text: We train employees to understand their role in attempting to protect the Company from cybersecurity attacks. Our information security training program for employees includes acknowledgement of our information security policies, regular internal communications, and testing to measure the effectiveness of our information security program. For example, we conduct regular phishing awareness campaigns designed to emulate current threats and provide immediate feedback and, as necessary, additional training or remedial action.


text: In addition, we engage third parties to assist in assessing, identifying, and remediating material risks from cybersecurity threats. Our key cybersecurity controls are regularly tested by third-party service providers, which we retain to help identify vulnerabilities in our systems and to help maintain compliance to standards and regulatory requirements. Other third-party service providers are enlisted by the Company for security operations center services to augment our teams' monitoring capabilities and to assist with our investigation and response to alerts on emerging and ongoing threats.

companyName: DESTINATION XL GROUP, INC.

ticker: DXLG

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: majority


text: Further, our cybersecurity team continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs. We use various security tools and processes to help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner, including, but not limited to, risk assessment network security controls, detection and response tools and a vulnerability management program.


text: The complexity and evolving nature of cybersecurity threats requires that we engage with a range of external experts, including cybersecurity assessors and consultants, in evaluating and testing our risk management systems. This enables us to leverage specialized knowledge and insights to be confident that our cybersecurity strategies and processes are consistent with industry best practices. Our collaboration with these third parties includes regular threat assessments and consultation on security enhancements.

stage1Method: unanimous


text: In order to mitigate data or security incidents that may originate from third-party vendors or suppliers, we conduct both privacy and security assessments to properly identify, prioritize, assess and remediate any third-party risks, and we require security and privacy addenda to our contracts where applicable. We currently maintain a cyber insurance policy that provides coverage for security breaches; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, or other related breaches.

stage1Category: Third-Party Risk


text: The nature of our business exposes us to cybersecurity threats and attacks that can lead to the unauthorized acquisition or access, compromise, loss, misuse or theft of our data, including personal information, confidential information or intellectual property. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition. Also see Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks.

stage1Category: Strategy Integration


text: Our Board is ultimately responsible for the risk oversight of the Company, including cybersecurity and privacy risks. Our Board has delegated day-to-day responsibility for oversight of cybersecurity risks to the Cyber Committee. The Cyber Committee is composed of members of our Board who have diverse expertise, including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. Pursuant to its charter, our Cyber Committee: • assists our Board in fulfilling its risk oversight responsibilities with respect to the protection of the Company's assets, including confidential, proprietary and personal information, reputation and goodwill in all forms; • supervises and monitors the soundness of our cybersecurity and data protection strategies and practices; • oversees and monitors our material compliance with applicable information security, privacy and data protection laws, industry standards and contractual requirements; • promotes and furthers the integrity, adoption and coordination of our data security processes across the Company to help ensure that data and system security is a Company-wide business objective and priority; and • oversees our cybersecurity and data protection performance and the overall implementation of our cybersecurity and data protection strategy.

stage1Category: Board Governance


text: At the management level, our Chief Technology Officer and our Senior Vice President, Technology and Innovation, as well as our technology staff, are primarily responsible for identifying, assessing, monitoring and managing our cybersecurity. Our Chief Technology Officer reports directly to our President and Chief Executive Officer and meets at least quarterly with the Cyber Committee. Our current Chief Technology Officer has over 35 years of industry experience, including service as a Chief Technology Officer/Chief Information Officer for over seven years and extensive experience in developing and leading technology risk management programs. Our Senior Vice President, Technology and Innovation reports directly to the Chief Technology Officer and has over 32 years of industry experience with the Company. He has led the Company's cybersecurity team and overseen PCI certification for the past seven years, ensuring compliance with industry standards and strengthening the organization's security posture. Additionally, our technology staff holds multiple industry-standard security certifications, including Cisco Certified Network Associate, PCI Internal Security Assessor, and Certified Ethical Hacker.

stage1Category: Management Role


text: We maintain a data security plan designed to provide a documented and formalized information security policy to detect, identify, classify and mitigate internal and external cybersecurity and other data security threats. This cybersecurity program is based in-part on, and its effectiveness is measured using applicable industry standards, and is integrated into our overall enterprise risk management program. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes.

companyName: Shimmick Corp

ticker: SHIM


text: In furtherance of detecting, identifying, classifying and mitigating cybersecurity and other data security threats, including such threats associated with our use of any third-party service providers, we also: • assess and analyze baseline configuration standards to ensure that they meet the intent and effectiveness required for the overall safety and security (both logically and physically) of critical system components; • ensure the asset inventory for relevant system components is kept current and accurate; • ensure that network connection arrangement documents are kept current and accurate; • limit access rights to system components to authorized personnel only, with all end-users being properly granted access in accordance with stated access rights policies and procedures; • deploy anti-virus solutions on all applicable system components, with the respective anti-virus solutions being the most current versions available from applicable vendors, enabled for automatic updates and configured for conducting periodic scans as necessary; • provision, hardens, secures and locks down critical system resources; • use internal and external vulnerability scanning procedures, along with network layer and anti-hacking tests; • facilitate requests for validation of baseline configurations for purposes of regulatory compliance assessments and audits; and • provide mandatory training and optional certification accreditation for purposes of maintaining an acceptable level of information security expertise necessary for configuration management.


text: Conducting our businesses involves the collection, storage, use, disclosure, processing, transfer, and other handling of a wide variety of information, including personally identifiable information, for various purposes in our businesses. Like other comparable-sized companies that process a wide variety of information, our information technology systems, networks and infrastructure and technology have been, and may in the future be, vulnerable to cybersecurity attacks and other data security threats. As of the date of this Form 10-K, we do not believe any risks from previous cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our results of operations or financial condition. However, cybersecurity attacks are constantly evolving, may be difficult to detect quickly, and often are not recognized until after they have been launched against a target. Despite our security measures, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information about these and other cybersecurity risks faced by us, see "Risk Factors – Risks Related to Our Business and Industry – We rely on IT systems to conduct our business, and disruption, failure or security breaches of these systems could adversely affect our business and results of operations" and "– Cybersecurity attacks on or breaches of our information technology environment could result in business interruptions, remediation costs and/or legal claims".


text: Our board of directors has ultimate oversight for risks relating to our data security plan. In addition, the board of directors has delegated primary responsibility to the Audit Committee for assessing and managing data privacy and cybersecurity risks, reviewing data security and cybersecurity policies and processes with respect to data privacy and cybersecurity risk assessment and management, reviewing steps management has taken to monitor and control such risks, and regularly inquires with our management team, internal auditors and independent auditors in connection therewith. The Audit Committee is also responsible for overseeing our investigation of, and response to, any cybersecurity attacks or threats.


text: We also have a dedicated team of employees overseeing its data security plan and initiatives, led by our Director of IT. With over fifteen years of experience in the field of cybersecurity, our Director of IT brings a wealth of expertise to his role. His background includes extensive experience in all facets of information technology and information security. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Director of IT also works directly in consultation with internal and external advisors in connection data security planning and initiatives. We engage such external advisors to assist with the evaluation of our technology, security, critical risk areas and related controls to improve our ability to identify and detect, protect against, and recover from, cybersecurity incidents and other evolving threats and to appropriately benchmark against industry practices.


text: We have developed a procedure by which the board of directors and management are informed about relevant cybersecurity risks, allowing for effective cybersecurity oversight and the ability of the Company to monitor, prevent, detect, mitigate and remediate cybersecurity incidents. The results of our evaluations and the feedback from its engagements are used to drive alignment on, and prioritization of, initiatives to enhance our cybersecurity strategies, policies, and processes and make recommendations to improve processes.


text: In the event of a potential or actual cybersecurity event, the Director of IT immediately notifies general counsel at which point the information security incident response plan is activated if warranted. The information security incident response plan provides the procedures for responding, including personnel required to be informed and updated. The board of directors is informed promptly in the event such incident is, or is reasonably expected to have, a material impact on operations or financial condition.


text: The Fund has processes in place designed to assess, identify, and manage material risks from cybersecurity threats. The Fund's business is dependent on the communications and information systems of the Investment Adviser and other third-party service providers. The Investment Adviser manages the Fund's day-to-day operations and has implemented a cybersecurity program that applies to the Fund and its operations.

companyName: John Hancock Comvest Private Income Fund


text: Cybersecurity Program Overview The Investment Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Fund. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Fund relies. The Investment Adviser, together with external consultants, actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Fund.


text: The Fund relies on the Investment Adviser's compliance and risk management program and processes, which include periodic review of the Investment Adviser's cybersecurity program.


text: The Fund depends on and engages various third parties, including service providers, to operate its business. The Fund relies on its Chief Compliance Officer ("CCO") and the expertise of risk management, legal, information technology, and compliance personnel of the Investment Adviser when identifying and overseeing risks from cybersecurity threats associated with its use of such entities.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the Investment Adviser regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Investment Adviser's operations, as well as the Fund.


text: Management's Role in Cybersecurity Risk Management The Fund's management, including the Fund's CCO and the Investment Adviser's Technology Risk and Information Security Committee (the "Committee"), manage the Fund's cybersecurity program. The CCO of the Fund oversees the Fund's oversight function generally and relies on the Investment Adviser's Committee to assist with assessing and managing material risks from cybersecurity threats. The Committee is chaired by an outside cybersecurity and information technology expert, and its other members are the Investment Adviser's Chief Financial Officer, General Counsel, and Director of Information Technology. The CCO has been responsible for this oversight function since the Fund's inception and has worked in the financial services industry for more than 25 years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Fund.


text: The Fund's senior management team is regularly informed regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, and/or other comparable SEC regulated investment funds and their managers, including through the receipt of notifications from service providers and reliance on communications with operations, risk management, legal, information technology, and/or compliance personnel of the Investment Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Fund are assessed on an ongoing basis, and how such risks could materially affect the Fund's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Fund has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Fund believes have materially affected, or are reasonably likely to materially affect, the Fund, including its business strategy, operational results, and financial condition.


text: Strategy and Oversight We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical studies and employees, or our information systems and the data contained therein.

companyName: Eledon Pharmaceuticals, Inc.

ticker: ELDN


text: We retain a Chief Information Consultant to collaborate with the company, including the Chief Financial Officer, and Executive Leadership Team, to help identify, assess and manage the company's cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, and evaluating threats reported to us. We also use a third-party security management vendor to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems, including, for example, incident detection and response policy, route risk assessments, data encryption, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, penetration testing, and cybersecurity insurance. As part of our information security program, we provide mandatory periodic training for all employees on how to identify potential cybersecurity risks and protect our resources and information. This training is supplemented by firmwide testing initiatives, including periodic phishing tests.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the Chief Information Consultant works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. In addition, our Chief Financial Officer evaluates material risks from cybersecurity threats and, as appropriate, reports to the Audit Committee of the Board of Directors, which evaluates our overall enterprise risk.


text: To date, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that we are aware of, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all such cybersecurity incidents or threats. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor titled " We depend on our information systems and those of our third-party collaborators, service providers, contractors or consultants, which may fail or suffer cybersecurity incidents that could result in a material disruption of our development programs or loss of data and have a material adverse effect on our reputation, business, financial condition or results of operations."


text: Our Board addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by our Chief Financial Officer who oversees the work performed by our Chief Information Consultant.


text: Our Chief Financial Officer is responsible for hiring appropriate consultants, helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our Chief Financial Officer, with support from our Chief Information Consultant, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: To date, we have not (to our knowledge) encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Report.

companyName: Tivic Health Systems, Inc.

ticker: TIVC


text: The Audit Committee receives periodic reports from our Chief Financial Officer concerning our significant cybersecurity threats and risks and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation. The Chief Financial Officer also promptly informs and updates the Board about any information security incidents that may pose significant risk to our Company.


text: The Chief Financial Officer has over 20 years of operations and leadership experience, including experience in information technology strategy and execution. The Chief Information Consultant has over 20 years of experience managing and securing technology infrastructure.


text: We recognize the importance of maintaining the trust and confidence of our patients, our collaborators, our business partners, our investors, and our employees and understand how key it is to maintain their confidence in our ability to properly protect and manage our information technology systems, infrastructure and data as part of that trust and confidence. In order to achieve this, our management team and our Board of Directors are actively involved in the oversight of our cybersecurity program as part of our approach to risk management.

companyName: BioAge Labs, Inc.

ticker: BIOA


text: Risk management and strategy We depend on the functioning, availability and security of our information systems, including financial, data processing, communications and operating systems. Several information systems, such as software applications and cloud platforms, are provided by third parties. Our cybersecurity risk framework is designed to allow us to identify, assess and manage the cybersecurity risks we face in relation to, our systems and the information we process.


text: As part of our framework, we maintain certain processes defined to assess, identify and manage risks. For example, we have an incident management and response process under which we communicate the details of certain threats and incidents to management and the audit committee of the board of directors as may be appropriate; use manual and automated processes that are designed to monitor relevant information systems for vulnerabilities, threats and incidents; manage and take certain actions designed to address incidents that may occur; and take actions designed to remediate certain vulnerabilities identified in relevant environments. We employ an array of data security technologies, processes, and methods across our infrastructure designed to protect our systems and sensitive information from unauthorized access. We work with information technology consultants who provide advice and expertise on monitoring evolving industry practices. Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, certain management executives, including our Senior Director of Information Technology and Chief Financial Officer evaluate material risks from cybersecurity threats in connection with our overall business objectives and reports such evaluations to the audit committee of the board of directors as appropriate, which then evaluates our overall enterprise risks. In addition to the third parties above, we use additional third-party service providers to perform a variety of functions throughout our business, such as enterprise and employee management platforms, labs, contract research organizations, contract manufacturing organizations, and supply chain resources. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, we take steps designed to address cybersecurity risks that such service providers may present to us, such as conducting diligence into such service providers' cybersecurity practices and risk profiles.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "We are dependent on the efficient and uninterrupted operation of our information technology systems, and those systems, or those of our third-party service providers, may be impacted by security incidents, cyberattacks, loss of data and other disruptions, which could adversely impact our business."

stage1Category: None/Other


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain management, including our Senior Director of Information Technology, who has more than two decades of information technology and information technology leadership experience. Our Senior Director of Information Technology, under the supervision of our Chief Financial Officer, manages and monitors our cybersecurity risk (including that presented by our information technology service providers). Our Senior Director of Information Technology is responsible for informing our Chief Financial Officer of relevant cybersecurity risks including, as relevant, the prevent, detection, mitigation and remediation of cybersecurity incidents. Our Chief Financial Officer has over two decades of management experience, including oversight over information technology and cybersecurity matters.


text: Our Board of Directors, with the assistance of the Audit Committee, has oversight for the cybersecurity risks facing us and for our processes designed to identify, prioritize, assess, manage, and mitigate those risks. As part of its oversight responsibilities, the Audit Committee receives periodic updates on cybersecurity and information technology matters and related risk exposures (including, as relevant, those stemming from certain cybersecurity incidents) from our Senior Director of Information Technology and Chief Financial Officer.


text: Additionally, we conduct regular internal assessments and audits, complemented by insights from external experts. The outcomes of these evaluations are communicated to senior leadership. Based on these risk assessments, we redesign, implement, and maintain adequate safeguards to reduce identified risks, address gaps, and continuously assess the efficacy of these measures. Our engagement with our key partners, vendors, customers, industry stakeholders, and government bodies is ongoing, aiming to improve our information security policies and procedures over time. We aim to diligently manage risks related to cybersecurity threats from third-party service providers, including, when possible, requesting our service providers to report incidents that may compromise the Company's data.

companyName: Aeva Technologies, Inc.

ticker: AEVA


text: Please see 1A. Risk Factors in this Form 10-K for more information regarding cybersecurity-related risks that could materially affect our business strategy, results of operations, or financial condition, including under the heading "Our business may be adversely affected by information technology disruptions".

companyName: Enpro Inc.

ticker: NPO


text: Cybersecurity Processes We have implemented various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including sensitive and confidential information (including intellectual property and tenant and property-related information) that is proprietary, strategic, or competitive in nature ("Information Systems and Data"). Our information security processes are overseen by an outsourced IT Manager, with oversight from our Chief Operating Officer, who works to help identify, assess, and manage the Company's cybersecurity threats and risks by monitoring and evaluating our threat environment using various methods. We have implemented and maintain technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including with respect to incident response, network security controls, access controls, periodic back-ups of data, and employee training addressing awareness of cybersecurity risks and how to detect certain cyberattacks. Some of these measures and processes involve the assistance of additional third-party service providers. For example, we rely on third-party service providers to assist us with our employee phishing testing and cybersecurity awareness training.

companyName: FrontView REIT, Inc.

ticker: FVR


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Company's overall risk management processes include an assessment of risks posed to data that is critical to our business operations (e.g., to support financial reporting, process payroll, and collect and maintain property and lease information).


text: Third Party Risk Management We use third-party service providers to perform a variety of functions throughout our business, including application providers and hosting companies. The Company has implemented a risk-based approach designed to help identify and mitigate cybersecurity threats associated with the use of third-party service providers, including an assessment of the security protocols of certain service providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our third-party service provider risk management process involves different levels of assessment designed to identify cybersecurity risks associated with the provider and imposes contractual obligations related to cybersecurity on the provider.


text: As of the date of this Report, we have not identified risks from cybersecurity threats, including as a result of any prior cybersecurity incident, that has materially affected us, or is reasonably likely to affect us, including our business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that we face, see our risk factors under Part 1. Item 1A. Risks Related to our Business and Properties - Security breaches and other technology disruptions could disrupt our operations, compromise our confidential information or information systems and expose us to liability, which could materially and adversely affect us.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general risk oversight function, and has delegated responsibility to the audit committee for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The audit committee reviews the processes developed by management to assess, monitor, manage, and mitigate risks from cybersecurity threats to the Company. The audit committee will review our cybersecurity processes and cybersecurity threats, and will brief the entire board of directors on these processes and threats, in each case on at least an annual basis.


text: Our cybersecurity risk assessment and management processes are overseen by our Chief Operating Officer and the IT Manager, who has worked in various roles responsible for securing networks, hardware, and other application systems. Our outsourced IT team is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.


text: Our cybersecurity incident response processes are designed to escalate cybersecurity incidents to members of management depending on the circumstances, including senior management. The Company has identified and designated a group of Company employees as members of a cybersecurity incident response team, which includes the Chief Financial Officer. This team is intended to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response process also requires reporting to the audit committee about certain cybersecurity incidents.


text: Risk Management and Strategy The Company's Information Technology team has established an information security management system to safeguard the confidentiality, integrity, and availability of the Company's products, infrastructure, and data. This system is integrated with our Quality and Business Management Systems and aims to identify, assess, and address cybersecurity risks affecting our business. It features an Incident Response Procedure ("IRP") that specifies roles and responsibilities during security incidents, detailing incident detection, investigation, mitigation, and prompt incident reporting procedures.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company.

companyName: First Seacoast Bancorp, Inc.

ticker: FSEA


text: Risks from Threats and Incidents Our IT infrastructure, encompassing operational and security systems, integrated software, and data processed by us or our third-party vendors, is vulnerable to cybersecurity threats and incidents. As of December 31, 2024, these risks have not significantly impacted the Company, including our business strategy, or operational results, or financial results. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See Part I, Item 1A. "Risk Factors" of this report for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Our Chief Technology Officer is tasked with assessing and managing significant cybersecurity risks across the Company based on the assessments of our IT Director. Our IT Director brings substantial IT and Information Security expertise from various roles in the technology industry.


text: The IT Director leads and coordinates cybersecurity efforts at Aeva, providing regular updates on cybersecurity progress to the senior leadership team. The Information Security team actively shares updates on the status of cybersecurity efforts and risks, evaluates our information security programs, and monitors the evolving threat landscape on a company-wide level.


text: The Audit Committee oversees our cybersecurity, including assessment, prevention, detection, and remediation of cyber risks, threats and incidents. When incidents occur, depending on the nature and severity, the Audit Committee is notified, and incidents are further reviewed with the Audit Committee. Material cybersecurity matters will be reviewed with the full Board of Directors.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risk across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Senior Technology/Cybersecurity Officer is primarily responsible for this cybersecurity component and is a key member of the Company's Information Technology Governance, along with our Chief Finance/Information Security Officer, including the Enterprise Risk Management Committee ("ERM"), the Information Technology Steering Committee ("ITSC") and the Information Technology Advisory Committee ("ITAC"), reporting directly to the Chief Information Officer. Our Senior Technology/Cybersecurity Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management, including 31 years of cybersecurity experience, 6 of which was spent at the Company. The ITAC and ERM are board level committees with the ITSC consisting of members of management.


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Finance/Information Security Officer and our Chief Information Officer, report directly to our Chief Executive Officer, and along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: The Company employs an in-depth, layered, defensive strategy that embraces a "secure by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a portion of our workforce has the option to work remotely. We leverage internal auditors to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan ("IRP") that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below. The IRP is coordinated through the Chief Finance/Information Security Officer, Senior Technology/Cybersecurity Officer and key members of management are embedded into the IRP by its design. The IRP facilitates coordination across multiple parts of our organization and is evaluated at least annually.


text: We leverage people, processes, and technology to manage and maintain cybersecurity controls. We employ various preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats.

companyName: ENB Financial Corp

ticker: ENBP


text: Our Chief Finance/Information Security Officer has oversight of information security across the organization, with the Senior Technology/Cybersecurity Officer independently accountable for managing our enterprise information security department and delivering our information security program. The responsibility of this role includes cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first and second line of defense functions. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Information Officer. The department consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. Our Senior Technology/Cybersecurity Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.


text: Our board of directors has approved management committees including the ITAC, which focuses on technology impact, and ERM, which focuses on business impact while the ITSC is an internal management committee providing direction and priorities to information technology strategies. These committees provide oversight and governance of the technology program and the information security program. The ITAC and ERM are chaired by certain members of the board of directors with senior management participation including the Chief Finance/Information Security Officer, Chief Information Officer, Senior Technology/Cybersecurity Officer as well as other key departmental managers from throughout the organization. These committees meet periodically to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the IRP in order to facilitate timely informing and monitoring efforts. The Senior Technology/Cybersecurity Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the ITAC on a quarterly basis (or more frequently as may be required by the IRP).


text: The ITAC is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Finance/Information Security Officer, Senior Technology/Cybersecurity Officer and our Chief Information Officer provide quarterly reports to the ITAC and ERM regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The ITAC reviews and approves our information security and technology budgets and strategies annually. Additionally, the ERM reviews our cyber security risk profile on a quarterly basis. The ITAC and ERM provide a report of their activities to the board of directors regularly.


text: We take a comprehensive approach to cybersecurity and prioritize the security and integrity of our data, including those of our residents and other stakeholders, as a top priority. Our board of directors and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant resources to implement and maintain security measures to meet regulatory requirements and stakeholder expectations, and we intend to continue to make appropriate investments to maintain the security and integrity of our data. There can be no guarantee that our established policies, standards, processes and practices will be properly followed in every instance or that they will be effective at mitigating all cybersecurity threats. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from cybersecurity threats, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business, results of operations, or financial condition.

companyName: Strategic Student & Senior Housing Trust, Inc.

ticker: STSR


text: Risk Management and Strategy Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management process and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards and best practices. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and resident information, identifying, preventing and mitigating cybersecurity threats. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our board of directors in a timely manner.


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known security vulnerabilities, and other external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and updates are presented to our board of directors and members of management, as appropriate.


text: Third-Party Risk Management We have implemented processes designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in our risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness We regularly remind employees of the importance of handling and protecting resident and employee data, including through annual certifications of our policies as well as periodic security training to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: Risk Management and Strategy As a company externally managed by the Advisor, we rely on Starwood Capital's information technology ("IT") systems, including data hosting facilities and other hardware and software platforms, some of which are hosted by third-party service providers, to assist in conducting our businesses. Starwood Capital's IT systems, like those of most companies, may be vulnerable to certain cybersecurity threats such as ransomware, interruption of services, data breaches, or any other cybersecurity incidents, or a series of related cybersecurity incidents, that could adversely impact our financial condition, results of operations, cash flows or business strategy, including our ability to operate core business functions. In the last fiscal year, Starwood Capital continually monitored the risk landscape and did not experience any cybersecurity breaches, including malware and computer virus attacks that have materially affected, or are reasonably likely to materially affect our financial condition, results of operations, cash flows, or business strategy. For more information on our cybersecurity-related risks, see Part I, "Item 1A. Risk Factors" included elsewhere in this Annual Report on Form 10-K.

companyName: Starwood Real Estate Income Trust, Inc.

ticker: SWDR


text: Starwood Capital considers cybersecurity risks, along with other top risks, within its Enterprise Risk Management ("ERM") framework. The ERM framework includes internal reporting at the business and enterprise levels, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. Starwood Capital has implemented a cybersecurity program that employs various controls and activities aimed at identifying, protecting against, detecting, and responding to cybersecurity threats. These controls and activities include hardware and software inventory tracking, endpoint protection, and network security measures to safeguard our assets from unauthorized access and attacks. Starwood Capital prioritizes data protection through access management designed to permit access only by authorized personnel. Starwood Capital's cybersecurity incident response plan, integrated into the ERM framework, outlines a structured process for handling information security incidents involving assets or data. It guides Starwood Capital's cybersecurity incident response team in containing, eradicating, and recovering from incidents while minimizing damage and disruption. The plan includes a clearly defined notification framework ensuring timely communication with business and management teams based on the incident's severity and potential impact. Additionally, Starwood Capital maintains a cybersecurity insurance policy to mitigate risks associated with cybersecurity incidents. The cybersecurity insurance policy covers both our company and other Starwood Capital affiliates.


text: Starwood Capital also periodically performs simulations and tabletop exercises at a management level and utilizes external resources and consultants, as needed. All employees of Starwood Capital are required to complete an annual computer-based Security Awareness Training Program that includes various topics on cybersecurity risk management best practices. This program educates users on how to identify information security threats and what actions should be taken in the event of a cybersecurity breach. Additionally, the employees of Starwood Capital are regularly tested with phishing campaigns reinforcing their awareness of email threats.


text: Annual risk assessments of Starwood Capital's Information Security Program are conducted to identify emerging information security and third-party risks. In addition, periodic vulnerability assessments and penetration tests are conducted throughout the year to support the identification of risks.


text: Further, Starwood Capital utilizes on-premises and cloud-based security solutions, with real-time monitoring provided by specialized managed third-party security service providers. These third parties collect events generated by critical systems in real-time, filter non-security events, and then correlate the information using security data analytical engines so that personnel of Starwood Capital can identify and analyze threats. With respect to the software platforms that are hosted by third parties, Starwood Capital utilizes an external vendor risk management platform to evaluate, rate, monitor and track vendor risk. The security practices and processes of our third-party service providers are monitored regularly. In addition, we have engaged a third-party to evaluate and review the remediation of cyber risks of our third party service providers, including financial service providers, property managers and professional service firms. For any hosted applications, Starwood Capital inquires if the vendor issues a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, Starwood Capital takes additional steps to assess its cybersecurity preparedness and assess the relationship on that basis. Starwood Capital's assessment of risks associated with the use of third party service providers is part of Starwood Capital's overall cybersecurity risk management framework.


text: Access to data on the Corporation's networks is granted only if needed for job functions. The Information Security Department approves all changes to access and critical systems are subject to annual review.


text: Our board of directors is ultimately responsible for the oversight of risks from cybersecurity threats and has delegated responsibility for such oversight of cybersecurity matters to the audit committee. The audit committee receives at least quarterly, or more frequently as needed, updates from the Advisor on our cybersecurity program, including measures taken to address cybersecurity risks and significant cybersecurity incidents.


text: Starwood Capital's Chief Technology Officer, an industry veteran that has been focused on technology for over 40 years and in technology leadership roles at financial institutions for 20 years, leads the overall cybersecurity function and is responsible for developing and implementing Starwood Capital's Information Security Program and managing our response to threats. In addition to its in-house cybersecurity capabilities, at times Starwood Capital also engages third parties to assist with assessing, identifying, and managing cybersecurity risks. Members of Starwood Capital's IT security team, including the third-party security firms utilized as part, of its program, have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification.


text: We believe cybersecurity is critical to advancing our technological advancements. As a biopharmaceutical company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: MAIA Biotechnology, Inc.

ticker: MAIA


text: Our Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our cybersecurity consultant, regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board retains oversight of cybersecurity because of its importance. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate. Our Cybersecurity consultant has extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks.


text: As a biopharmaceutical company, we must comply with extensive regulations, including requirements imposed by the Federal Drug Administration related to adequately safeguarding patient information and reporting cybersecurity incidents to the SEC. We work with our cybersecurity consultant on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. We believe we are positioned to meet the requirements of the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach.


text: We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a supplier, subcontractor or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on us. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See "Risk Factors" for a discussion of cybersecurity risks.


text: Risk Management and Strategy Daily, we are threatened by system intrusions, social engineering attempts and web application attacks. These threats and attempts are directed at payment data, employee credentials, system passwords and personal information. We have developed and implemented a risk-based framework to address them. We consider cybersecurity a top risk within our enterprise risk management protocol, which is subject to oversight by our Board of Directors.

companyName: SHOE CARNIVAL INC

ticker: SCVL


text: Our risk-based processes, as designed, seek to maintain physical, administrative and technical controls that protect the confidentiality, integrity and availability of our information systems and information stored on our network, including customer information, personal information, intellectual property and proprietary information.


text: We use the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF") as a guideline for our cybersecurity framework. This does not imply that we meet any technical standards, specifications or requirements under the NIST CSF, only that we use the NIST CSF as a framework to help us identify, assess and manage cybersecurity risks related to our business. Our policies for overall general information technology controls are also influenced by the Control Objectives for Information and Related Technologies, which align with the NIST CST.


text: Our key cybersecurity processes are organized into four primary categories: • Outage and access: these processes address system intrusion and credential and password threats and risks; • Payment and loyalty rewards: these processes protect the information of our customers; • Personal data: these processes protect the payroll and healthcare data of our current and former employees and vendor information; and • Vendor partner security: these processes review the infrastructure and security processes of vendor partners that process transactions, provide cloud-based solutions and provide the backbone for our data flow.


text: Key elements of our cybersecurity processes include, but are not limited to, the following: • Firewalls, data encryption and tokenization, multifactor authentication and data backup, among other safeguarding tactics; • Routine tests of our back up processes, the physical security of our data storage and access to systems via penetration testing; • A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • Training and testing of the diligence and awareness of our employees regarding social engineering email and other cybersecurity schemes and risks; • Engaging third-party cybersecurity companies periodically to assess our cybersecurity posture and assist with identifying and remediating cybersecurity risks; and • Contractual commitments from vendor partners and a review of controls at vendor partners via System and Organization Controls reports.


text: Our Board of Directors oversees and guides our business and oversees our exposure to major risks. As stated in its charter, our Board of Directors has delegated to the Audit Committee, which currently includes the Board members with cybersecurity acumen, the responsibility for Board-level oversight of cybersecurity risk. As part of its oversight role, the Audit Committee receives reports about our protocols, material threats or incidents and other developments related to cybersecurity.


text: These cybersecurity reports are provided to our Audit Committee at least annually, and these reports are delivered by our Senior Vice President and Chief Information Officer ("CIO"). Our CIO has over 30 years of experience with our information systems and is versed in cybersecurity frameworks and best practices. A security committee assists the CIO with developing controls, selecting vendor partners, identifying emerging threats and implementing best practices within our risk-based framework. Our security team is comprised of professionals with cybersecurity certifications and specialized training. The CIO addresses how we allocate capital resources to our cybersecurity processes with our executive leadership team, which includes our Chief Executive Officer, Chief Operating Officer, Chief Merchandising Officer and Chief Financial Officer. The CIO reports directly to our Chief Operating Officer.


text: Process to Access, Identify and Manage Material Risks from Cybersecurity Threats When a cybersecurity incident occurs or we identify a vulnerability, our CIO and our security committee, which is described in more detail under "Governance" above, are responsible for leading the initial risk assessment, and external experts may also be engaged and our Audit Committee or full Board may also be consulted. If a breach of our control structure were to occur, our executive leadership team, Audit Committee and counsel would be briefed by the CIO and a determination would be made on whether such issue is material to warrant disclosure.


text: As of February 1, 2025, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, cash flow or financial condition.


text: Even with our current control processes and a continuous improvement mindset, cybersecurity threats constantly evolve. If the measures we have employed were to fail, or if a breach were to occur, it could result in impairment or loss of critical functions, such as the operation of our e-commerce websites, our Evansville distribution center, our corporate network and/or our point-of-sale systems, as examples. Additionally, confidential information could be compromised, or we could be defrauded or ransomed for a material amount of funds. Any of these outcomes could negatively affect our reputation and customer loyalty. The ultimate effects of a breach or loss in function or confidential information are difficult to quantify with any certainty, but such loss may be partially limited through insurance. See "Risk Factors—We could be adversely affected if our information technology systems fail to operate effectively, are disrupted or are compromised", "—Various risks associated with our e-commerce platform may adversely affect our business and results of operations" and "—We outsource certain business processes to third-party vendors and have certain business relationships that subject us to risks, including disruptions to our business and increased costs" in PART I, ITEM 1A of this Annual Report on Form 10-K, which risk factors are incorporated by reference into this section of this Annual Report on Form 10-K.


text: We recognize the importance of developing, implementing and maintaining cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity and availability of our data.

companyName: KinderCare Learning Companies, Inc.

ticker: KLC


text: Risk management and strategy In the ordinary course of our business, we and our third-party service providers collect, maintain and transmit sensitive data on our networks and systems, including confidential business information such as child, parent and employee personal information. The secure maintenance of this information is critical to our business and reputation. In addition, we are heavily dependent on the functioning of our information technology infrastructure to carry out our business processes. While we have adopted administrative, technical and physical safeguards to protect such systems and data, our systems and those of third-party service providers may be vulnerable to a cyber-attack.


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include frameworks to respond to and assess internal and external threats to the security, confidentiality, and integrity of our data and information systems, along with other material risks to our operations, which we review with our IT leadership, information security steering committee, and Audit Committee at least twice annually or whenever there are material changes to our systems or operations.


text: Our IT department is tasked with evaluating and addressing cybersecurity risks in alignment with our business objectives and operational needs. We have processes to detect potential vulnerabilities and anomalies through technical safeguards. As part of our risk management process, we conduct regular IT security audits to assess and respond to internal and external security threats and engage outside providers to conduct periodic internal and external penetration testing.


text: We rely on third parties, including cloud vendors and consultants, for various business functions. Many of our third-party service providers have access to our information systems and data, and we rely on such third parties for the continuous operation of our business operations. We oversee third-party service providers by conducting vendor diligence. Vendors are generally assessed for risk based on the nature of their service, access to data and systems and supply chain risk and, based on that assessment, we conduct diligence that may include completing security questionnaires, onsite evaluation, and scans or other technical evaluations.


text: Our Board of Directors has established oversight mechanisms to manage risks from cybersecurity threats. Our Audit Committee has primary responsibility for oversight of cybersecurity, including the responsibility to review and discuss with management and the Company's auditors, as appropriate, management risks relating to data privacy, technology and information security, including cyber security and back-up of information systems, and the steps the Company has taken to monitor and control such exposures and the responsibility to confer with management and the Company's auditors the adequacy and effectiveness of the Company's information and cyber security policies and the internal controls regarding information security. The Audit Committee, or the Board of Directors as a whole, is briefed on any material cybersecurity incidents that may adversely affect the Company and on cybersecurity risks in general at least twice each year.


text: At the management level, our cybersecurity program is managed by our Head of Information Security & Compliance who reports to our Chief Information Officer. Our Head of Information Security & Compliance has over 30 years of IT security experience.


text: Our Head of Information Security & Compliance and IT Department implement processes around security monitoring and vulnerability testing. Our Head of Information Security & Compliance reports at least twice annually to the Audit Committee and such reporting will include topics such as our risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses and recommendations for changes and updates to policies and procedures.


text: Although we have experienced cybersecurity incidents in the past, as of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm or damage to our Company, loss of intellectual property rights, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "We rely significantly on the use of information technology, as well as those of our third-party service providers. Any significant failure, inadequacy, interruption or data security incident of our information technology systems, or those of our third-party service providers, could disrupt our business operations, which could have a material adverse effect on our business, prospects, results of operations, financial condition and/ or cash flows." under Item 1A. Risk Factors.


text: Risk management and strategy Due to the size of our company, we have not yet developed robust policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We have implemented access controls with respect to our systems, which we monitor regularly and audit annually. We currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems, including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. We rely on third party providers and outsourced IT services to monitor and address cybersecurity related risks, including installing software for threat protection and malware. Such third party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our board of directors to discuss if deemed necessary or appropriate. Based on the results of our risk assessments, if deemed necessary or appropriate, we take steps to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.


text: Our management team is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from third-party service providers. Management oversees our cybersecurity process on a day-to-day basis, including those described in "Risk Management and Strategy" above.


text: Our audit and risk committee is tasked with general oversight of our risk management process, including risks from cybersecurity threats. Members of management provide periodic briefings to the audit and risk committee of our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In furtherance thereof, the committee is responsible for monitoring and assessing strategic risk exposure. Our audit and risk committee provides regular updates to the board of directors on such reports.


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. We use people, process, and technology controls to manage and mitigate cybersecurity risk. Our Chief Operations Officer is primarily responsible for this cybersecurity component and is a key member of the Information Technology ("IT") Committee, reporting directly to the Chief Executive Officer and, as discussed below, periodically to the board of directors. Our Chief Operations Officer has more than 15 years with the Company.

companyName: Affinity Bancshares, Inc.

ticker: AFBI


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Operations Officer along with members of the IT Committee, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: In many instances we rely on third-party providers to facilitate providing products and services to our customers. As a part of our overall cybersecurity risk management framework and, in addition to assessing our own cybersecurity preparedness, we also have a process in place to manage cybersecurity risks associated with third-party service providers. To help mitigate adverse impacts from a cybersecurity incident, we assess third-party vendors as a part of our vendor onboarding and continued due diligence which includes processes to assess information security posture. Depending upon the level of perceived security risk, we may impose security requirements upon a supplier, including: maintaining an effective security management program; abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident. We periodically conduct (or engage a third party to conduct) reviews of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of hosted applications, depending upon the level of risk, are required to provide a report as to their controls (e.g., a System and Organization Controls (SOC) 2 or ISO 27001 (Information and Security Certification) or similar report).


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the Board. The Incident Response Plan is coordinated through the Chief Operations Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated and tested at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company.


text: Our board of directors has established the IT Committee, which focuses on technology impact on all aspects of the bank. The IT Committee provides oversight and governance of the technology program including the information security program. The IT Committee includes the Chief Operations Officer and key departmental managers from throughout the entire company. The IT Committee generally meets monthly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Chief Operations Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the IT Committee on a monthly basis (or more frequently as may be required by the Incident Response Plan).


text: The board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Operations Officer provides monthly reports to our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The board of directors reviews and approves our information security and technology budgets and strategies annually.


text: Risk Management and Strategy The Company's cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats. The Company's business depends on the communications and information technology systems that it shares with Man Group, which has a majority interest in Varagon, the parent company of the Adviser. The Company also relies on the cybersecurity policies and procedures implemented by Man Group. Man Group has processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of controls, processes, systems, and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our data. Pursuant to Man Group's Information Security Policy (the "Information Security Policy") and Man Group Cybersecurity Policy ("the "Cybersecurity Policy"), the Man Group's Information Security team and the Chief Information Security Officer ('the "CISO") are responsible for the ongoing and regular monitoring of the Information Security Policy and the Cybersecurity Policy to ensure that they are operating in a manner reasonably calculated to prevent unauthorized access to, or unauthorized use of, non-public information. Man Group has engaged and may engage, from time to time, assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks, subject to the continued oversight of Man Group.

companyName: Varagon Capital Corp


text: The CISO and man Group's Information Security team are responsible for identifying and assessing reasonably foreseeable internal and external risks to the security, confidentiality, and/or integrity of any electronic, paper, or other records containing non-public information, and evaluating and improving, where necessary, the effectiveness of the current safeguards for limiting such risks, including those pertaining to the Company. Additionally, Man Group uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, Man Group also maintains a cyber incident response plan that provides guidance for assessing cybersecurity incidents and is utilized when cybersecurity incidents impacting the Company or the Adviser are detected. Man Group also requires that all employees, including employees of the Adviser, complete periodic information security training, including new hire training, regular compliance training, and periodic informal training pertaining on specific areas of concern.


text: Material Impact of Cybersecurity Risks As of the date of this Annual Report on Form 10-K, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, future incidents could have a material impact on its business. Additional information about cybersecurity risks the Company faces is described in Item 1A of Part I, "Risk Factors," under the heading "Cybersecurity Risks," which should be read in conjunction with the information above.


text: The Company's cybersecurity risks and associated mitigations are evaluated by the Company's management and the CISO periodically, but no less frequently than annually. Management and representatives of Varagon and Man Group periodically report to the Board on information security and cybersecurity matters. Reports include, among other things, the overall state of the Company's cybersecurity program, information on the current threat landscape, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of material cybersecurity risks to the Company.


text: Cybersecurity Risk Management and Strategy As an externally managed REIT, the Company's risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Adviser, an indirect subsidiary of Apollo. Apollo determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for the Company and other affiliated entities managed by Apollo, and the Company relies on Apollo for assessing, identifying and managing material risks to the Company's business from cybersecurity threats.

companyName: Apollo Realty Income Solutions, Inc.


text: Risk Management and Strategy. The General Partner has written plans, procedures and policies that govern the Partnership's general information security program. The General Partner has a Risk and Control Self-Assessment ("RCSA") framework to help identify, measure, monitor and report important operational risks faced by the General Partner. Man Group has a Cyber Incident Response Plan ("CIRP") which dictates how the Partnership reviews and responds to security alerts, events and incidents. Pursuant to the written incident response plan, in the event of a cybersecurity incident, the security team first identifies the incident, triages, and responds. The General Partner's compliance team is also notified of the cybersecurity incident and, in conjunction with the legal team, assists in incident remediation and determining the materiality. As applicable, RCSAs are filed with the General Partner's operational risk team in order to keep the General Partner informed on cyber risks. Ultimately, an aggregate response to a cyber incident is reported to Man Group's risk committees, creating awareness and consideration of the top risks and overall levels of risk exposure.

companyName: MAN AHL DIVERSIFIED I LP

ticker: MADL


text: The operational risk team also has service provider monitoring in place in order to oversee and identify cybersecurity threats associated with the Partnership's use of third-party service providers. Prior to onboarding, the Partnership conducts due diligence for key new third-party services providers. This involves a diligence questionnaire sent by a cybersecurity training company that is then reviewed by the Partnership. The training company also assess the Partnership's security status during onboarding for services providers and, for critical suppliers, at regular intervals throughout the life of the supplier's contract.


text: The Audit and Risk Committee ("ARCom") of the board of directors of the General Partner's parent entity, (the "Board") is responsible for risk governance and management frameworks, determining risk strategy and ensuring that risk is monitored and controlled effectively. The risk management framework requires that the Partnership operates within acceptable risk tolerances, while risk governance provides a foundation for potential oversight in an evolving cyber environment. The ARCom meets quarterly to discuss cybersecurity risks and events and reports its findings to the Board. The chief information security officer presents to the ARCom quarterly, including providing incident reports for potentially material security incidents, and all Board members have the opportunity to ask questions. The full Board also discusses cybersecurity risks and events quarterly.


text: The General Partner uses both internal and external auditors for cybersecurity services. The General Partner maintains an Information Security Steering Committee chaired by Man Group's chief information security officer ("CISO") and which contains, among other members, Man Group's chief technology officer ("CTO"). The CISO is a Certified Information Systems Security Professional ("CISSP") and has over a decade of experience in the fields of technology and security. The General Partner utilizes a Security Operations Center ("SOC") model and annual reports to prevent, detect, and respond to cybersecurity incidents. The General Partner has regular cybersecurity audits conducted by KPMG. Further, the General Partner contracts third parties to perform quarterly phishing testing, annual penetration tests, and a bi-annual red team exercise. These exercises consist of virtual simulations of cybersecurity incidents in order to test the effectiveness of the General Partner's cybersecurity protection program. The exercises also help prepare the General Partner and Partnership to sufficiently respond in the instance of cybersecurity incidents. The General Partner also has a dedicated compliance function that focuses on the General Partner's international operations in order to comply with international cybersecurity laws. The General Partner uses these processes as well as the RCSA and CIRP to stay informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Employees are required to complete annual cybersecurity training. The training is updated periodically in order to stay up to date with current laws and was last updated in the fourth quarter of 2023. The General Partner models risks, including security risks, and allocates risk capital accordingly, and does not carry cyber insurance.


text: In the past, the Partnership has experienced actual and attempted cybersecurity events and incidents. While prior incidents have not materially affected the General Partner's or the Partnership's business strategy, results of operations or financial condition, and although the General Partner's processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cyber incident would not materially affect the General Partner's or the Partnership's business strategy, results of operations or financial condition. To date, the General Partner has not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the General Partner, the Partnership, the General Partner's business strategy, the Partnership's results of operation or the Partnership's financial conditions.


text: Breaches in Information Technology Security. The General Partner and the Trading Advisor maintain information technology systems, consisting of infrastructure, applications and communications networks to support the Partnership as well as its own business activities. These systems could be subject to security breaches such as 'cyber-crime' resulting in theft, a disruption in the Trading Advisor's ability to close out positions and the disclosure or corruption of sensitive and confidential information. Security breaches may also result in misappropriation of assets and could create significant financial and/or legal exposure for the Partnership. The General Partner and the Trading Advisor seek to mitigate attacks on their own systems but will not be able to control directly the risks to third-party systems to which it may connect. Any breach in security of the General Partner's or the Trading Advisor's systems could have a material adverse effect on the General Partner or the Trading Advisor and may cause the Partnership to suffer, among other things, financial loss, the disruption of its business, liability to third parties, regulatory intervention or reputational damage.


text: The Apollo Global Management, Inc. ("AGM") board of directors is involved in overseeing Apollo's risk management program, including with respect to cybersecurity, which is a critical component of Apollo's overall approach to enterprise risk management ("ERM"). Apollo's cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based, in part, on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas: • Governance: As discussed further under the heading "Cybersecurity Governance," the AGM board of directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer ("CISO") and the CISO of Athene Holding Ltd. ("AHL"), a subsidiary of AGM, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, as well as, as appropriate, with the Company's executive officers and other representatives of the Adviser and its affiliates. • Collaborative Approach: Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with the Company's management and its board of directors, as applicable, in a timely manner. • Technical Safeguards: Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as the Company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.


text: Apollo engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. Apollo regularly engages third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to Apollo's risk management function, and Apollo adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Cybersecurity threat risks have not materially affected the Company, including its business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Organizational Structure—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, a misappropriation of funds, and/or damage to our business relationships, all of which could negatively impact our financial results."