text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical systems and our proprietary, strategic or competitive data. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program and employee training. We conduct regular reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We have an incident response process that relies on a multidisciplinary team for assessing and managing cybersecurity incidents, including an escalation framework based on the materiality of incidents. The multidisciplinary team includes members of our IT security function, executive management of our legal, finance, human resources, corporate communications and internal audit/risk functions and third party service providers of technical, legal and insurance services, as well as coordination with law enforcement as appropriate. Our IT security function also addresses cybersecurity threats through regular vulnerability reviews, risk registry reviews and global team meetings.


text: Our information security processes are integrated into our overall enterprise risk management ("ERM") process and system. Our ERM process relies on designated risk managers to identify and assess material risks from cybersecurity threats. The risk managers form a multidisciplinary group including members of our IT security, finance, human resources and legal functions, operations and executive management, and are responsible for timely reporting of risks on an ongoing basis. Our ERM process includes an annual evaluation and ranking of the top risks captured in our ERM system against leading third party benchmark reports on global risks.

companyName: Gentherm Inc

ticker: THRM

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: We work with third parties from time to time that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, consulting firms, threat intelligence service providers, and penetration testing firms.


text: To operate our business, we utilize certain third-party service providers to support a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.

stage1Category: Third-Party Risk


text: Our systems periodically experience directed attacks that may be intended to lead to financial loss, interruptions and delays in our operations as well as loss, misuse or theft of personal information (of third parties, employees, and other stakeholders) and other data, confidential information or intellectual property. However, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K, including "Security breaches and other disruptions to our information technology networks and systems, including a disruption related to cybersecurity, could interfere with our operations and could compromise the confidentiality of our proprietary information or personal information", for additional discussion about cybersecurity-related risks.

stage1Category: Strategy Integration


text: The Audit Committee of the Board of Directors (the "Audit Committee") oversees the quality and effectiveness of the control and enterprise risk management processes of systemic risks, including cybersecurity, in accordance with its charter. The Audit Committee receives reports and engages in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and reasonably manage these risks, including those that may result from material cybersecurity threats. The Audit Committee also receives reports on material cybersecurity and data privacy incidents (if any), which would include plans to mitigate and respond to such incidents, and status on key information security initiatives. These discussions include the Company's enterprise risk assessment and risk management policies.

stage1Category: Board Governance


text: The Technology Committee of the Board of Directors oversees the management of risks associated with the Company's products and technologies, including cybersecurity risks related to new product technologies or significant innovations to existing product technologies, in accordance with its charter.


text: Our Vice President & Chief Information Officer (the "CIO") leads our global information security organization and reports to the Board of Directors on matters related to cybersecurity on behalf of the Company's management. Our CIO has over 20 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large industrial and technology companies.

stage1Category: Management Role

stage1Method: majority


text: Our CIO leads an internal IT Security Committee that meets regularly to oversee company-wide efforts to address cybersecurity threats, to assess the effectiveness of our information security program and to prioritize efforts to improve our security measures and planning. Our IT Security Committee includes members of our IT security function and executive management of our legal, finance and internal audit/risk, human resources and corporate communications and technology functions.


text: We place the utmost importance on information security and privacy, including protecting the personal medical, financial and insurance information of our patients and employees, and have a cybersecurity risk management program designed to assess, identify and manage material risks from cybersecurity threats. Our cybersecurity risk management program is designed to employ industry best practices across our operations and business functions, including through monitoring and assessing our threat environment; vulnerability assessments; detecting and responding to cyber attacks, cybersecurity incidents, and data breaches; cybersecurity crisis preparedness and incident response plans; and investments in cybersecurity infrastructure and technology intended to reduce cybersecurity risk. Key aspects of our cybersecurity risk management program include the following: • adoption of the National Institute of Standards and Technology, or NIST, Cybersecurity Framework to assess the maturity of our cybersecurity programs; • periodic comprehensive Cybersecurity Program Assessments conducted by an external cybersecurity consultant; • enterprise-wide security and privacy policies that are reviewed and updated annually; • information security and privacy trainings included in mandatory onboarding and annual compliance training for all personnel; • regular testing, both by internal and external resources, of information security defenses; • incident response procedures; • Third Party Cyber Risk Program to assess cybersecurity and information security risk associated with third parties that perform contracted services using information on our network; and • a Security Operations Center that is designed to continuously monitor information on our network, investigate potential cyber threats and report on information security incidents.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: We engage consulting firms and other third parties in connection with our cybersecurity risk management processes. For example, third parties are engaged from time to time to conduct evaluations of our security controls, including penetration testing and independent audits, and to advise the Board of Directors, the Audit and Compliance Committee of the Board of Directors and/or our management team regarding cybersecurity matters.


text: We have processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers. As part of these processes, we conduct cybersecurity due diligence where deemed advisable with respect to third-party service providers that will be accessing our information technology systems, including access to view or store sensitive data, prior to their engagement. Moreover, we have processes designed to oversee and identify material cybersecurity risks associated with the information systems of third-party service providers. In addition, third-party service providers that have access to our information technology systems, including access to view or store sensitive data, are contractually obligated to report cybersecurity incidents to us so that we can assess the impact of any such incident on our business.


text: The current cyber threat environment presents increased risk for all companies, particularly companies in our industry, as the volume and intensity of cybersecurity attacks on hospitals and health systems has continued to increase. We are regularly the target of cybersecurity attacks and other threats that could have a security impact, and we have experienced security incidents from time to time. In particular, on February 13, 2023, we disclosed a security breach in which a third-party vendor that provides a secure file transfer software platform utilized by our subsidiaries experienced a security breach whereby personal information of certain patients of our healthcare facilities were exposed to the attacker.

stage1Category: Incident Disclosure


text: The audit committee receives regular reports from the Chief Information Security Officer concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: Confluent, Inc.

ticker: CFLT


text: We engage third-party consultants in connection with our cybersecurity program. For example, we have engaged an independent consultant to not only perform certain testing but to also provide remediation recommendations as applicable regarding our information security program and information technology strategic plan.

companyName: Sitio Royalties Corp.


text: We do not believe that risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, despite our security measures, there is no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that materially affects us. For additional information regarding the risks to us associated with cybersecurity incidents, see "A cyber-attack or security breach could result in the compromise of our facilities, confidential data or critical data systems and give rise to potential harm to patients, remediation and other expenses, expose us to liability under HIPAA, privacy and data protection laws and regulations, consumer protection laws, common law or other theories, subject us to litigation and federal and state governmental inquiries and actions, damage our reputation, adversely impact our financial results and otherwise be disruptive to our business." included in Part I, Item 1A of this Form 10-K.


text: We maintain a cybersecurity insurance policy that provides coverage in connection with cybersecurity incidents. However, costs and damages associated with cybersecurity incidents may not be fully insured under our insurance policy, and (to the extent otherwise covered) are subject to applicable deductibles.


text: Our cybersecurity risk management processes are integrated into our overall risk management system. Our Board of Directors is responsible for the overall supervision of our risk management activities. The Board's oversight of the material risks faced by us occurs at both the full board level and at the committee level. In addition, the Audit and Compliance Committee has primary oversight responsibility regarding our information security, data security, data privacy, and other cybersecurity programs, procedures and risks. Further, the Audit and Compliance Committee and our Board of Directors receive updates at least quarterly from management, including our Chief Information Security Officer, or the CISO, covering our programs for managing cybersecurity risks, including data privacy and data protection risks. Additionally, the Audit and Compliance Committee and the Board of Directors actively participate in discussions with management and among themselves regarding cybersecurity risks.


text: Risk management is administered at a management level through a multi-disciplinary Enterprise Risk Committee comprised of members of management, including our CISO. The Enterprise Risk Committee identifies and monitors what we believe to be the key risks currently facing the organization, including cybersecurity risks. A comprehensive presentation regarding our enterprise risk management process and our key risks is presented to the full Board of Directors on an annual basis.


text: In addition, we have established a Cyber Risk Executive Steering Committee, a multi-disciplinary management-level team chaired by our CISO which is responsible for assessing and overseeing our information security and cybersecurity risk management policies, practices and priorities and for assessing and monitoring key cybersecurity risks with respect to reporting such risks within the organization.


text: At a management level, our cybersecurity risk management efforts are led by our CISO. Our current CISO was appointed as our Vice President and Chief Information Security Officer in 2021. Our current CISO has expertise in cybersecurity risk management through his more than 25 years of experience in cybersecurity, technology and data privacy roles, including his service with the Company since 2021 and his service as chief information security officer at another large organization prior to being employed by us. In addition, other individuals on our IT security team have cybersecurity experience or certifications relevant to their respective role.


text: A key component of our enterprise risk management program is our incident response plan, which provides for controls and procedures in connection with cybersecurity incidents. Under this plan, we have established a cybersecurity incident command, a multi-disciplinary management-level team led by the CISO. The plan provides that the incident response team will conduct an initial assessment in the event of a cybersecurity incident meeting certain criteria elevated for the review of senior members of the IT security team. In such event, the plan provides that the incident response team will assess whether a cybersecurity incident has the potential to materially impact the organization and whether public disclosure is required or advisable in connection therewith, and further provides that, if appropriate, any such cybersecurity incident may be further elevated for the review of senior management, the Audit and Compliance Committee and/or the Board of Directors.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, personal information, confidential information that is proprietary, strategic or competitive in nature, and customer data ("Information Systems and Data").


text: The ERM of the Board of Directors oversees risks resulting from cybersecurity threats. DIRTT's management, represented by the SVP of Technology, is responsible for identifying, assessing, and managing risks arising from cybersecurity threats. Quarterly, DIRTT's SVP of Technology reports to the ERM on the health of DIRTT's cybersecurity, incidents, and emerging threats and vulnerabilities that may impact the Company.

companyName: DIRTT ENVIRONMENTAL SOLUTIONS LTD

ticker: DRTTF


text: The Chief Information Security Officer, in coordination with the Chief Technology Officer, Chief Financial Officer, Chief Accounting Officer, certain members of the Company's legal team and certain third-party service providers ("Cybersecurity Risk Management Team"), is primarily responsible for identifying, assessing, and managing the Company's cybersecurity threats and risks. Through our Cybersecurity Risk Management Team, we identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example manual and automated tools, conducting scans of threat environment, use of external intelligence feeds, internal and third-party threat assessments and evaluating our industry's risk profile, subscribing to reports and services that identify cybersecurity threats, red/blue team testing and tabletop incident response exercises, evaluating threats reported to us, and conducting red/blue team testing and tabletop incident response exercises.


text: Depending on the particular environment and systems, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: network security controls, system monitoring, incident detection and response, incident response policy, disaster recovery and business continuity plans, vulnerability management policy, penetration testing, encryption of data, data segregation controls, employee training, physical security cyber insurance, vendor risk management program, risk assessments, implementation of security standards/certifications, access controls, dedicated cybersecurity staff, and asset management, tracking and disposal.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, security management works with senior management to prioritize our risk management processes, mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and reports to the audit committee of the board of directors, which reviews our overall risk management framework and programs.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, penetration testing firms, forensic investigators, dark web monitoring services, and professional service firms, including legal counsel.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessments for each vendor, security questionnaires, audits, and review of security reports. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Risks Related to Cybersecurity."

stage1Category: None/Other


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the Chief Information Security Officer, who oversees the Company's Trust, Security and Reliability department, and the members of the Cybersecurity Risk Management Team. Our Trust, Security and Reliability department has significant collective experience in relevant computer science and engineering disciplines and cybersecurity matters.


text: The Chief Information Security Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Chief Information Security Officer is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes and policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including senior management. Senior management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes and policies include reporting to the management disclosure committee and to the audit committee of the board of directors for certain cybersecurity incidents.


text: We have a comprehensive approach to mitigate cybersecurity risk which primarily focuses on three key elements: • People - security awareness education and readiness-testing throughout the year for employees and contractors; • Process - incorporating "cyber awareness" in our day-to-day processes which includes constant review of alerting and detection to mitigate constant cybersecurity threats, regular review of security posture and security roadmap to ensure alignment throughout the organization, physical and digital asset protection and security vulnerability remediation via preventable and detective measures; and • Technology - investing in industry aligned security technology and threat intelligence capabilities.

companyName: RANGE RESOURCES CORP

ticker: RRC


text: Cybersecurity governance is supported by our information technology department which includes certified security professionals and seasoned security analysts. This department conducts an extensive periodic review of our security initiatives to assess the current state of our program (using a cybersecurity framework) and potential evolution based on current business risks along with detection and communication of cybersecurity threats and actions to mitigate those threats. Cybersecurity incidents meeting a pre-determined minimum threshold are communicated to a separate committee comprised of officers charged with reporting responsibilities to determine overall materiality and disclosure obligations.


text: We have engaged an independent third-party operations center that is focused on, among other things, monitoring alerts, logs, behavior analytics and end devices usage. This continuous monitoring is in conjunction with periodic security assessments, constant vulnerability scanning and frequent penetration tests. We also complete an initial vendor cybersecurity review process for new cloud-based software which provides a standardized review assessment. We monitor known third-party breaches, known software vulnerabilities that may affect third-party vendors and communicate as necessary with those vendors allowing us to increase security of our technology assets and our data.


text: Our board of directors oversees our cybersecurity risk and receives a quarterly cybersecurity report and an update from management which includes additional discussions of any relevant issues related to the understanding of technology and cybersecurity risk that may be relevant at any given time. This report includes, among other things, information regarding our current security posture and on-going cybersecurity events. Cybersecurity incidents meeting a pre-determined minimum threshold are communicated to our Board.


text: The security of our information technology systems and Company data is important to our operations and reputation. Accordingly, we are committed to identifying and managing cybersecurity risks. Our Cybersecurity team performs periodic risk assessments and, on a quarterly basis, provides to our Enterprise Risk Management Committee ("ERM") information related to the Company's cybersecurity, including statistics on attempted cyber-attacks, status of employee information security training awareness, and information on any security investigations. The Cybersecurity team advises the ERM of significant global cyber events that occurred during the quarter and whether they impacted DIRTT. The Cybersecurity team regularly discusses with the ERM the Company's cybersecurity posture and whether the Company should implement additional protections and controls to assist the Company in protecting, responding to, or mitigating potential future cyber-attacks.


text: DIRTT has developed and implemented a cybersecurity risk management strategy which consists of 5 phases: Identify, Protect, Detect, Respond, and Recover. Each phase has multiple processes and technologies supporting those processes. Identification processes at DIRTT include: system asset identification, threat identification, vulnerability identification and maintaining cybersecurity policies and standards.


text: Protection processes at DIRTT include: cyber awareness training, cyber awareness assessment (each employee is assigned a cybersecurity awareness grade calculated by a best in class cybersecurity vendor), implementation of identity and access controls, perimeter and endpoint security, annual vulnerability assessments and remediation, data encryption in transit, key vendor (third parties) control effectiveness assessment, and pre-implementation of software and systems cybersecurity assessments. Detection processes at DIRTT include: automated event collection, collation, analysis, alerting and end user incident reporting. Respond processes at DIRTT include: containment, communication, investigation and analysis, and long-term mitigation planning. Recovery processes at DIRTT include: impact identification and analysis, system restoration, internal and external communications as deemed necessary.


text: DIRTT engages external assessors annually for specific controls, to assess and provide assurance on the health of DIRTT's cybersecurity posture and controls.


text: DIRTT's Senior Vice President ("SVP") of Technology, who reports to the CEO, is responsible for DIRTT's cybersecurity and has over 15 years of technology experience. The SVP of Technology is supported by dedicated Cybersecurity staff and Governance, Risk and Compliance ("GRC") staff. DIRTT's cybersecurity team leader has over 20 years of experience in cybersecurity, multiple industry standard cybersecurity certifications, and extensive offensive and defensive cybersecurity tactical skills. DIRTT's GRC lead has over 20 years of GRC experience and industry standard certifications. Cybersecurity incidents, response and remediation activities and statuses are reported directly to the SVP of Technology.


text: Cybersecurity Strategy and Risk Management We have established and maintain policies and processes for assessing, identifying, monitoring, and managing material risks arising from cybersecurity threats which form an important component of our overall risk management program. Our policies and processes underlie and support the integrity and availability of critical data and systems, and are designed to provide a framework for timely, effective responses to cybersecurity threats, such as threats associated with our services and with our use of services or technology products by our strategic vendors, contractors, or other suppliers. ACV also engages independent third parties to help us assess our internal preparedness, audit our adherence to cybersecurity standards, assist us with risk mitigation activities, such as security assessments and penetration testing, and identify areas for continued focus and improvement.

companyName: ACV Auctions Inc.

ticker: ACVA


text: Our efforts are led by ACV's Chief Information Officer ("CIO") who oversees a team of cybersecurity professionals (the "Cybersecurity Department") dedicated to identifying, assessing, escalating, responding to, and recovering from cybersecurity threats on a day-to-day basis.


text: The Cybersecurity Department works with our strategic vendors, contractors, or other suppliers that provide services or technology products to complete information security risk assessments, each consisting of a holistic review using NIST as a standard. For these suppliers, operational security details, including third-party reports on compliance frameworks (such as NIST, SOC2 Type2), are reviewed by the Cybersecurity Department for sufficiency. The Cybersecurity Department uses tools to assist in monitoring cyber activities, benign and otherwise, and creates alerts based on anomalous activities or potential vulnerabilities. ACV personnel also are required to take cybersecurity training, which is designed to prepare our personnel to look out for and report any suspicious or anomalous events they may experience.


text: While our board of directors has overall responsibility for risk oversight, our Audit Committee assists our board of directors in monitoring cybersecurity risks by receiving regular reports from our CIO, as needed, that cover information such as NIST review outcomes, and actions to address findings and vulnerabilities.


text: Our CIO has primary management responsibility for ACV's cybersecurity. He has over twenty- five years of experience working in information technology, with the last fifteen years in senior leadership and delivery roles in large, geographically spread corporate technology settings. Pursuant to our Cybersecurity Incident Response Plan ("CIRP"), which governs ACV's responses to cybersecurity events and is designed to align with industry practices, when a cybersecurity event has been identified, it is assessed by our Cybersecurity Department based on a threat detection and response analysis to determine whether the event is a cybersecurity incident. Events that do not meet the standard of incident are resolved and closed out by the Cybersecurity Department in our cybersecurity event management system.


text: If an event is identified as an incident, the CIRP provides for notification to designated members of the Cybersecurity Department and the legal compliance function who will analyze the incident for potential materiality. Any incident whose impacts are judged to be potentially material is escalated immediately to a senior management team comprised of at least our CIO, Chief Legal Officer, Chief Operations Officer, and Chief Financial Officer. Additionally, certain cybersecurity events, such as a ransomware attack, will be immediately escalated to the designated members set forth above and the CIO. If the threat is found to be credible, it is further escalated on an emergency basis to the Chief Legal Officer and Chief Financial Officer. Once a cybersecurity incident is escalated to senior management, other members of management and senior management may be engaged to oversee the assessment, response, recovery, and disclosure efforts relating to such cybersecurity event.


text: Despite our efforts, we can offer no guarantees that the cybersecurity measures we use will prevent unauthorized or malicious access to ACV systems and information. For more information regarding the risks relating to cybersecurity, see "Risk Factors—Risks Related to Information Technology and Intellectual Property—Security breaches, cyber-attacks or other similar incidents with respect to our information technology systems, or those of our third- party service providers, could result in adverse consequences, including, but not limited to, a disruption of our business operations; reputational harm; loss of revenue or profits; regulatory investigations or actions; litigation; fines and penalties. If we fail to comply with our commitments, assurances or other obligations regarding data privacy and security, our reputation may be harmed and we may be exposed to liability; loss of business; and other adverse business consequences."


text: Risk Management and Strategy The Company's processes for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall Enterprise Risk Management (ERM) process. As part of the ERM, the Company focuses on developing multi-layered, collaborative processes to identify, monitor, and manage risks from cybersecurity threats. Risks are grouped into categories that management can then assess, monitor, and prioritize based on the likelihood of an occurrence, level of impact, and mitigating factors.

companyName: Alcoa Corp

ticker: AA


text: Management regularly reviews material technology services used, the population of technology service providers, and material and/or sensitive financial and operational data, and then assesses the material risks from cybersecurity threats associated with these items. Management has developed processes, procedures, and internal controls to address materials risks focusing on application security (levels of access, passwords, etc.), system change controls, and operations processing. The design and operating effectiveness of internal controls are subject to testing annually by the Partnership's internal audit function.

companyName: Greystone Housing Impact Investors LP

ticker: GHI


text: Our various cybersecurity risk management processes apply to various functions, including but not limited to, third-party suppliers and vulnerability management. We employ processes and technologies to bring visibility to, and protect against, cybersecurity risk, to include real time monitoring of network traffic. The Company also has a comprehensive body of policies and standards for assessing, identifying, and managing material risks from cybersecurity threats, including an incident response plan, business continuity plan, crisis management plan, as well as disaster recovery mechanisms, which are tested and updated. Additionally, the Company employs staff that are specifically dedicated to raising cybersecurity awareness and training within the organization.


text: The Company engages third party assessors, consultants, and auditors to assist in assessing, identifying, and managing risk from cybersecurity threats. Third parties assist the Company by (i) providing regular penetration testing and vulnerability assessments; (ii) assessing and maintaining our formal incident response policies, including through the use of tabletop testing; and (iii) providing multiple sources of threat intelligence information that are fed directly into our technical security platforms, including ongoing network monitoring. The Company also has a comprehensive third party information security audit program in place.


text: Alcoa has implemented processes designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to a security risk assessment prior to engagement to determine if they meet defined levels of security capabilities. Our master services agreements with third party service providers generally carry a number of security requirements, including audit rights for the Company. After engagement, third party service providers are subject to regular audits in which contract owners within Information Technology Automated Solutions (ITAS) validate that any certifications a vendor had upon engagement are maintained throughout the life of the agreement.


text: We have in the past experienced attempts and incidents by external parties to penetrate our, our service providers', and our business partners' networks and systems. Such attempts and incidents to date have not had a material adverse effect on our business, financial condition, or results of operations. See Part I Item 1A of this Form 10-K for more information on risks.


text: The Alcoa Board of Directors (Board), in coordination with the Audit Committee, is responsible for the oversight of our cybersecurity risk management program. The Audit Committee and the Board receive regular updates regarding the state of the Company's cybersecurity program, cybersecurity developments, and emerging threats. The Chief Information Security Officer (CISO) and the Chief Information Officer (CIO) regularly update the Audit Committee and the Board regarding the Company's strategy to mitigate cybersecurity risks, which includes regular vulnerability assessments and employee training on cybersecurity matters. Alcoa's CISO is responsible for maintaining identified material cybersecurity risks within the Company's ERM platform. On a quarterly basis, the CISO reviews and updates risks, as well as the control procedures in place. These risks are regularly reported to the Audit Committee and Board.


text: Alcoa's CISO has twenty-five years of experience in Information Technology, carries multiple certifications in information security, and has extensive cybersecurity risk management experience in manufacturing organizations. The CISO closely collaborates with the CIO and Chief Financial Officer (CFO) in managing material risks from cybersecurity threats. Alcoa also maintains an information security steering committee, which oversees current and emerging cybersecurity risks to the Company. The steering committee is comprised of a cross-functional team of leaders from across Alcoa's business groups, including the CISO and CIO.


text: The Company has established comprehensive incident response plans that set forth the processes through which cybersecurity incidents are managed, including how management is informed of cybersecurity incidents. As part of these plans, incidents are evaluated, classified, and elevated to an executive team which includes the CISO and executives on the Crisis Response Team. Once elevated, these executives are ultimately responsible for the management, mitigation, and remediation of incidents.


text: At Outset, we strive to protect the confidentiality, integrity and availability of the personal data entrusted to us. We continue to invest in our cybersecurity program in an effort to enhance our ability to prevent, detect, contain, and mitigate cybersecurity threats.

companyName: Outset Medical, Inc.

ticker: OM


text: Oversight of our information security program, including oversight of risks related to cybersecurity threats and the assessment and management of such risks, is accomplished through a governance structure which includes our Board, Audit Committee, and executive management.


text: BOARD AND COMMITTEE OVERSIGHT BOARD: One of the key functions of our Board is informed oversight of our risk management process. Our Board focuses on the overall risks affecting us and delegates responsibility for oversight of certain specific risks to its standing committees. For significant risks related to cybersecurity, the Board has delegated oversight responsibility to the Audit Committee.


text: We have established a continuous monitoring strategy and program, which includes: • a set of defined security metrics to be monitored; • performance of security control assessments on an ongoing basis; • addressing results of analysis and reporting security status to the executive team; and • monitoring information systems to detect attacks and indicators of potential attacks.

companyName: TTM TECHNOLOGIES INC

ticker: TTMI


text: Our full Board and Audit Committee are kept informed about significant risks related to cybersecurity, including enterprise-level risks from cybersecurity threats. The Board receives written updates, generally on a quarterly basis, regarding the status of our information security program. In addition, the Audit Committee receives in-person updates on our information security programs on at least an annual basis. These updates generally cover topics such as our cybersecurity strategy, the threat landscape, key cybersecurity risk areas facing the organization, any key findings of audits and testing, the status of key initiatives, as well as a review of any major incidents.


text: AUDIT COMMITTEE: Our Audit Committee is responsible for overseeing our major financial, legal, and regulatory risk exposures, which span a variety of areas, including cybersecurity.


text: Executive management plays a significant role in assessing and managing material risks from cybersecurity threats. Our Chief Technology Officer manages our information security program.


text: Executive leadership Our Chief Technology Officer and the information security team periodically present information about the Company's information security program, including program goals and actions, progress against key initiatives and key risks, to our executive leadership team. As described above, significant risks related to cybersecurity are escalated to the Audit Committee and/or the full Board as appropriate.


text: Cross-functional management engagement We have established a committee comprised of leaders from key functions across the Company including, but not limited to, information security, IT, engineering, legal, regulatory, medical affairs, finance, research and development, operations, supply chain, marketing and people operations. This committee generally meets quarterly and is responsible for promoting a culture of awareness and accountability related to, among other things, information security. The committee also provides cross-functional input to facilitate the development, articulation, implementation and operation of information security risk management programs.


text: Governance of information security risks We have also established a risk governance committee, which generally meets on a monthly basis. This committee, which is sponsored by the Chief Technology Officer, is comprised of Company associates from information security, information technology (IT), engineering, and other functions, who have experience in managing cybersecurity risks, who review the cybersecurity threat landscape, and who evaluate key emerging data security risks. The committee reviews certain cybersecurity-related risks facing the company; discusses open policy exceptions and key risk indicators; and manages cybersecurity risks presented by the information security team and proposed mitigation actions. Members of this committee review the key risks identified as an outcome of our cybersecurity risk management strategy described below.


text: Risk Management and Strategy Our cybersecurity risk management program is designed to identify, assess, and manage reasonably foreseeable material risks facing Outset from cybersecurity threats. We identify cybersecurity risks in various ways, including but not limited to the ongoing monitoring of our systems using various technologies and processes, monitoring of emerging threats, third-party penetration testing of our device and systems, vulnerability scanning and assessments, and cross-functional risk discussions. We have also received Systems and Organizations Controls 2 (SOC 2) certification for Tablo cloud. We have developed processes to help us track, prioritize, and manage identified cybersecurity risks. For example, risks are defined, categorized, and assigned a risk rating based on potential impact and likelihood, which informs acceptance, mitigation or remediation actions which should be undertaken. The Risk Governance Committee reviews key identified risks and discusses related mitigation actions in response to such risks.


text: We have operationalized key processes to help us identify, assess, manage, and mitigate reasonably foreseeable risks from potential cybersecurity threats. For example: • USE OF THIRD PARTIES: We engage third-party cybersecurity consulting firms to assist us with various aspects of our cybersecurity risk management program. For example, we currently consult with third party firms to assist with our annual penetration testing for the Tablo device, Tablo cloud and IT infrastructure. In addition, In addition, we used a third-party audit firm accredited by the American Institute of Certified Public Accountants (AICPA) to support us in the SOC 2 certification process for Tablo cloud. We also used a third-party firm to assist us with the National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) 140-3 certification we are pursuing. • VENDOR ASSESSMENT: We leverage a third-party risk assessment tool to help us identify cybersecurity related risks associated with our use of certain third-party service providers. • INCIDENT PREPAREDNESS AND RESPONSE: We maintain a Cybersecurity Incident Response Plan (IRP) which establishes a framework designed to enable us to respond to cybersecurity incidents in a consistent, timely and effective manner. Our IRP outlines procedures for identifying, reporting, investigating, assessing, and responding to cybersecurity incidents, including incident response team formation, roles and responsibilities by department, and communication and escalation protocols. Depending on the severity of the cybersecurity incident, our IRP contemplates escalation to our executive leadership team and the Audit Committee and/or the full Board, as well as periodic briefings on developments related to the incident response. We periodically review and update our IRP and have conducted training of key team members regarding the IRP. In addition, we recently conducted a tabletop exercise to simulate a response to a cybersecurity incident. • SECURITY STANDARDS: Our IT and Tablo cloud security architecture are designed to comply with the HIPAA Security Rule. In addition, our Tablo cloud security architecture leverages recognized frameworks designed to protect customer data. For example, we have received SOC 2 certification for Tablo cloud, we are in the process of pursuing NIST FIPS 140-3 certification, and we are working to align our processes, protocols and software with the FDA's recent cybersecurity guidance finalized in September 2023. We periodically examine our security controls and take steps to review, prioritize and address key compliance gaps where identified, using a risk-based approach. • TECHNICAL SAFEGUARDS: We perform information security maturity assessments and penetration testing for the Tablo device and Tablo cloud (including in connection with new product features and services), as well as for our IT infrastructure. We conduct vulnerability scans across key assets, core infrastructure, and endpoints to identify potential vulnerabilities and potential cybersecurity events. We assess and prioritize the remediation of vulnerabilities and other cybersecurity risks identified through these activities, using a risk-based approach. • INSURANCE: We maintain information security risk insurance coverage to mitigate potential losses in the event of a business disruption.


text: • TRAINING: All Outset employees are assigned HIPAA and information security training as part of the new employee onboarding process and refresher training is assigned annually. Our IT team also conducts continuous automated phishing campaigns, which can trigger additional training for employees on how to recognize social engineering attempts (e.g., phishing, smishing, etc.). We track employee performance on phishing exercises to help us monitor the awareness of our employees and inform future training priorities. For employees whose jobs require access to sensitive data, including PHI, additional security training may be required.


text: Risks from Cybersecurity Threats Our business relies on secure and continuous processing of information and the availability of our IT networks and IT resources, as well as critical IT vendors that support our technology and data processing operations. Security breaches, computer malware and computer hacking attacks have become more prevalent across industries and may occur on our systems or those of our third-party service providers. Attacks upon IT systems are increasing in their frequency, levels of persistence, sophistication, and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. We may face increased risks from cybersecurity threats due to our reliance on internet technology and the increased frequency of employees working remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities.


text: We regularly monitor, defend against, and respond to cyber and other security threats to our networks and other information security incidents. Despite our information security efforts, our facilities, systems, servers, platforms and data, as well as those of our third-party cloud and other service providers and Tablo's two-way wireless communication system, may be vulnerable to privacy and information security incidents and may be breached due to the actions of outside parties, employee error or misconduct, malfeasance, or a combination of these and, as a result, an unauthorized party may obtain access to our data or the personal information maintained by us or on our behalf. These include data breaches, viruses or other malicious code, exploitation of known or unknown vulnerabilities, coordinated attacks, data loss, phishing attacks, ransomware, denial of service attacks, insider threats or other security or IT incidents caused by threat actors, technological vulnerabilities, or human error. Additionally, outside parties may attempt to fraudulently induce employees to disclose sensitive information to gain access to the data and personal information we maintain. As of the date of this Annual Report, we are not aware of any material adverse impact to our business or operations from cybersecurity threats or incidents. We do, however, recognize that the cybersecurity landscape evolves rapidly and that we are not immune to such incidents. If we, or any of our third-party service providers, fail to comply with laws requiring the protection of sensitive personal information, or fail to safeguard and defend personal information or other critical data assets or IT systems, or if our incident response, containment or mitigation measures are inadequate in the face of a particular data security incident, we may face significant business interruptions, incur reputational damage, and be subject to regulatory enforcement and fines as well as private civil actions. We may be required to expend significant resources in the response, containment, mitigation of cybersecurity incidents as well as in defense against claims that our information security was unreasonable or otherwise violated applicable laws or contractual obligations. In addition, to the extent that our cloud and other service providers experience security breaches that result in the unauthorized or improper use of confidential information, employee information or personal information, we may not be indemnified for any losses resulting from such breaches. If we are unable to prevent or mitigate the impact of such security breaches or other cyber events that impact our operations, our ability to attract and retain new customers, patients, and other partners could be harmed, as they may be reluctant to entrust us with their data, and we could be exposed to litigation and governmental investigations, which could lead to a potential disruption to our business or other adverse consequences.


text: In addition, manufacturing operations at our Mexico-based facility may also suffer disruptions from cybersecurity attacks, which could negatively impact our ability to produce Tablo consoles and cartridges, restrict or delay our ability to deliver products to our customers and meet our customers' demand on a timely basis, and result in customer dissatisfaction, all of which would adversely impact our results of operations. Moreover, we use Amazon Web Services to support Tablo's cloud connectivity and any disruption of service as a result of cybersecurity attacks could interrupt or delay our ability to receive and deliver certain treatment and reporting information from and to providers and patients. The continuing and uninterrupted performance of Tablo is critical to our success and any repeated or prolonged system failures may damage our reputation, reduce the attractiveness of Tablo to providers and patients, and result in decreased demand for Tablo, thereby adversely affecting our business, financial condition and results of operations. For more information on the risks we face from cybersecurity threats and the potential impacts on our company, see the section above entitled "Risk Factors" under Part I, Item 1A, including the risk factor entitled "We may face additional costs, loss of revenue, significant liabilities, harm to our brand, decreased use of our platform and business disruption if there are any security or data privacy breaches or other unauthorized or improper access."


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, patient data, and data related to our clinical trials ("Information Systems and Data").

companyName: Minerva Neurosciences, Inc.

ticker: NERV


text: The Company's information security function and third-party service providers help identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's risk assessment process. The Company's information security function and third-party service providers identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: • automated tools; • subscribing to reports and services that identify cybersecurity threats; • analyzing reports of threats and actors; • conducting scans of the threat environment; • evaluating our and our industry's risk profile; • evaluating threats reported to us; • conducting audits; • conducting threat assessments for internal and external threats; • conducting vulnerability assessments to identify vulnerabilities; and • using external intelligence feeds.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: • our incident response plan; • incident detection and response processes; • a disaster recovery/business continuity plan; • encryption of certain data; • network security controls; • access controls; • asset management, tracking and disposal; • systems monitoring; • employee training; • penetration testing; • cybersecurity insurance; and • outsourced cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Company's information security function works with management, including our Chief Operating Officer ("COO") to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: • our external IT service provider; • professional services firms, including legal counsel; • cybersecurity consultants; • managed cybersecurity service providers; and • penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, contract research organizations and contract manufacturing organizations. As part of our vendor security due diligence and to manage cybersecurity risks associated with our use of certain vendors, we perform risk assessments on vendors and may include cybersecurity obligations in our contracts with them. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor due diligence may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and we may impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including: • Our business and operations would suffer in the event of system failures; and • If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our COO.


text: The COO is responsible for managing our information security function and overseeing our third-party information technology service providers. The COO is also responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, and approving budgets. Our outsourced Chief Technology Officer, who has over 20 years in executive-level IT and cybersecurity roles, is responsible for developing and implementing our technology environment and cybersecurity framework, helping the Company prepare for cybersecurity incidents, approving and implementing certain cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the COO and Chief Financial Officer ("CFO"). The COO and CFO work with the other members of the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company will report to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic updates from the CFO and finance department concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various updates, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Cybersecurity Risk Management We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats, which risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or participants in our clinical trials, and violation of data privacy or security laws.

companyName: Karuna Therapeutics, Inc.


text: Identifying, assessing, and managing cybersecurity risk is integrated into our overall enterprise risk management systems and processes. Our cybersecurity risk management program is informed by prevailing security standards and is designed to provide a framework for evaluating and responding to potential cybersecurity risks, and addressing cybersecurity threats and incidents to the extent they arise. This includes processes for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat, implementing cybersecurity countermeasures and mitigation strategies and informing and updating management and, as needed, the audit committee of our board of directors of cybersecurity incidents that may pose a significant risk for the business, as applicable. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact. An important component of this program is employee awareness of and vigilance regarding cybersecurity risks, which we promote through periodic training and testing.


text: Recognizing the complexity and evolving nature of cybersecurity threats, incidents and risks, we engage third-party experts, including managed IT service providers and cybersecurity consultants, to evaluate and support our risk management systems. We also have processes to assess third party risks, and we perform third-party risk management to identify and mitigate risks from third party providers, such as vendors, suppliers, CROs, and other business partners associated with our use of third-party service providers.


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management program. Cybersecurity risks are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.


text: As of the date of this Annual Report on Form 10-K, risks from cybersecurity threats have not materially affected, and we do not believe are reasonably likely to materially affect, us, our business strategy, results of operations, or financial condition. However, cybersecurity threats are constantly evolving, becoming more frequent and more sophisticated and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them. While we have implemented measures to safeguard our operational and technology systems, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. For more information about these risks, please see "Risk Factors – Cyber-attacks or other failures in our telecommunications or information technology systems, or those of our collaborators, contract research organizations, third-party logistics providers, distributors or other contractors or consultants, could result in information theft, data corruption and significant disruption of our business operations." in this Annual Report on Form 10-K.


text: Cybersecurity Governance Our board of directors has overall oversight responsibility for our risk management, and delegates information security and related risk management oversight to the audit committee of the board of directors through the audit committee charter. Members of the audit committee receive updates on a regular basis from management regarding matters of cybersecurity. This includes existing and new cybersecurity risks, how management is addressing or mitigating those risks, cybersecurity and data privacy incidents (if any), and the status of key information security initiatives.


text: Management is responsible for identifying, considering and assessing material risks for the business on an ongoing basis, including in relation to cybersecurity. As part of this process, our Vice President of Information Technology is tasked with establishing processes to ensure that potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our Vice President of Information Technology receives reports from our cybersecurity team and oversees the monitoring of the prevention, detection, mitigation, and remediation of cybersecurity incidents, if any. In addition, our Vice President of Information Technology reports cybersecurity incidents to our compliance committee, which is composed of relevant members of management, and, where appropriate, to the audit committee.


text: Our Vice President of Information Technology and our cybersecurity team are experienced information systems security professionals. These individuals, working with cybersecurity vendors, including managed IT service providers and training partners, monitor for vulnerabilities and threats, which are reported to other members of management, where appropriate.


text: Cyber Risk Management and Strategy Kymera uses, stores and processes data for and about our research programs, clinical trials, employees, and suppliers. We have developed and maintain an information security program designed to assess, identify, and manage risks from cybersecurity threats, including to our data and systems. We conduct periodic assessments of our assets, including internal and external security testing, as part of our risk management process and to evaluate the effectiveness of applicable security controls. These assessments are informed by industry standards. Our cybersecurity risk management process is a part of our overall risk management program. We also have an employee education program that includes training designed to raise awareness of cybersecurity threats. We have adopted an Incident Response Policy that outlines the legal and governance process for identifying and managing material cyber risks to our information and information systems and our framework for assessing and responding to cyber incidents, as applicable.

companyName: Kymera Therapeutics, Inc.

ticker: KYMR


text: Governance Related to Cybersecurity Risks Under the ultimate direction of the Chief Executive Officer and our executive management team, the Cybersecurity Supervisory Committee (CSSC) has primary responsibility for overseeing our management of cybersecurity risks, which includes representatives from finance, legal, operations, human resources, and information technology. The CSSC meets as circumstances warrant to review and update incident response procedures and to provide oversight of incident response activities of the Cyber Security Incident Response Team.


text: The head of information technology and the CSSC have primary responsibility for assessing and managing our cybersecurity program. The head of information technology, who reports to the Chief Operating Officer, has more than 25 years of experience in building and leading information technology and security teams.


text: The board of directors has ultimate oversight of our risk management program and has delegated oversight of that program, including, oversight of cybersecurity, to the audit committee of the board of directors. The S.V.P. of Information Technology presents to the audit committee periodically regarding cybersecurity matters. The Chief Financial Officer and the Chief Legal Officer are responsible for informing the audit committee in the event of any material cybersecurity incidents and any potential disclosure obligations arising from such incidents.


text: WTW engages third parties to conduct assessments to help it identify, categorize and manage cyber risks including SOC 2 - Type 2, ISO 27001 and a National Institute of Standards and Technology ('NIST') cybersecurity maturity assessment. Additionally, management and third parties from time to time conduct penetration testing and vulnerability scanning to help WTW identify and reduce the threat of known and emerging cybersecurity risks.

companyName: WILLIS TOWERS WATSON PLC

ticker: WTW


text: Risk Management and Strategy We recognize that cybersecurity threats have been increasing in number and severity in the general marketplace and in our industry. In an effort to address these threats, we maintain a cybersecurity risk management strategy that is designed to identify, assess, and manage cybersecurity risks to our business. Our cybersecurity risk management strategy includes various policies and components, including cybersecurity assessments, an incident response plan, evaluation of the security practices of our key vendors, and cybersecurity awareness training for our staff. We also leverage third-party technology and security tools and solutions, including alerting and monitoring tools, to support our cybersecurity program.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: We engage a third-party to conduct a cybersecurity risk assessment on an annual basis, which is informed by the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We have established a process for our IT security team to track and quantify known IT security risks and our remediation efforts through a cybersecurity risk register. The IT security team meets periodically to review and update the cybersecurity risk register based on feedback across the organization and the findings contained in our NIST-informed annual cybersecurity risk assessment. The IT security team reports on findings on at least an annual basis to the executive leadership team and the board of directors.


text: We have established a process to review and assess major software vendors' security practices prior to onboarding, which includes review of the vendors' responses to cybersecurity questionnaires and security audit reports and certifications, as applicable. Our process also includes contractual requirements for major vendors that process data on our behalf to maintain data protection safeguards.


text: We maintain a security awareness training program for employees, which is provided during onboarding. We also provide additional mandatory trainings, including phishing training, throughout the year.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected, and we do not believe they are reasonably likely to materially affect, our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our and our third-party vendors' information systems. For more information about the cybersecurity risks we face, see the risk factor entitled "Cyber-attacks or other failures in our telecommunications or IT systems, or those of our collaborators, CROs, third-party logistics providers, distributors or other contractors or consultants, could result in information theft, data corruption and significant disruption of our business operations" in Item 1A- Risk Factors.


text: Governance of Cybersecurity Risks Our board of directors is responsible for the general oversight of cybersecurity risks and is informed of key updates to our cybersecurity processes by our audit committee and relevant members of our executive leadership team on at least an annual basis.


text: Our audit committee and members of our executive leadership team meet with our Head of Global Information Technology on a quarterly basis, along with other members of our IT security team from time to time, to discuss cybersecurity matters, such as the emerging cybersecurity threat landscape, significant developments to our cybersecurity processes, and our cybersecurity risk assessments.


text: Our IT security team, led by the Head of Global Information Security, Governance and Architecture ("Head of Global ISGA"), is responsible for managing and directing the day-to-day information security strategy of the organization, including oversight of our cybersecurity tools, controls and strategies to protect organization assets, networks and data. The Head of Global ISGA reports to our Head of Global Information Technology. The Head of Global ISGA routinely reports on cybersecurity risks, projects, and initiatives to the Head of Global Information Technology, who regularly reports to executive management and the audit committee on these matters as described above.


text: The Head of Global ISGA maintains a Certified Information Systems Security Professionals, or CISSP, certification and has approximately two decades of IT security management experience. The IT security team is supported by external vendors that provide managed services for network support, security operations and other IT areas as needed. Our IT security team also meets regularly with our Global Privacy Committee, which oversees our Enterprise Data Protection Program, to coordinate on cybersecurity initiatives and strategy related to protection of personal data.


text: Partnership management considers risks from cybersecurity threats as a component of its entity-wide risk assessment that includes various processes and procedures to assess, identify, and manage material risks. The Partnership uses a variety of information technology solutions in the operation of its business, all of which are maintained by reputable third-party providers, including an information technology managed services system provider that is an affiliate of Greystone.


text: We incorporate technical safeguards such as Multi-Factor Authentication ("MFA"), principles of Zero Trust and password complexity policies for all accounts to help prevent unauthorized access to our systems and data. We also operate a Security Operations Center ("SOC") to manage our real-time end point protection monitoring.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: Management has also developed procedures to assess the operations and internal controls of material service providers through the use of questionnaires, reviews of available policy statements, and evaluation of System and Organization Controls assurance reports, which are assessed in the aggregate to determine if the service providers have adequately addressed the risks of cybersecurity threats within their operations. The overall assessment includes an evaluation of a service provider's breach notification policies and procedures and any reported cybersecurity incidents. Management is not aware of any cybersecurity incidents at any of its service providers that have materially affected or are reasonably likely to materially affect the Partnership's operations.


text: Notwithstanding the extensive approach the Partnership takes to cybersecurity in conjunction with Greystone, the Partnership may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Partnership. See "Item 1A. Risk Factors," for a discussion of cybersecurity risks.


text: Certain employees of Greystone Manager that provide services to the Partnership are responsible for assessing and managing material risks from cybersecurity threats and are overseen by the Partnership's Chief Financial Officer. The Chief Financial Officer and relevant Greystone Manager employees collectively have over 20 years of experience in information technology risk assessment and audit evaluations. These individuals will also consult with experts from Greystone's affiliate that provides information technology managed services systems, particularly the Chief Information Security Officer ("CISO") of the Greystone affiliate, when assessing and evaluating risks of cybersecurity threats. These consultations with the CISO typically encompass a broad range of topics, including the current cybersecurity landscape and emerging threats; the status of ongoing cybersecurity initiatives and strategies; incident reports and learnings from any cybersecurity events; and compliance with regulatory requirements and industry standards.


text: The Partnership has established incident response procedures to be followed in the event of a cybersecurity incident that is overseen by the Partnership's Chief Executive Officer and Chief Financial Officer. The Chief Executive Officer and the Chief Financial Officer are notified of cybersecurity incidents as soon as the Partnership receives notification from a third-party service provider or is informed by other means, and will determine if additional internal and/or external resources are needed to evaluate, mitigate, and remediate the cybersecurity incident. At a minimum, the Board of Managers will be notified of material cybersecurity incidents prior to any public announcement and will receive updates on material developments and remediation activities.


text: The Board of Managers considers risks from cybersecurity threats in conducting its oversight of the Partnership's overall risk assessment, primarily through the activities of the Audit Committee of the Board of Managers. The Chief Financial Officer reports to the Audit Committee the results of the evaluation of risks from cybersecurity threats, the process, procedures and internal controls designed to address such risks, and other relevant information needed for the Audit Committee to operate its oversight responsibilities. The Partnership's internal audit function reports to the Audit Committee annually the results of its assessment of design and operating effectiveness testing of internal controls. In addition, the Audit Committee conducts an annual review of the Partnership's cybersecurity posture and the effectiveness of its risk management strategies. This review assists in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework of the Partnership.


text: Additional third parties, contracted with by our third-party service providers, also play a role in the Partnership's overall cybersecurity. Our third-party service providers engage with a range of additional third-party service providers and external experts, including cybersecurity assessors, consultants, and auditors, to evaluate and test their risk management systems. These services include, but are not limited to, penetration testing, independent audits, and consulting on best practices to address new challenges, and also include testing both the design and operational effectiveness of our security controls. These engagements enable our service providers to leverage specialized knowledge and insights, ensuring cybersecurity strategies and processes remain at the forefront of industry best practices.


text: Risks from Cybersecurity Incidents The Partnership has not encountered a cybersecurity incident that has materially impaired our operations or financial condition.


text: WTW's management is responsible for the day-to-day management of risks, and the board, including through its committees, is responsible for understanding and overseeing the various risks facing WTW.


text: Cybersecurity Risk Management and Strategy Increased global cybersecurity vulnerabilities, threats and more sophisticated and targeted cyber-related attacks pose an ongoing risk to the security of our information systems and networks. WTW seeks to manage cybersecurity risks consistent with its general approach to enterprise risk management ('ERM'). Technology and cyber risks that meet certain thresholds are escalated and tracked by the ERM team within the Risk function.


text: Education and Awareness: Our Adviser provides regular, mandatory training for its employees regarding cybersecurity threats as a means to equip its employees with effective tools to address cybersecurity threats, and to communicate our Adviser's evolving information security policies, standards, processes and practices.

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: Board Oversight and Governance WTW's board of directors has delegated the oversight of risks to the Audit and Risk Committee through its charter. The Audit and Risk Committee assists the board of directors in its oversight of the ERM framework, policies and practices used by WTW to identify, assess and manage key risks facing WTW, including financial and strategic risks as well as risks relating to matters of compliance and internal control, tax and pension, among other matters. The Operational Transformation Committee (the 'OT Committee') oversees risks arising out of WTW's operations related to cybersecurity and other risks. WTW's Chief Information Security Officer ('CISO') and Chief Information Officer ('CIO') report to the OT Committee on cybersecurity matters, including key risks. The OT Committee reports to the board of directors at each formal board meeting and the board of directors discusses those reports.


text: Management Oversight and Governance Management plays an important role in assessing and managing WTW's material risks from cybersecurity threats. The CISO is responsible for designing and implementing a security program and strategy. WTW's CISO has served in various roles in information technology and information security for over 32 years, including serving as CISO of several public companies. The CISO holds undergraduate and graduate degrees in mathematics and strategic information systems and has attained the professional certification of Certified Information Systems Security Professional. The CISO reports to the CIO. WTW's CIO has served in various roles in information technology for over 36 years.


text: As part of the WTW cybersecurity program, cross-functional teams throughout WTW address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and escalate such threats and incidents as appropriate through the processes described in more detail below.


text: Management's cybersecurity risk management strategy and processes focus on several key areas, including: • Incident Response Planning: WTW has a global Information and Cyber Security Incident Response Plan ('ICSIRP' or 'Plan') for identifying and managing cyber and data security threats. The ICSIRP defines the roles and responsibilities of WTW stakeholders involved in responding to cyber and data security events, severity levels and incident categories, and it outlines a process for incident management, including escalation and communication procedures. • Technical Safeguards: WTW seeks to continuously improve implemented technical safeguards that are designed to protect WTW's information systems. Standards include controls for access management, cyber threat and incident management, data security, encryption, human resource security, network and device security, secure asset management, secure system development, security operations and third-party security. While WTW seeks to maintain adequate controls, they may not always be effective. See Part I, Item 1A Risk Factors under the heading 'Data and cybersecurity breaches or improper disclosure of confidential company or personal data could result in material financial loss, regulatory actions, reputational harm, and/or legal liability' for more information about WTW's technical controls, management, mitigation, and security practices as well as the risks related thereto. • Education and Awareness: WTW's policy is that all WTW colleagues are required to receive annual, mandatory privacy and information security training. • Third-Party Risk Management: WTW's risk management strategy includes a third-party risk management process that is intended to be aligned to the technology security key controls across the organization. • Threat Intelligence: WTW seeks to obtain threat intelligence on cyber threats to WTW at the strategic, operational and tactical levels.


text: Material Effects of Cybersecurity Incidents We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected our business strategy, results of operations, or financial condition. However, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations or financial condition. To learn more about risks from cybersecurity threats, review the risk factors included in Part I, Item 1A Risk Factors in this Annual Report on Form 10-K, as updated by WTW's subsequent SEC filings. The risks described in such filings are not the only risks facing WTW. Additional risks and uncertainties not currently known or that may currently be deemed to be immaterial also may materially adversely affect WTW's business, financial condition or results of operations.


text: Risk Management and Strategy The Company maintains robust and comprehensive processes, procedures and controls to protect and secure its information systems and data infrastructure from cybersecurity threats. The Company's cybersecurity program is led by its Chief Information Security Officer ("CISO"). The Company's cybersecurity program interfaces with other functional areas within the Company, including but not limited to the Company's business segments and information technology, legal, risk management, human resources and internal audit departments, as well as external third-party partners, to identify and understand potential cybersecurity threats. The Company regularly assesses and updates its processes, procedures and management techniques in light of ongoing cybersecurity developments.

companyName: Builders FirstSource, Inc.

ticker: BLDR


text: Internally, the CISO coordinates oversight of reviewing security alerts, identifying and monitoring ongoing and potential cybersecurity threats, evaluating strategic business impacts of cybersecurity threats and developing programs and initiatives to educate the Company's employees regarding cybersecurity. The CISO also manages the Company's Security Incident Response Plan (the "Incident Response Plan"), which outlines action steps for the preparation, identification, triage, analysis, containment, eradication, recovery and reflection stages of a cybersecurity incident. The Incident Response Plan serves as the charter for the Company's Security Incident Response Team (the "Incident Response Team"), which includes a strategic team comprised of executives from various cross-functional management teams, as well as a tactical team comprised of internal technical support roles and external third-party service providers. The Incident Response Plan provides how the Incident Response Team will analyze and, as necessary, escalate cybersecurity incidents both internally and with third-party service providers based on type and severity of the specific incident.


text: The Company also requires cybersecurity training for all active employees, focusing on the appropriate protection and security of confidential company and third-party information. Additionally, the Company provides quarterly cybersecurity awareness training that covers a broad range of security topics, including secure access practice, phishing schemes, remote work and response to suspicious activities. In addition to online training, employees are educated through several methods, including event-triggered awareness campaigns, recognition programs, security presentations, company intranet articles, videos, system-generated communications, email publications and various simulation exercises.


text: The Company has engaged a third-party managed detection and response company to monitor the security of its information systems around-the-clock, including intrusion detection, and to provide instantaneous alerting should a cybersecurity event occur. The Company also maintains a cybersecurity insurance policy and has engaged a third-party digital forensics and incident response consultant and legal counsel on retainer.


text: The Company does not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected the Company. However, the sophistication of cyber threats continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.


text: The Company's Audit Committee and Board of Directors provide ultimate oversight of the Company's cybersecurity risk management. The Audit Committee regularly reviews and discusses with management the strategies, processes, procedures and controls pertaining to the management of the Company's information technology operations, including cyber risks and cybersecurity. The Company's Chief Information Officer ("CIO") provides quarterly reports to the Audit Committee regarding the evolving cybersecurity risk landscape, including emerging risks, as well as the Company's processes, program and initiatives for managing these risks.


text: The Company's CISO reports directly to the CIO, who in turn reports to the CFO. The CISO maintains the certified information systems security professional (CISSP) certification and GIAC G2700 (Certified ISO 27000 Specialist) and has over 20 years of experience in cybersecurity. Under the direction of the CISO, the Company's cybersecurity department continuously analyzes cybersecurity and resiliency risks to our business, considers industry trends and implements controls, as appropriate, to mitigate these risks. The team consists of cybersecurity professionals holding multiple certifications such as the CISSP, CEH (Certified Ethical Hacker), GSOM (GIAC Security Operations Manager), GCIA (GIAC Certified Intrusion Analyst), GCFA (GIAC Certified Forensic Analyst), GNFA (GIAC Network Forensic Analyst), GCTI (GIAC Cyber Threat Intelligence), CISM (Certified Information Security Manager) and CISA (Certified Information Systems Auditor). This analysis drives the Company's long- and short-term cybersecurity strategies, which are executed through a collaborative effort within the IT department and are communicated to the Board of Directors regularly.


text: Our EVP and Chief Financial Officer is responsible for the oversight of the Company's information technology and cybersecurity function, which consists of five employees and is led by our VP, Information Systems & Solutions. Our VP, Information Systems & Solutions has over 25 years of experience in information technology leadership, including oversight of information technology general controls and management of information technology security and cybersecurity programs. The information technology and cybersecurity team also includes our Director, Information Technology, who has held information technology leadership roles for over 15 years, including in management of infrastructure, applications, information technology security, and cybersecurity prevention and education programs. The Audit Committee of the Board of Directors oversees the evaluation of the policies and practices developed and implemented by the Company with respect to the risk assessment and risk mitigation of information technology and cybersecurity matters.

companyName: Broadstone Net Lease, Inc.

ticker: BNL


text: The Company has implemented a Computer Security Incident Response Plan (the "Incident Response Plan") that sets forth the process for identifying, responding to, and recovering from cybersecurity incidents. We have a dedicated cross-functional Incident Response Team (the "IRT") that participates in annual tabletop exercises and simulations with our external cybersecurity legal counsel to test the Incident Response Plan as part of our business continuity, incident response, risk assessment, and disaster recovery planning. The IRT is also responsible for evaluating the level of materiality of any cybersecurity incident in accordance with the Incident Response Plan and may engage the services of third-party experts to assist in the event of a cybersecurity incident.


text: Our Head of IT is responsible for strategic leadership of our cybersecurity risk management program. The Head of IT role is currently held by an individual who has approximately eighteen years of professional IT management experience. Our Head of IT also provides regular updates on our cybersecurity risk to our executive leadership team and other management committees responsible for IT and cybersecurity risk management.

companyName: Intellia Therapeutics, Inc.

ticker: NTLA


text: The Audit Committee of the Board of Directors provides direct oversight over cybersecurity risk and provides regular updates to the Board of Directors regarding such oversight. The Audit Committee regularly meets with members of management responsible for data privacy, technology, and information security risks to discuss these risks, risk management activities, incident response plans, best practices, the effectiveness of our security measures, and other related matters.

companyName: CarGurus, Inc.

ticker: CARG


text: To our knowledge, in the last three years we have not experienced a cybersecurity incident that has had, and we are not aware of any cybersecurity incident that is reasonably likely to have, a material impact on us, our business strategy, results of operations or financial condition. However, as (i) our business involves the storage and transmission of numerous classes of sensitive and confidential information and proprietary information, including tenants' information, private information about our investors and our employees, and financial and strategic information about us and (ii) we also rely on third-party service providers that have access to such information in connection with providing necessary information technology and security and other business services to us, we face risks associated with security breaches through cyber-attacks or cyber-intrusions, malware, computer viruses, attachments to e-mails, persons inside our organization or persons with access to systems inside our organization, and other significant disruptions of our IT networks and related systems that could have a material impact on us, our business strategy, results of operations or financial condition. See "Risks Related to Our Business and Properties – Security breaches and other technology disruptions could compromise our information systems and expose us to liability, which could materially and adversely affect us" for additional information.


text: In an effort to mitigate the impact of cybersecurity events, we conduct mandatory information technology and cybersecurity training for all employees upon hire and at least annually thereafter, and regularly test our employees for information security awareness and adherence to our information technology and cybersecurity policies, which are reviewed at least annually. We also provide our employees with access to educational newsletters and articles regarding relevant information technology and cybersecurity matters on a regular basis. Additionally, we utilize third-party experts to review and test our information technology infrastructure, including constant monitoring for suspicious activity, routine penetration testing of our networks, and an annual security assessment of the effectiveness of our informational technology environment to identify potential vulnerabilities. For example, our VP, Information Systems & Solutions and Director, Information Technology receive periodic reporting from our managed security service provider and meet regularly to discuss reported activity and assess any recommendations. The Company also receives a quarterly cyber risk rating from an external enterprise risk management service provider and our VP, Information Systems & Solutions and Director, Information Technology meet to discuss the rating and potential enhancements to our cybersecurity program. The cyber risk rating reports are also shared with the Audit Committee on a quarterly basis. Our third-party service providers of technology services are generally required to provide us with system and organization controls (SOC) reports prior to formal engagement and annually thereafter. The reports are reviewed by our VP, Internal Audit and our VP, Information Systems & Solutions, or their designee(s), to assess and monitor compliance with cybersecurity best practices.