example managed cybersecurity service providers, threat intelligence service providers, dark web monitoring services, and other cybersecurity software providers.


text: We use third-party service providers to perform a variety of functions throughout our business, including but not limited to application providers, hosting companies, contract manufacturing organizations and contract research organizations. We have a vendor management program to oversee, identify and manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for vendors that may include, depending on the vendor and nature of services being performed, security questionnaires, review of the vendor's written security program, review of security assessments, audits and reports, vulnerability scans related to the vendor, security assessment calls with the vendor's security personnel, and the imposition of certain contractual obligations on the vendor, among other elements, in accordance with the processes outlined in our internal vendor selection, management, and oversight process policy and other internal guidelines. More specifically, the level of assessment may depend on the following: the nature of the services provided and the data the vendors may collect, retain, and utilize, the sensitivity of the Information Systems and Data at issue, and the identity of the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor captioned "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, regulatory investigations or actions; litigation; fines and penalties; interruptions to our commercial operations, clinical trials or other operations; harm to our reputation; loss of revenue or profits; loss of sales and other adverse consequences."

stage1Category: None/Other


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. Commencing in 2024, our Audit Committee, on behalf of the board of directors, provides oversight of our cybersecurity risk management program.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by various members of our management team and IT consultants, which includes individuals who have a diverse combination of relevant expertise, experience, education and training. Our team includes individuals with relevant experience in enterprise risk management and disclosure controls and procedures. Additionally, certain members of our team have experience managing cybersecurity programs and are specifically assigned cybersecurity oversight.


text: Certain members of our management team are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management. Our cybersecurity incident management team, and other individuals as needed, work to help us mitigate and remediate cybersecurity incidents of which we are notified. In addition, our incident response processes include a procedure for reporting certain cybersecurity incidents to the board of directors.


text: The Company's cybersecurity program and policies articulate the expectations and requirements with respect to acceptable use, risk management, data privacy, education and awareness, security incident management and reporting, identity and access management, vendor due diligence, security (with respect to physical assets, products, networks, and systems), security monitoring and vulnerability identification. The cybersecurity program and policies are operated by a dedicated cybersecurity team in conjunction with the Company's enterprise risk management program.


text: The Company's cyber risk management program is designed to identify, track, escalate, remediate, and report cybersecurity risks across the Company. These risk areas include internal, product, vendor, supply chain, and external services leveraged across the Company. The Company has a vendor management program that evaluates and oversees cybersecurity risks related to third party vendors providing services to the Company. Any identified risks are assessed, prioritized, and addressed via process, technology, and personnel improvements to help ensure ongoing mitigation and tracking.


text: The Company's cybersecurity strategy is guided by risk priorities and identified areas for improvement, which are informed by regulatory requirements and industry standards, such as the Federal Trade Commission's Safeguards Rule and the National Institute for Standards and Technology (NIST) Cybersecurity Framework, and evolving business needs. This strategy is shared with the executive leadership at least annually. The Company maintains an incident response plan, coupled with a continuous monitoring program. This plan and program include incident alerting, comprehensive incident criticality assessments, and escalation processes to support teams, senior leadership, and the Board.


text: The Company's cybersecurity team manages all facets of the security monitoring and incident program, coordinating with Company engineers and other staff, along with third parties as needed, across our operating companies. All company employees are provided cybersecurity awareness training, which includes topics on the Company's policies and procedures for reporting potential incidents. The Company's cybersecurity team evaluates emerging risks, regulations, and compliance matters and updates the policies and procedures accordingly on an ongoing basis.


text: To date, other than the 2020 Incidents, the Company has not experienced a cybersecurity threat or incident that has materially affected or that we believe is reasonably likely to materially affect the Company including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "Cyberattacks and other security breaches or disruptions suffered by us or third parties upon which we rely could have a materially adverse effect on our business, harm our reputation and expose us to public scrutiny and liability." in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: The Board oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. Pursuant to the Audit Committee Charter, the Audit Committee of the Board provides compliance oversight to the Company's risk assessment and risk management policies, including for cybersecurity, and the steps management has taken to monitor and mitigate cybersecurity exposures and risks.


text: The Company's Director of Security and Information Technology (DSIT), in coordination with the Company's Vice President of Technology, is responsible for leading the assessment and management of cybersecurity risks. The current DSIT has over 18 years of experience in information security. The DSIT reports to the Board and management on cybersecurity risk assessment, policies, incident prevention, detection, mitigation, and remediation of cybersecurity incidents on a quarterly basis or as needed.


text: Cyber Risk Management and Strategy As a part of the overall risk management system for the Company, processes are in place to assess, identify and manage material risks from cybersecurity threats. The Investment Adviser manages the Company's day-to-day operations and has implemented a cybersecurity policy that applies to the Company and its operations. With respect to cybersecurity, the Company and the Investment Adviser rely on the systems of Goldman Sachs, its third-party service providers and the Company's service providers.

companyName: Goldman Sachs Private Credit Corp.


text: Goldman Sachs' cybersecurity risk management processes are integrated into its overall risk management processes. Goldman Sachs has established an Information Security and Cybersecurity Program (the "Cybersecurity Program"), administered by Technology Risk within its Engineering organization, and overseen by its chief information security officer. This program is designed to identify, assess, document and mitigate threats, establish and evaluate compliance with information security mandates, adopt and apply our security control framework, and prevent, detect and respond to security incidents. The Cybersecurity Program is periodically reviewed and modified to respond to changing threats and conditions. A dedicated Operational Risk team, which reports to the chief risk officer of Goldman Sachs, provides oversight and challenge of the Cybersecurity Program, independent of Technology Risk, and assesses the operating effectiveness of the program against industry standard frameworks and risk appetite-approved operational risk limits and thresholds.


text: Cyber Risk Governance The Board provides strategic oversight on cybersecurity matters generally, including oversight of material risks associated with cybersecurity threats. The Board receives periodic reports and updates from Goldman Sachs which generally include the overall state of the Cybersecurity Program, the current cybersecurity threat landscape, material risks from cybersecurity threats, cybersecurity incidents, risk management policies and/or risk assessment initiatives.

companyName: Goldman Sachs Private Middle Market Credit II LLC


text: Goldman Sachs' process for managing cybersecurity risk includes the critical components of its risk management framework, as well as the following: • Training and education, to enable Goldman Sachs employees to recognize information and cybersecurity concerns and respond accordingly; • Identity and access management, including entitlement management and production access; • Application and software security, including software change management, open source software, and backup and restoration; • Infrastructure security, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems; • Mobile security, through the use of mobile applications; • Data security, including cryptography and encryption, database security, data erasure and media disposal; • Cloud computing, including governance and security of cloud applications, and software-as-a-service data; • Onboarding protocols; • Technology operations, including change management, incident management, capacity and resilience; and • Third-party risk management, including vendor management and governance, and cybersecurity and business resiliency diligence in vendor assessments.


text: In conjunction with third-party vendors and consultants, Goldman Sachs performs risk assessments to gauge the performance of the Cybersecurity Program, to estimate its risk profile and to assess compliance with relevant regulatory requirements. Goldman Sachs performs periodic assessments of control efficacy through its internal risk and control self-assessment process, as well as a variety of external technical assessments, including external penetration tests and "red team" engagements where third parties test its defenses. The results of these risk assessments, together with control performance findings, are used to establish priorities, allocate resources, and identify and improve controls. Goldman Sachs uses third parties, such as outside forensics firms, to augment its cyber incident response capabilities. Goldman Sachs and its third-party service providers have a vendor management program that documents a risk-based framework for managing third-party vendor relationships (including those of the Company). Information security risk management is built into our vendor management process, which covers vendor selection, onboarding, performance monitoring and risk management.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are evaluated. However, despite these efforts, we cannot eliminate all cybersecurity risks or provide assurance that we have not had occurrences of undetected cybersecurity incidents. During the reporting period, the Company did not identify any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


companyName: West Bay BDC LLC


text: Cyber Risk Governance The Board provides strategic oversight on cybersecurity matters generally, including oversight of material risks associated with cybersecurity threats. The Board receives periodic reports and updates from Goldman Sachs, which generally include the overall state of the Cybersecurity Program, the current cybersecurity threat landscape, material risks from cybersecurity threats, cybersecurity incidents, risk management policies and/or risk assessment initiatives.


companyName: Silver Capital Holdings LLC


companyName: Goldman Sachs Middle Market Lending Corp. II


companyName: Phillip Street Middle Market Lending Fund LLC


text: We and our third-party service providers, such as CROs, collect, process, transmit, and store sensitive data on our networks and systems, including intellectual property, proprietary or confidential business information, and a variety of personal data.

companyName: iTeos Therapeutics, Inc.


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations.


text: Our risk management team collaborates with our Chief Information Security Officer ("CISO") and our Head of Legal to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have processes to detect potential vulnerabilities and anomalies through technical safeguards and have adopted policies and procedures around internal and external notification of cybersecurity incidents.


text: Our CISO and Cybersecurity Manager implement processes around security monitoring and vulnerability testing. We also have in place an incident response plan, which incorporates four overarching and interconnected stages: (1) preparation for a cybersecurity incident, (2) detection and analysis of a security incident, (3) containment, eradication and recovery, and (4) post-incident analysis. The plan specifies that security events and data incidents should be evaluated, ranked by severity and prioritized for response and remediation. Our procedures include an evaluation of incidents to determine materiality as well as operational, business and privacy impact. Our team of cybersecurity and information security professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation and remediation strategies. In addition to implementing technical security measures, we have maintained an ongoing cybersecurity awareness and training program.


text: As part of our risk management process, we engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. In addition, we engage outside providers to conduct annual penetration testing.


text: Our board of directors has established oversight mechanisms to manage risks from cybersecurity threats. The audit committee of our board of directors (the Audit Committee"), has primary responsibility for oversight of cybersecurity and is briefed on cybersecurity risks at least once a year and following any material cybersecurity incidents. Our board of directors receives periodic updates from our Audit Committee regarding matters of cybersecurity. Our board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any significant updates to our cybersecurity risk management and initiatives.


text: Our cybersecurity program is overseen by our Head of Information Technology ("IT"), and is managed by our CISO and other leaders from our IT and legal departments. Our Head of IT, CISO and Cybersecurity Manager have an average of over 20 years of prior work experience in various roles involving IT, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to senior management and the Audit Committee on any appropriate items.


text: Our senior management reports at least annually to the Audit Committee and such reporting includes an overall assessment of the Company's compliance with our cybersecurity policies and procedures as well as topics including existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives.


text: A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive, or business harm, loss of intellectual property rights, significant costs, or the Company being subject to government investigations, litigation, fines, or damages. As of the date of this Annual Report on Form 10-K, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. For more information, see "Risk factors - Risks related to our business operations, employee matters, taxes, litigation, and managing growth - Information system failures or unauthorized or inappropriate use of or access to our information systems risk disclosure of confidential or proprietary information, including personal data, and could damage our reputation, and subject us to significant financial and legal exposure."


text: Risk Management and Strategy We recognize the importance of safeguarding the security of our computer systems, software, networks, and other technology assets. We have implemented processes for identifying, assessing, and mitigating cybersecurity risks and we have implemented a cybersecurity risk management program that is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

companyName: TScan Therapeutics, Inc.


text: Our cybersecurity risk management program incorporates a number of components, including, but not limited to, information security policies and operating procedures, periodic information security risk assessments and other vulnerability analyses, and ongoing monitoring of critical risks from cybersecurity threats using automated tools. Additionally, we have implemented a process to conduct cybersecurity awareness training for employees during onboarding and thereafter.


text: We maintain a Cybersecurity Incident Response Plan, or CIRP, which is designed to guide our response to cyber incidents, including to mitigate and contain any potential cybersecurity incidents that could affect our systems, network, or data. The CIRP identifies the individuals responsible for developing, maintaining, and following procedures related to cybersecurity incident response, including escalation protocols. We also engage external third-party consultants to provide services, such as penetration testing, which is conducted on an annual basis, along with ongoing vulnerability scans. These consultants also perform annual assessments of our cybersecurity program, which involve, among other things, review of our IT security measures and processes for alignment with the NIST Cybersecurity Framework and provision of threat intelligence regarding emerging risks to our information systems.


text: As part of our cybersecurity risk management program, we maintain processes around third-party vendor risk management, including a framework for managing third-party information security risks. This framework, which applies to select third parties who have access to our systems and/or process our information, includes processes for assessing and reviewing the cybersecurity practices of such third-parties, including a review of available security audit reporting and certifications and inclusion of security requirements in contracts, as appropriate.


text: We have not been materially affected by cybersecurity threats. We may, from time to time, experience threats to and security incidents related to our data systems but we do not believe they are reasonably likely to materially affect our business strategy, results of operations or financial condition. For more information, please see the risk factors entitled "Our internal computer systems, or those used by our third-party CROs or other contractors or consultants, may fail or suffer cybersecurity incidents, data breaches or other unauthorized or improper access, which could result in a material disruption of the development programs of our product candidates" and "Cybersecurity incidents, loss of data or modification of information, and other disruptions could compromise information related to our business or prevent us from accessing critical information, result in a significant disruption of our activities and expose us to liability, which could adversely affect our business and our reputation" in Item 1A- Risk Factors in this Annual Report on Form 10-K.


text: Our board of directors, as a whole and through its committees, is responsible for our overall enterprise risk management program, which incorporates as an element our cybersecurity risk management program. Our audit committee, a subcommittee of our board of directors, has been delegated responsibility for oversight of cybersecurity risk management, which includes reviewing our cybersecurity and other information, technology risks, controls and procedures, including our plans to mitigate and respond to cybersecurity risks. The Head of IT, alongside the Chief Legal and Compliance Officer, and Chief Financial Officer, provide quarterly reports to the audit committee covering cybersecurity and other information technology risks affecting us. These reports may include reviewing our current infrastructure and the status of key cybersecurity initiatives, including the status of ongoing mitigation efforts, providing insights into the latest cybersecurity threats, and discussing any recent security incidents impacting our peer companies. Periodically, or in the event of a critical cybersecurity incident, the Chief Legal and Compliance Officer, and Chief Financial Officer will provide our full board of directors with findings and recommendations from these reports.


text: We maintain a cybersecurity program that is reasonably designed to protect our information, and our customers' information, from cybersecurity threats against us, our third-party vendors, and services providers, that may result in a material adverse effect on the confidentiality, integrity, and availability of our information systems.

companyName: Techpoint, Inc.


text: Our Technology Team is responsible for the implementation, monitoring, and maintenance of cybersecurity and data protection practices across the Company. The Technology Team includes members who have experience in network security, server integration and data protection. In conjunction with a cross-functional team, our Technology Team regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. In addition to our internal cybersecurity capabilities, we also regularly engage consultants and other third parties to assist with assessing, identifying, and managing cybersecurity risks and to participate in tabletop and other training exercises. The Technology Team monitors and is informed about cybersecurity incidents through firewalls that are triggered in our information technology systems.


text: Board of Directors Our board of directors, in coordination with the audit committee of our board of directors, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our audit committee regularly receives reports and presentations from the Technology Team regarding cybersecurity. The Technology Team also reports to our board of directors at least annually on cybersecurity matters. We have established protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, are reported to our board of directors and/or our audit committee.


text: Risk Management and Strategy We employ a defense-in-depth approach with systems and processes designed to oversee, identify, and reduce the potential impact of a security incident against us or a third-party vendor or service provider. These include but are not limited to: multi-factor authentication, Endpoint, email, immutable backups, third party risk assessments, and other applicable controls.


text: Incident Response We have adopted a Cybersecurity Incident Response Plan (the "IRP") that applies in the event of a cybersecurity incident that provides a standardized framework for responding to cybersecurity incidents. The IRP is expected to be integrated into our overall risk management system and applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats and have materially affected or could materially affect us, including our business strategy, results of operations, or financial condition.


text: We have implemented and maintain a cybersecurity risk management program that includes processes for the identification, assessment, and mitigation of cybersecurity risks. We conduct annual cybersecurity training for all of our employees and periodically engage third-party consultants to conduct penetrating testing and vulnerability assessments. Additionally, we use automated tools designed to monitor, identify, and address cybersecurity risks. Further, we have a process to evaluate and review the cybersecurity practices of our key vendors prior to onboarding, including through a general security assessment and contractual requirements, as appropriate.

companyName: FATE THERAPEUTICS INC

ticker: FATE


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the risk factors entitled "Our business could be negatively affected by cyberattacks or a deficiency in our cybersecurity system and infrastructure" and "Our internal computer systems, or those used by our third-party research institution collaborators, CROs or other contractors or consultants, may fail or suffer security breaches" in Item 1A- Risk Factors.


text: Governance: As discussed in more detail under the heading "Governance" below, our Board of Directors' oversight of cybersecurity risk management is supported by our Senior Vice President of Information Technology, who leads our cybersecurity team, which is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and ensuring our compliance.

companyName: STORE CAPITAL LLC


text: Governance Related To Cybersecurity Risks Our cybersecurity process is overseen by our Information Technology department, which is managed by our Head of IT. The Head of IT role is currently held by an individual who has approximately two decades of professional IT management experience. In addition, our Security Leadership Team (SLT), which is comprised of the Head of IT as well as leaders from our operations, finance, and legal departments, is responsible for documenting, reviewing, and assessing our cybersecurity processes, monitoring for cybersecurity incidents, and periodically reporting on cybersecurity risks and risk management to a committee of our executive team (Executive Committee). The Executive Committee, which is led by our Chief Executive Officer, undertakes reviews of our cybersecurity program and assesses any security incident updates from the SLT on a quarterly basis.


text: The Executive Committee meets with the Audit Committee of our Board of Directors on a quarterly basis to report on and discuss material updates to our cybersecurity program. The Audit Committee provides oversight of our cybersecurity program as part of its periodic review of enterprise risk management and provides regular reports to our Board of Directors regarding our cybersecurity processes, including updates on the status of ongoing cybersecurity projects, the results of cybersecurity risk assessments, and the emerging cybersecurity threat landscape. Additionally, the Board of Directors reviews the enterprise risk management program on at least an annual basis.


text: Assessment, Identification and Management of Material Risks from Cybersecurity We rely on the cybersecurity strategy and policies implemented by Inland. Inland's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Inland's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Inland has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: Inland Real Estate Income Trust, Inc.

ticker: INRE


text: Inland's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help our sponsor and Business Manager to prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us and our Business Manager. Inland's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us and our Business Manager, is integrated into Inland's risk management program. In addition, Inland periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs, including performing penetration testing of Inland's networks, and security assessments of the effectiveness of Inland's information technology environment to identify potential vulnerabilities.


text: Inland's cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities as well as regular phishing simulations for all of the employees of the Business Manager and its affiliates. Inland undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of our Business Manager and our critical third-party vendors (including the transfer agent) and other partners.


text: Inland has established a Computer Security Incident Response Team ("Inland CSIRT"), which aims to manage and mitigate the impact of cybersecurity breach events, including those arising from or impacting our Business Manager and service providers (including the transfer agent), tenants, and other business contacts. Members of the Inland CSIRT include Inland's VP Director of IT Infrastructure & Information Security, who has more than 20 years of experience in information technology security and leads Inland's cybersecurity program, and its Head of Technology Strategy, as well as members of the firm's legal, risk, and communications groups. Inland has established a notification decision framework to determine when the Inland CSIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including members of our Business Manager's management, and our Board and Audit Committee, as appropriate.


text: Oversight of Cybersecurity Risks The board and our audit committee oversee our cybersecurity risk exposures and the steps taken by management to identify, monitor and mitigate cybersecurity risks to align our risk exposure with our strategic objectives. With respect to such cybersecurity risk oversight, our board and/or our audit committee receive periodic reports and/or updates from management on the primary cybersecurity risks facing us and the Business Manager and the measures we, and the Business Manager are taking to mitigate such risks. In addition to such reports and updates, our board and/or our audit committee receive updates from management as to changes to our and the Business Manager's cybersecurity risk profile or certain newly identified risks. In the event of an incident, we intend to follow Inland's incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel, senior leadership and the board or audit committee, as appropriate.


text: Impact of Cybersecurity Risks As of the date of this filing, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Part I, Item 1A, Risk Factors, General Risks" for more information regarding cybersecurity risks.


text: Governance and oversight of cybersecurity risks and strategies form a core component of our risk management framework. Recognizing the critical importance of cybersecurity in protecting our operations and preserving shareholder value, we have established a governance structure that emphasizes risk identification, management, and mitigation across our organization.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: Central to our governance approach is the involvement of our Audit Committee, which maintains oversight over the Company's cybersecurity strategy.