text: The MSP conducts ongoing cybersecurity training to ensure all employees are aware of cybersecurity risks and performs periodic phishing simulation testing for increased cyber resilience. Annually, the MSP conducts penetration testing to assess cybersecurity measures and to review the information security control environment and operating effectiveness. In addition, our advisor evaluates key third-party service providers before granting the service provider access to its information systems and has a process in place to ensure that future access is appropriate. Our assessment of risks associated with the use of third-party providers is part of the advisor's overall cybersecurity risk management framework. For any software platforms that are hosted by third parties, our advisor confirms the vendor maintains a System and Organization Controls ("SOC") 1 report. While we have control, through our contract with the MSP, over our information systems, we do not have control over the information systems of third parties who provide services, and in particular certain property management services, at our commercial real estate properties. Although we confirm third party software platforms maintain a SOC 1 report, we rely on third parties for managing their cybersecurity risk. Our advisor maintains third-party cyber insurance and upon identification of a significant cyber incident, our advisor would notify its cyber insurance carrier and engage a third-party cyber forensic analysis vendor to assist in investigating and remediating the incident.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms (including legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software and managed service providers, penetration testing firms, and dark web monitoring services.

companyName: CASTLE BIOSCIENCES INC

ticker: CSTL

secItem: Item 1C


text: acknowledge the increasing importance of cybersecurity in today's digital and interconnected world. Cybersecurity threats pose significant risks to the integrity of our systems and data, potentially impacting our business operations, financial condition and reputation.

companyName: INNO HOLDINGS INC.

ticker: INHD


text: As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, our business is highly dependent on our ability to collect, use, store and manage organizational and property data. If any of our significant information and data management systems do not operate properly or are disabled, we could suffer a material disruption of our business or managing real estate, liability to tenants, loss of tenant or other sensitive data, regulatory intervention, breach of confidentiality or other contract provisions, or reputational damage. These systems may fail to operate properly or become disabled as a result of events wholly or partially beyond our control, including disruptions of electrical or communications services, natural disasters, political instability, terrorist attacks, sabotage, computer viruses, deliberate attempts to disrupt our computer systems through "hacking," "phishing," or other forms of both deliberate or unintentional cyber-attack, or our inability to occupy our office location. As our advisor has elected to outsource our information technology functions to third-party providers, we bear the risk of having less direct control over the security and performance of those systems.

companyName: Strategic Realty Trust, Inc.

stage1Category: Strategy Integration

stage1Method: majority


text: As part of its responsibilities pursuant to our corporate governance guidelines, our board of directors oversees our policies with respect to risk assessment and risk management, including with respect to cybersecurity risks. The board of directors administers its risk oversight function by receiving regular reports from our executive officers on areas of material risk to us, which reports include any updates regarding cybersecurity incidents or other developments.

stage1Category: Board Governance

stage1Method: unanimous


text: As discussed above, we engage the MSP to assist us with the identification, monitoring and management of cybersecurity risks and rely on the expertise and knowledge of the MSP with respect to supporting our information technology network. The MPS reports periodically to our management team as necessary, including our Chief Executive Officer and Chief Financial Officer. These senior executive officers then brief our board of directors on security matters as required and no less frequently than annually. Our Chief Financial Officer, together with our advisor's Director of Human Resource is responsible for managing our cybersecurity risk and developing mitigation strategies and implementing controls to reduce the likelihood of a cybersecurity incident occurring and to reduce the impact of such an incident should this occur.

stage1Category: Risk Management Process


text: We are increasingly dependent on sophisticated software applications and computing infrastructure to conduct key operations. We depend on both our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: Arbutus Biopharma Corp

ticker: ABUS


text: Cybersecurity Program Given the importance of cybersecurity to our business, we maintain a robust and comprehensive cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of administrative, physical and technical safeguards, with regular evaluations of our cybersecurity posture, including internal and external audits, as well as annual penetration tests. We also require cybersecurity training when onboarding new employees and contractors and on an annual basis thereafter. Our cybersecurity program leverages industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Risk Assessment Framework to strengthen our program effectiveness and reduce cybersecurity risks.


text: We use a risk-based approach with respect to our oversight of third-party service providers. As part of our new vendor onboarding process, we assess all new third-party service providers for technical capabilities, reputation, financial stability, pricing, and other criteria and all new third-party service providers are reviewed and approved by our Finance and Legal departments. Foreign vendors are evaluated separately for compliance with the Foreign Corrupt Practices Act. Our contracts with third-party service provides include appropriate data security and privacy terms. For certain key third-party service providers, we obtain a SOC type 2 audit report from the vendor's audit firm which provides detailed information and assurance about a service organization's security, availability, processing integrity, confidentiality and privacy controls, in accordance with Statement on Standards for Attestation Engagements No. 18.

stage1Category: Third-Party Risk


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain a regularly tested Incident Management and Response program as well as business continuity and disaster recovery plans. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat and handling it in accordance with that severity level. We have relationships with a number of third-party service providers to assist with cybersecurity evaluation, containment and remediation efforts.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Executive Director of IT and Information Security (ED, IT & IS), who reports to our Chief Financial Officer. Our ED, IT & IS has over 30 years of IT experience and an Advanced Graduate Certification in Cybersecurity. He is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. He provides regular briefings (quarterly at a minimum) to our Computer Security Incident Response Team consisting of the Chief Financial Officer and General Counsel/Chief Compliance Officer on cybersecurity matters, including threats, events, and program enhancements.

stage1Category: Management Role


text: While the Board of Directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, discussing with management, and overseeing our data privacy, information technology and security and cybersecurity risk exposures. On at least an annual basis, the ED, IT & IS reports to the Audit Committee on information security and cybersecurity matters, including significant information technology risks, material threats (and the potential impact of those exposures on our business, financial results, operations and reputation) and the steps implemented by management to monitor and mitigate exposures. He also apprises the Audit Committee promptly of any high priority cybersecurity incidents, consistent with our Incident Management and Response Policy, and provides updates to the full Board as needed.


text: Cybersecurity Risks Management assesses the top organizational risks for the Company on an annual basis. Our cybersecurity risk is a component of our overall organizational risk assessment. Management also performs a specific cybersecurity risk assessment based on the NIST cybersecurity risk framework. As part of our cybersecurity risk assessment, department leaders identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. Department leaders are asked to consider the severity and likelihood of certain risk factors, drawing upon their company knowledge and past business experience. Our cybersecurity risk assessment helps to inform our risk mitigation strategies. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors."


text: We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our own systems, networks, and technology or the systems, networks and technology of our contractors, consultants, vendors and other business partners. In the last three years, we did not experience any material cybersecurity incidents or threats.


text: Cybersecurity Program Given the importance of cybersecurity to our business, we maintain a robust and comprehensive cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of administrative, physical and technical safeguards, with regular evaluations of our cybersecurity posture, including internal and external audits, as well as annual penetration tests. We also require cybersecurity training when onboarding new employees and contractors and on an annual basis thereafter. Our cybersecurity program leverages industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework to strengthen our program effectiveness and reduce cybersecurity risks.


text: We use a risk-based approach with respect to our oversight of third-party service providers. As part of our process for onboarding new vendors, we assess new third-party service providers for technical capabilities, reputation, financial stability, pricing, and other criteria and such third-party service providers are reviewed and approved by our Finance and Legal departments. We have implemented processes to confirm that agreements with third-parties contain data security and privacy terms as appropriate. For certain key third-party service providers, we obtain a SOC type 2 audit report from the vendor's audit firm which provides detailed information and assurance about a service organization's security, availability, processing integrity, confidentiality and privacy controls.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We utilize various risk management guides, as well as the protocols of certain certifications as described below to identify, assess, and manage cybersecurity risks relevant to our business through our risk management program. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Teads Holding Co.

ticker: TEAD


text: While our Board of Directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, discussing with management, and overseeing our data privacy, information technology and security and cybersecurity risk exposures. On at least an annual basis, the ED, IT & IS reports to the Audit Committee on information security and cybersecurity matters, including significant information technology risks, significant threats (and the potential impact of those exposures on our business, financial results, operations and reputation) and the steps implemented by management to monitor and mitigate exposures. He also apprises the Audit Committee promptly of high priority cybersecurity incidents, consistent with our Incident Management and Response Policy, and provides updates to the full Board as needed.


text: We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our own systems, networks, and technology or the systems, networks and technology of our contractors, consultants, vendors and other business partners.


text: As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected our business strategy, results of operations or financial condition or are reasonably likely to have such a material effect.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and commercial and pipeline tests ("Information Systems and Data").


text: Our Director of Cyber Security & Infrastructure ("DCSI") oversees our information security function, which in conjunction with our security and engineering operations, Security Operations Center, a third-party managed security provider, helps identify, assess and manage the Company's cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example: manual and automated tools; subscribing to and analyzing reports of cybersecurity threats and threat actors; conducing scans of our environment; evaluating our and our industry's risk profile and threats reported to us; coordinating with law enforcement concerning certain threats; conducting internal and external audits and threat assessments; conducting vulnerability assessments; using external intelligence feeds; and working with a third-party test our incident response processes.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response and business continuity plan; vulnerability management policy; risk assessments; implementing certain certifications and security standards; encrypting certain of our data; network security controls; segregating certain data; access and physical security controls; asset management, tracking, and disposal; monitoring our systems; employee training; penetration tests; maintaining cybersecurity insurance; and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program; our information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which is primarily responsible for overseeing our risk management processes on behalf of our board of directors.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms (including legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software and managed service providers, penetration testing firms, and dark web monitoring services.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have vendor management processes to manage cybersecurity risks associated with our use of certain providers. These processes may include reviewing vendors' written security programs and security assessments, conducting security assessment calls with vendor personnel, and imposing contractual obligations related to information security on certain of our vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems, or those of third parties upon which we rely, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."

stage1Category: None/Other


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee oversees the risk assessment, risk management and internal controls over cyber security matters, as outlined in its committee charter.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our DCSI. Our DCSI has over 20 years of experience as a security professional, has a CISSP certification, and has completed the Carnegie Melon Insider Risk Management Program.


text: The DCSI is responsible for hiring appropriate personnel, leading enterprise-wide cybersecurity strategy, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Security Management. Security Management work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The DCSI provides periodic reports to our board of directors, as well as our Chief Operating Officer, Chief Executive Officer and other members of our senior management as appropriate, concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our Director of Cyber Security & Infrastructure ("DCSI") oversees our information security function, which in conjunction with our security and engineering operations, Security Operations Center, a third-party managed security provider, helps identify, assess and manage the Company's cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example: manual and automated tools; subscribing to and analyzing certain reports of cybersecurity threats and threat actors; conducing scans of our environment; evaluating our and our industry's risk profile and certain threats reported to us; coordinating with law enforcement concerning certain threats; conducting internal and external audits and threat assessments; conducting vulnerability assessments; using external intelligence feeds; and working with a third-party to test our incident response processes.


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, incident response personnel, and senior management;

companyName: BioXcel Therapeutics, Inc.

ticker: BTAI


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems, or those of third parties with whom we work, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Security Management. Security Management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The DCSI provides periodic reports to our board of directors, as well as our Chief Operating Officer, Chief Executive Officer and other members of our senior management as appropriate, concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation, and assessment of our cybersecurity program against programs of other organizations.


text: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. Our board of directors is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM").

companyName: TWILIO INC

ticker: TWLO


text: Risk Management and Strategy We have policies, standards, processes and practices for assessing, identifying, and managing material risk from cybersecurity threats that are integrated into our ERM systems and processes. Our cross-functional approach to cybersecurity risk management is focused on preserving the confidentiality, integrity, and availability of our information systems by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. As part of this approach, we have implemented controls and procedures that provide for the prompt escalation of certain cybersecurity incidents to enable timely decisions by management regarding the public disclosure and reporting of such incidents.


text: Our cybersecurity program is focused on the following key areas: • Governance. As discussed in more detail under the heading "Governance" below, our board of directors' oversight of cybersecurity risk is supported by our audit committee, which regularly interacts with our ERM function, our Chief Digital Officer ("CDO"), our Chief Information Security Officer ("CISO"), other members of management, and relevant committees and working groups, including management's Enterprise Risk Committee ("ERC"), Cyber Incident Task Force ("CITF"), and Security Incident Response Team ("SIRT"), in its oversight of cybersecurity-related risk. • Risk Assessment. We devote significant resources and designate high-level personnel, including our ERC, which includes our Chief Legal Officer ("CLO"), our CDO, our CISO, our Vice President of Internal Audit, and our Vice President of Ethics, Compliance and Risk Management, to manage the cybersecurity risk assessment and mitigation process. We conduct security assessments both internally and with the assistance of third parties to identify cybersecurity threats periodically and to identify any potentially material changes in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These security assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential impact of such risks, and the sufficiency and effectiveness of existing policies, procedures, systems, and controls to manage such risks. Risk themes identified during our risk assessments guide annual cybersecurity planning activities and investments to improve security coverage, technology capabilities and processes. • Technical Safeguards. We deploy, maintain, and regularly monitor the effectiveness of technical safeguards that are designed to protect our information systems from cybersecurity threats. We align our security program to recognized frameworks and industry standards. We make investments in core security capabilities, including awareness and training, identity and access, incident response, product security, cloud security, enterprise security, risk management, and supply chain risk, in order to enable us to better identify, protect, detect, respond to, and recover from evolving security threats. Our technical safeguards include firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through internal and external security assessments and cybersecurity threat intelligence. We regularly assess our safeguards through internal testing by our assurance teams. We also leverage external third-party testing (e.g., penetration testing, attack surface mapping, and security maturity assessments) and seek third-party certifications (e.g., SOC2, ISO, and PCI DSS). Following our risk assessments, we evaluate whether and/or how to re-design and/or enhance our safeguards to reasonably address any identified risks or gaps. • Incident Response and Recovery Planning. We have established comprehensive incident response and recovery plans that address the full lifecycle of our response to a cybersecurity incident. These plans are periodically tested and evaluated.


text: Our CDO has over 25 years of experience at technology companies and has been in the security space for over 18 years, including serving as chief security officer at a public company and leading security engineering at another public company. Our CDO also serves on the board of directors of a publicly traded cybersecurity company. Our CDO holds an undergraduate degree in electronics engineering and a graduate degree in business administration and management. Our CISO has over 18 years of experience managing cybersecurity risks in the technology industry, including serving as the acting chief security officer at a public company and holding other senior cybersecurity leadership and operational roles at other companies. Our CISO holds an undergraduate degree in computer engineering and graduate degrees in electrical engineering and business administration. Our CFO, CLO, VP of Internal Audit, and VP of Ethics, Compliance and Risk Management each hold undergraduate and/or graduate degrees in their respective fields, and have over 10 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: • Third-Party Risk Management. We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We perform due diligence on vendors, service providers and other third-party users of our systems at initial onboarding and periodically thereafter. We require that third-party service providers have the ability to implement and maintain reasonable and appropriate security measures, consistent with applicable laws, in connection with their work with us, and to promptly report any actual or suspected breach of their security measures that may affect our company. • Security Awareness and Training. Our security awareness program requires that employees and certain contractors complete comprehensive security training upon joining the company and annually thereafter. The training covers critical security topics to ensure our workforce stays informed about top-of-mind security areas, such as phishing. The training helps ensure that our personnel have the knowledge and skills required to protect our digital assets and critical data. In addition, we conduct awareness campaigns on cybersecurity threats as a means to equip our personnel with effective tools to address such threats and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in the periodic assessment and testing of our cybersecurity policies, standards, processes and practices, including through audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. To assist with such assessment and testing, we engage assessors, consultants, auditors, and other third parties to perform assessments on our cybersecurity measures, including for third-party testing and certifications (as described above under "Technical Safeguards"), information security maturity assessments, customer audits, and independent reviews of our information security control environment and operating effectiveness. The material results of such assessments, audits and reviews are reported to our audit committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our company, including our business strategy, results of operations, or financial condition. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect our company in the future, including our business strategy, results of operations, or financial condition, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: Our board of directors, in coordination with our audit committee, oversees our ERM process, including the management of cybersecurity risks, and is responsible for monitoring and assessing strategic risk exposure. Our management team and its committees, including our ERC, our CITF, our SIRT, and our core information security operational teams, in partnership with our engineering teams, are responsible for the day-to-day management and mitigation of the material cybersecurity risks we face.


text: Our board of directors administers its cybersecurity risk oversight function through our audit committee. Our audit committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties, and risks relating to cybersecurity incidents. Our board of directors receives quarterly updates from our audit committee on ERM and cybersecurity risks.


text: Our ERC, comprised of our CLO, our CDO, our CISO, our Vice President of Internal Audit, and our Vice President of Ethics, Compliance and Risk Management, among others, oversees our ERM activities, including cybersecurity-related risks. Our CDO and our CISO (who reports to our CDO) are primarily responsible for the assessment and management of our material risks from cybersecurity threats, working collaboratively and cross-functionally to design and implement our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above, and for responding to any cybersecurity incidents. In addition, our CITF (which includes our CDO, our CISO, our CLO, and our Chief Financial Officer ("CFO")) is primarily responsible for evaluating cybersecurity incidents, gathering and assessing facts relevant to applicable regulatory reporting and disclosure obligations, making recommendations to our Chief Executive Officer and CFO regarding such disclosure, and advising our board of directors and audit committee on the effectiveness of policies and procedures related to the disclosure of cybersecurity incidents.


text: To facilitate our cybersecurity risk management program, multidisciplinary teams throughout our company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, our CDO, our CISO, and the SIRT monitor the detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the CITF when appropriate.


text: All employees and contractors are required to receive annual cybersecurity awareness training. New hires also receive training in response to drills and simulated attacks. We perform cybersecurity quarterly exercises to test the effectiveness of our training and discuss "lessons learned" with management to enhance user awareness and increase users' responses.

companyName: CSI Compressco LP


text: As with all institutions involved in financial services, information security represents a significant operational risk. To mitigate this risk, we have developed and manage a comprehensive information security program dedicated to protecting data entrusted to us by our clients as well as our own proprietary corporate information and the information technology infrastructure we use to process this data and information. Our approach is considered to be a defense-in-depth strategy, with multiple tiers of security controls and monitoring. Our security program is benchmarked against the National Institute of Standards and Technology Cybersecurity Framework ("NIST"), including, among other things, with respect to application security, vulnerability management and data protection, threat detection and incident response.

companyName: Essent Group Ltd.

ticker: ESNT


text: Cybersecurity risk management is the direct responsibility of our IT security team, which is led by our chief information officer ("CIO") and our chief information security officer ("CISO"). The IT security team develops, maintains, and enforces our information security program and information security policies, which are reviewed at least annually and are subject to approval by our information security committee. Additionally, we complete the following: • an annual enterprise risk assessment; • an annual threat and vulnerability assessment conducted in accordance with NIST guidance which considers adversarial and non-adversarial threat events that could impact our environment; • periodic IT risk assessments; • quarterly vulnerability management reviews; and • periodic cloud risk assessments.


text: Our IT security team regularly monitors the company's technology environment to address and investigate potential incidents. In the event of an incident, we would follow our internally developed incident response playbook, which includes but is not limited to guidelines for determining the severity of an incident, roles and responsibilities of the cyber response team, mitigation and recovery steps, and communication to internal and external stakeholders based upon nature and extent of the incident. We conduct regular external and internal penetration testing, "red teaming" exercises to seek to identify and remediate potential vulnerabilities, and other methods to ensure the readiness and effectiveness of our program and to continue to enhance our security posture. Our information security team also performs periodic tabletop exercises to simulate potential incidents in order to identify potential enhancements to monitoring and our incident response process.


text: We have also established a formal third party risk management (TPRM) policy which defines the criteria that a third party service provider must meet in order to be considered by us. All vendors are risk ranked and reviewed by our TPRM team with results reported to our information security committee, which ultimately approves the use of new and existing vendors. In addition, we maintain an internal information security committee comprised of cross-departmental company executives and IT leaders to ensure that we maintain strong governance mechanisms and to ensure compliance with our security policies and procedures. During the year ended December 31, 2023, we did not experience any material cybersecurity incidents.


text: Although our information security program is designed to attempt to prevent, detect and respond to unauthorized use or disclosure of confidential information, including non-public personal information, there can be no assurance that such use or disclosure will not occur. See "Risk Factors—Risks Relating to the Operation of Our Business—The security of our information technology systems may be compromised and confidential information, including non-public personal information that we maintain, could be improperly disclosed."


text: Cybersecurity Governance Our board of directors, led by the board's technology, innovation and operations committee, actively oversees our information security program, with our management providing that committee with regular updates (including at each of the four meetings held by that committee in 2023) and reporting on our IT strategy, including information security strategies and initiatives, event preparedness and incremental improvement efforts.


text: The CIO and CISO, who oversee our information security program, are well qualified to oversee and manage risks posed by potential cybersecurity threats. Our CIO has over 25 years of experience serving Fortune 500 companies in the area of information technology, including nearly 20 years in mortgage and financial services, with roles ranging from overseeing application development and delivery to enhance risk management capability and improve operational efficiency to information technology strategy, architecture, delivery, and management. Similarly, our CISO has over 25 years of experience working for financial services companies in information technology, including roles overseeing e-commerce, technical infrastructure management and architecture, and 20 years overseeing information security programs.


text: Cybersecurity Risk Management and Strategy As with all institutions involved in the provision of financial services, information security represents a significant operational risk. To mitigate this risk, we have developed and manage a comprehensive information security program dedicated to protecting data entrusted to us by our clients as well as our own proprietary corporate information and the information technology infrastructure we use to process this data and information. Our approach is considered to be a defense-in-depth strategy, with multiple tiers of security controls and monitoring. Our security program is benchmarked against the National Institute of Standards and Technology Cybersecurity Framework (NIST), including, among other things, with respect to application security, vulnerability management and data protection, threat detection and incident response.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: American Assets Trust, Inc.

ticker: AAT


text: Cybersecurity risk management is the direct responsibility of our IT security team, which is led by our chief information officer (CIO) and our chief information security officer (CISO). The IT security team develops, maintains, and enforces our information security program and information security policies, which are reviewed at least annually and are subject to approval by our information security committee. Additionally, we complete the following: • an annual enterprise risk assessment; • an annual threat and vulnerability assessment conducted in accordance with NIST guidance which considers adversarial and non-adversarial threat events that could impact our environment; • periodic IT risk assessments; • quarterly vulnerability management reviews; and • periodic cloud risk assessments.


text: We engage third party consultants with respect to cybersecurity, including to conduct vulnerability assessments and penetration testing of its information technology systems. We have established a formal third party risk management (TPRM) policy which defines the criteria that a third party service provider must meet in order to be considered by us. All vendors are risk ranked and reviewed by our TPRM team with results reported to our information security committee, which ultimately approves the use of new and existing vendors. In addition, we maintain an internal information security committee comprised of cross-departmental company executives and IT leaders to ensure that we maintain strong governance mechanisms and to ensure compliance with our security policies and procedures.


text: Although we have implemented what we believe to be an appropriate information security program to protect against, detect, mitigate, and respond to cybersecurity risks, there can be no assurance that such risks, including incidents, may be prevented or timely detected. During the year ended December 31, 2024, we did not experience any material cybersecurity incidents, including cybersecurity incidents that materially affected or are reasonably likely to materially affect the Company, our business strategy, results of operations, or financial condition. See "Risk Factors—Risks Relating to the Operation of Our Business—The security of our information technology systems may be compromised and confidential information, including non-public personal information that we maintain, could be improperly disclosed."


text: Cybersecurity Governance Our board of directors, led by the board's technology, innovation and operations committee, actively oversees our information security program, with our management, inlcluding the CIO and CISO, providing the board and that committee with regular updates (including at each of the three meetings held by that committee in 2024) and reporting on our IT strategy, including information security strategies and initiatives, event preparedness and incremental improvement efforts.


text: The CIO and CISO, who are well qualified, oversee our information security program and are responsible for assessing and managing our risks from cybersecurity threats. Our CIO has over 25 years of experience serving Fortune 500 companies in the area of information technology, including over 20 years in mortgage and financial services, with roles ranging from overseeing application development and delivery to enhance risk management capability and improve operational efficiency to information technology strategy, architecture, delivery, and management. Similarly, our CISO has over 25 years of experience working for financial services companies in information technology, including roles overseeing e-commerce, technical infrastructure management and architecture, and over 20 years overseeing information security programs.


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks We seek to assess, identify and manage cybersecurity risks through the processes described below: • Risk Assessment: A multi-layered system designed to protect and monitor data and cybersecurity risk has been implemented.


text: An overall assessment of our cybersecurity safeguards was conducted by an independent cybersecurity vendor. Our internal Cybersecurity Team conducts regular evaluations designed to assess, identify and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies, and education programs on a regular basis. We use firewalls and protection software, and we additionally periodically rely on a third-party vendor for alerts regarding suspicious activity. A monitoring and detection system has been implemented to help promptly identify cybersecurity incidents.


text: In the event of any breach or cybersecurity incident, we have a cross-functional incident response plan that includes an executive management team, established incident levels, and associated notification procedures, including escalation procedures upon discovery of cybersecurity risks deemed to have a moderate or higher business impact, even if immaterial to us, and identifies what is needed to restore normal operations efficiently.


text: We incorporate external expertise and reviews as part of our cybersecurity program. For example, we have engaged an independent cybersecurity advisor to review, assess, and make recommendations regarding our information security program and information technology strategic plan. We recognize that third-party service providers introduce cybersecurity risks. In an effort to mitigate these risks, before engaging with any third-party service provider for information technology ("IT") services, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to include cybersecurity requirements in our contracts with these providers and endeavor to require them to adhere to security standards and protocols. Further, we request that third-party service providers with access to personally identifiable information enter into data processing services agreements and adhere to our policies and standards.


text: The above cybersecurity risk management processes are integrated into the Partnership's overall enterprise risk management program. Cybersecurity risks are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.


text: Impact of Risks from Cybersecurity Threats As of the date of this Report, though the Partnership and our services providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Partnership. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT or operational technology ("OT") systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise of our IT or OT systems.


text: Board of Directors' Oversight and Management's Role Through the Partnership's enterprise risk management program, the Board of Directors is responsible for overseeing cybersecurity, information security, and information technology risks, as well as management's actions to identify, assess, mitigate, and remediate those risks. As part of its program of regular risk oversight, the Audit Committee assists the Board in exercising oversight of the Partnership's cybersecurity, information security, and information technology risks. The Board or Audit Committee periodically reviews and discusses with management the Partnership's policies, procedures and practices with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, the IT Director is responsible for upward reporting of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us.


text: Recognizing the importance of cybersecurity to the success and resilience of our business, the Board considers cybersecurity to be a vital aspect of corporate governance. To facilitate effective oversight, our cybersecurity leadership team holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks.


text: Our cybersecurity leadership team is made up of highly experienced professionals with an extensive background in information security, risk management, and incident response. This background includes a dynamic team, comprised of military veterans versed in forensic analysis and regulatory compliance with over 23 years of combined Cybersecurity experience in private and public sector, supported by a Master's degree in Cybersecurity as well as several industry certifications.


text: Our operations are dependent on our information technology systems, and the systems of our third party partners, upon which we rely, to maintain our ability to access, store, and transmit sensitive information in a secure manner. One of the primary risks to which we are exposed is the risk that our information systems are compromised, either deliberately or unintentionally, and that sensitive information is disclosed, misused or corrupted, or our operations are disrupted. Such an incident could result in a number of adverse consequences, including disruptions in customer relationship management, system damage, remediation costs, litigation, and reputational damage. We maintain an information security and governance program that is designed to protect our information systems against such risks.

companyName: Embassy Bancorp, Inc.

ticker: EMYB


text: Risk Management and Strategy The Company recognizes the significance of such risks and cybersecurity is a critical component of our overall risk management program. In order to combat against and mitigate the impact of any unauthorized access to or attack on our information systems, we have implemented policies and procedures designed to assess, identify, and manage material risks arising from cybersecurity threats. Additionally, because we rely on third parties to provide services that are integral to our operations, we have procedures in place to assess a technology provider's cybersecurity controls prior to establishing a contractual relationship and to periodically review assessments of those systems. Whenever possible, we include cybersecurity requirements in our contracts with such providers, which typically include agreed-upon security standards and protocols and our right to obtain periodic reports or assessments of such provider's compliance therewith. Embassy Bancorp, Inc.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Hudson Pacific Properties, Inc.

ticker: HPP


text: Our cybersecurity program provides a program for compliance with applicable cybersecurity and data protection laws. Our program is designed to ensure the security and confidentiality of customer, employee and Company information, protect against known or evolving threats to the security or integrity of customer records and personal information and protect against unauthorized access to or use of such information. We work with third party reviews of cyber security programs, regulators, and third-party service providers to ensure that these policies are adequately designed to appropriately safeguard such information. The Company's policies and procedures include, and are not limited to: Information Systems and Cyber Security Policy Patch and Change Management Cyber Incident Response Policy and Testing Annual NIST Risk Assessments Business Continuity and Disaster Recovery Plans and Testing Annual CIS Benchmarks Assessments Vendor Risk Management Policies Access to Threat Intelligence Remote Access Policy Dark Web Monitoring Customer Facing Technology Risk Assessments Cyber Risk Insurance Policy Cyber Security Awareness Training Physical Security Policy


text: Vulnerability Assessments The Company uses a layered security structure of processes and technologies to detect, prevent, mitigate, monitor and respond to cybersecurity threats.


text: Employees undergo cybersecurity training during orientation. Employees and board members receive annual training to promote cybersecurity awareness. All employees are required to abide by our cybersecurity and data protection policies. To date, the Company has not experienced a material cybersecurity incident.


text: Cybersecurity and data protection is essential for the Company to maintain the trust of our customers, team members and stakeholders. The Board of Directors is ultimately responsible for overseeing the Company's management of cybersecurity risk, including oversight into appropriate risk mitigation, strategies, processes, systems, and controls.


text: The Company has an IT Team and Cyber Incident Response Team made up of senior managers of the bank and led by the Chief Operating Officer (COO), the Information Security Officer (ISO) and the Security Officer (SO).The COO, ISO and SO are primarily responsible for assessing and managing material risks from cybersecurity threats and are responsible for designing, implementing and maintaining our cybersecurity environment and incident response procedures. The IT Team is responsible for ensuring the Board of Directors and employees are trained annually on cybersecurity and information security awareness and apprised of any emerging threats. Additionally, the IT Team ensures employees are adequately trained on our incident response procedures.


text: The ISO and SO report to the COO and monthly written Cybersecurity reports are presented to the Board of Directors. At least annually the IT Team leadership and members of the Audit Committee and Board meet strategically to review, and as appropriate, adapt our cybersecurity program to an evolving landscape of emerging threats, evaluate effectiveness of key security controls, assess cybersecurity best practices, and to adopt the annual cybersecurity strategy. A written cybersecurity report and briefing to the full Board is conducted on an annual basis. These reports cover, but are not limited to, the Company's cybersecurity environment, threats, material cybersecurity risks and events, improvements and effectiveness, the results of periodic testing (both internal and external), and other material matters related to the cybersecurity program. Embassy Bancorp, Inc.


text: As of the date of our filing of this report, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on our business operations. Given the rapid evolution of cyber-related attack techniques, cybersecurity risks associated with our information technology systems and the systems of our customers and vendors continue to grow. Notwithstanding our cybersecurity management processes, a future cybersecurity incident could have a material adverse effect on our business or on our financial position, results of operations or cash flows. See "Item 1A. Risk Factors—Risks related to laws, regulation, and governmental compliance— We are subject to cybersecurity risks and threats as well as increasing regulation of data privacy and security."

companyName: Transocean Ltd.

ticker: RIG


text: Our cybersecurity program provides a program for compliance with applicable cybersecurity and data protection laws. Our program is designed to ensure the security and confidentiality of customer, employee and Company information, protect against known or evolving threats to the security or integrity of customer records and personal information and protect against unauthorized access to or use of such information. We work with third party firms to review and monitor our cyber security programs, our regulators, and other third-party service providers to ensure that these policies are adequately designed to appropriately safeguard such information. The Company's policies and procedures include, and are not limited to: Information Systems and Cyber Security Policy Patch and Change Management Cyber Incident Response Policy and Testing Annual NIST Risk Assessments Business Continuity and Disaster Recovery Plans and Testing Annual CIS Benchmarks Assessments Third Party Risk Management Policies Access to Threat Intelligence Remote Access Policy Dark Web Monitoring Customer Facing Technology Risk Assessments Cyber Risk Insurance Policy Cyber Security Awareness Training Physical Security Policy


text: Employees undergo cybersecurity training during orientation. Employees and board members receive annual training to promote cybersecurity awareness. All employees are required to abide by our cybersecurity and data protection policies. To our knowledge and to date, the Company has not experienced a material cybersecurity incident.


text: The Company has an IT Team and Cyber Incident Response Team made up of senior managers of the bank and led by the Chief Operating Officer (COO), the Information Security Officer (ISO) and the Security Officer (SO). The COO, ISO and SO, in conjunction with our third party cyber security technology provider, are primarily responsible for assessing and managing material risks from cybersecurity threats and are responsible for designing, implementing and maintaining our cybersecurity environment and incident response procedures. The ISO has twenty-eight (28) years of experience exclusively in the IT field. The IT Team is responsible for ensuring the Board of Directors and employees are trained annually on cybersecurity and information security awareness and apprised of any emerging threats. Additionally, the IT Team ensures employees are adequately trained on our incident response procedures.


text: Risk management and strategy Our approach to managing cybersecurity risk and safeguarding information across our organization embeds data protection and cybersecurity risk management throughout our enterprise and daily operations. We maintain processes for identifying, assessing and managing material risks, including such risks from cybersecurity threats, and such processes are integrated into our overall risk management system. Our enterprise risk register inventories significant risks to our company, including significant cybersecurity risks, and we maintain a separate functional risk register, specifically focusing on potential cybersecurity risks. Within these risk registers, we record each identified risk, describe its likelihood of occurrence and assess its potential impact, including the materiality thereof. As part of this exercise, mitigating measures are planned and implemented into action as necessary. As an additional feature of our cybersecurity risk management process, we have engaged an external third-party service provider to support our cybersecurity team and perform certain periodic external evaluations in addition to the assessments and network penetration tests we perform internally.


text: We undertake to align our cybersecurity program, which encompasses both enterprise security and operational security, with the standards of the National Institute of Standards and Technology Cybersecurity Framework. We maintain continuous cyber threat-detection systems and have established an incident response plan, which contains playbooks for addressing and recovering from potential material cyberattacks and breaches of data security. In addition to security measures for third-party vendors, we require onboarding orientation and periodic training covering cybersecurity and information management for all employees and board members and conduct regular cybersecurity awareness campaigns.


text: Our IT management team, with oversight by our board of directors ("Board") and audit committee of the Board ("Audit Committee"), helps identify, assess, and manage risks from cybersecurity threats by monitoring and evaluating threats through our cybersecurity risk management program, which leverages the National Institute of Standards and Technology Cybersecurity Framework.

companyName: SITIME Corp

ticker: SITM


text: We involve multiple levels of oversight as a part of our approach to cybersecurity risk management. Our board of directors oversees our enterprise risk register and cybersecurity program, including related policies and procedures. As part of this oversight, the audit committee of our board of directors receives regular status reports and updates from our management team and conducts periodic executive sessions with our Chief Information Officer. Such status reports and executive sessions cover cybersecurity matters, such as developments to our program, key risk indicators, emerging risks, and identified incidents.


text: In addition, our Chief Information Officer, who has more than 40 years of industry experience and over 20 years of experience with the development, training and controls of effective global enterprise cybersecurity programs, oversees the implementation and compliance of our cybersecurity program and mitigation of information security related risks. Such oversight includes (i) reviewing our enterprise risk register, (ii) maintaining adequate processes to manage the identified risks under our cybersecurity program, (iii) regularly analyzing logs of cybersecurity threats and vulnerabilities and (iv) overseeing prevention, detection, mitigation and remediation efforts in general, including the development and maintenance of the above-mentioned incident response plan. Additionally, we maintain an experienced information technology team at the employee level that supports our Chief Information Officer in implementing our cybersecurity program and internal reporting, security and mitigation functions.


text: Risk management and strategy Our approach to managing cybersecurity risk and safeguarding information across our organization embeds data protection and cybersecurity risk management throughout our enterprise and daily operations. We maintain processes for identifying, assessing and managing material risks, including such risks from cybersecurity threats, and such processes are integrated into our overall risk management system. Our enterprise risk register inventories significant risks to our company, including significant cybersecurity risks, and we maintain a separate functional risk register, specifically focusing on potential cybersecurity risks. Within these risk registers, we record each identified risk, describe its likelihood of occurrence and assess its potential impact, including the materiality thereof. As part of this exercise, mitigating measures are planned and implemented into action as necessary. As an additional feature of our cybersecurity risk management process, we have engaged an external service provider to support our cybersecurity team by performing penetration tests and periodic external security evaluations.


text: We undertake to align our cybersecurity program, which encompasses both enterprise security and operational security, with the standards of the National Institute of Standards and Technology Cybersecurity Framework. We maintain continuous cyber threat-detection systems and have established an incident response plan, which contains playbooks for addressing and recovering from potential material cyberattacks and breaches of data security. In addition to establishing security measures for vendors, we require onboarding orientation and periodic training for all employees and board members that focuses on cybersecurity and information management, and we conduct regular cybersecurity awareness campaigns.


text: As of the date of our filing of this report, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on our business operations. Given the rapid evolution of cyber-related attack techniques, including through the use of AI, cybersecurity risks associated with our information technology systems and the systems of our customers and vendors continue to grow. Notwithstanding our cybersecurity management processes, a future cybersecurity incident could have a material adverse effect on our business or on our financial position, results of operations or cash flows. See " Item 1A. Risk Factors—Risks related to laws, regulation, and governmental compliance—We are subject to cybersecurity risks and threats as well as increasing regulation of data privacy and security. "


text: We involve multiple levels of oversight as a part of our approach to cybersecurity risk management. Our board of directors oversees our enterprise risk register and cybersecurity program, including related policies and procedures. As part of this oversight, the audit committee of our board of directors receives regular status reports and updates from our management team and conducts periodic executive sessions with our Vice President, Information Technology. Such status reports and executive sessions cover cybersecurity matters, such as developments to our program, key risk indicators, emerging risks, and identified incidents.


text: In addition, our Vice President, Information Technology, who has more than 20 years of industry experience and over 25 years of experience with the development, training and controls of effective global enterprise cybersecurity programs, oversees the implementation and compliance of our cybersecurity program and mitigation of information security related risks. Such oversight includes (i) reviewing our enterprise risk register, (ii) maintaining adequate processes to manage the identified risks under our cybersecurity program, (iii) regularly analyzing logs of cybersecurity threats and vulnerabilities and (iv) overseeing prevention, detection, mitigation and remediation efforts in general, including the development and maintenance of the above-mentioned incident response plan. Additionally, we maintain an experienced information technology team at the employee level that supports our Vice President, Information Technology in implementing our cybersecurity program and internal reporting, security and mitigation functions.


text: Cybersecurity Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats. These policies and processes are intended to protect the confidentiality, integrity, and availability of our critical information systems and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature ("Information Systems and Data").


text: Our cybersecurity risk management program incorporates a variety of methods to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including: • risk assessments designed to help identify cybersecurity risks to our Information Systems and Data; • a team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • annual training of our employees at all levels and in all departments regarding cybersecurity awareness and protection of confidential information; and • a cybersecurity incident response plan that includes procedures for detecting and responding to cybersecurity incidents.


text: Additionally, our cybersecurity risk management program incorporates a variety of tools and services to assess, identify, and manage material risks from cybersecurity threats, including regular network and endpoint monitoring, vulnerability assessments, and penetration testing.


text: Our cybersecurity risk management program is integrated in our overall enterprise risk management program. For example, our IT team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact on our business.


text: Our cybersecurity risk management program also seeks to manage cybersecurity risks associated with our use of third-party service providers through risk assessments and imposition of contractual obligations.


text: For a description of risks from cybersecurity threats that may materially affect the Company and how they may do so, see Item 1A "Risk Factors" in this annual report on form 10-K, including the risk factors entitled "Security breaches, cyberattacks, and other disruptions to information technology systems owned or maintained by us or third parties, such as vendors or suppliers, could disrupt our operations, compromise the confidentiality of private customer data or our intellectual property, and adversely affect our business, reputation, operations, and financial results" and "Our business may be impacted by information technology system failures or network disruptions, and lack of redundancy."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Audit Committee oversight of cybersecurity matters and other policies and internal controls regarding information security risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management will update the Audit Committee, as necessary, regarding any significant cybersecurity incidents. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives a briefing from management on our cyber risk management program at least annually.


text: Our management team, including our IT management team, are responsible for day-to-day implementation, assessment, and management of our cybersecurity risk assessment and management processes. The IT management team has primary responsibility for our overall cybersecurity risk management program, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents, and works in partnership with our other business leaders, including our Chief Legal Officer. Our IT management team supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our Senior Director of IT has served in various roles in information technology and information security for over 25 years.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to a team of business leaders, including, but not limited to, our Chief Legal Officer, Executive Vice President and Chief Financial Officer, Executive Vice President of Engineering and Technology, and Executive Vice President of Operations. This team of business leaders works with our incident response team to help determine the severity of the impact of a cybersecurity incident, as well as to help mitigate and remediate cybersecurity incidents of which they are notified.


text: Our IT management team, with oversight by our board of directors ("Board") and audit committee of the Board ("Audit Committee"), helps identify, assess, and manage risks from cybersecurity threats by monitoring and evaluating threats through our cybersecurity risk management program, which leverages the National Institute of Standards and Technology Cybersecurity Framework.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Cartesian Therapeutics, Inc.

ticker: RNAC


text: We rely on the information technology and systems maintained by our manager, Tremont, and RMR, and rely on Tremont and RMR to identify and manage material risks from cybersecurity threats. RMR takes various actions, and incurs significant costs, to maintain and protect the operation and security of information technology and systems, including the data maintained in those systems. Our Audit Committee oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from RMR's Chief Information Officer regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, RMR has a detailed incident response plan in place for contacting authorities and informing key stakeholders, including our management. We have not been materially affected and do not believe we are reasonably likely to be materially affected by any risks from cybersecurity threats, including as a result of previous incidents.

companyName: Seven Hills Realty Trust

ticker: SEVN


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks is delegated to our Senior Director, Head of IT and Informatics, who reports on IT operations, risk mitigation and assessment efforts, and other general cybersecurity matters to our Chief Financial Officer, to manage the risk assessment and mitigation process.


text: The Audit Committee ("Audit Committee") of the Company's Board of Directors (the "Board") is involved in the oversight of the Company's enterprise risk management program, including risks of cybersecurity threats. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on ensuring each operating company is implementing effective and efficient controls, technologies, and other processes to assess, identify, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.

companyName: STEEL PARTNERS HOLDINGS L.P.


text: Cybersecurity risk management and strategy Each operating company assesses its own cybersecurity risk profile and designs and implements technical safeguards and other risk management policies; however, as one of the critical elements of the Company's overall enterprise risk management approach, the Company's cybersecurity program to which all operating companies are a part, includes: • Collaboration: Through ongoing communications with management and the Company's IT department, each operating company's IT department monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents applicable to the particular operating company in real time, and reports such threats and incidents to the Data Breach Response Team, who will then report to the Audit Committee when appropriate. • Technical Safeguards: Although each operating company assesses and implements its appropriate technical safeguards for its business, generally the Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats such safeguards are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that address the Company's response to a cybersecurity incident. The Company has adopted a Cybersecurity Incident Policy and has established a Data Breach Response Team to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards. • Outside Consultants: The Company engages various outside consultants, including forensic specialists, public relations and data breach resolutions firms, outside attorneys and other third parties, to among other things, obtain information of a cybersecurity incident and isolate compromised systems and electronic data from further exposure; and determine and execute mitigation and remediation options and plans. • Education and Awareness: The Company provides awareness training to its personnel regarding cybersecurity threats to help identify, avoid and mitigate cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company or its financial position, results of operations and/or cash flows.


text: As discussed above, the Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's overall cybersecurity and other information technology risks, controls, strategies and procedures. The Audit Committee periodically evaluates the Company's (and each operating company's) information security strategies to ensure its effectiveness. The Company's management reports to the Audit Committee as part of every quarterly scheduled meeting of the Audit Committee (or more frequently, as needed) regarding technological risk exposure and cybersecurity risk management strategy. In addition, the full Board may review and assess cybersecurity risks as part of its responsibilities for oversight of the Company's broad enterprise risk management program.


text: The Company's IT department, in coordination with the Company's legal department, General Counsel ("GC"), Chief Financial Officer ("CFO"), Senior Vice President of Finance ("SVP Finance") and as needed each operating company's IT department (collectively, the "Data Breach Response Team"), works collaboratively to promptly respond to any cybersecurity incidents in accordance with the Company's Cybersecurity Incident Policy. The Company's response planning is reviewed annually and kept up to date with industry developments.


text: Management's Expertise The Company's Senior Vice President, Information Technology, holds a Master's degree in business administration and industrial psychology. He has served in various roles in information technology for over 26 years. Staying informed on developments in the cyber industry is crucial to the Company's effective prevention, detection, mitigation and remediation of any cybersecurity incidents.


text: The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our internal IT function and management.


text: Cybersecurity risk management and strategy Each operating company assesses its own cybersecurity risk profile and designs and implements technical safeguards and other risk management policies; however, as one of the critical elements of the Company's overall enterprise risk management approach, the Company's cybersecurity program to which all operating companies are a part, includes: • Collaboration: Through ongoing communications with management and the Company's IT department, each operating company's IT department monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents applicable to the particular operating company in real time, and reports such threats and incidents to the Corporate Cyber Security Incident Team. • Technical Safeguards: Although each operating company assesses and implements its appropriate technical safeguards for its business, generally the Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats such safeguards are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that address the Company's response to a cybersecurity incident. The Company has adopted a Cybersecurity Incident Policy and has established a Corporate Cyber Security Incident Team to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards. • Outside Consultants: The Company engages various outside consultants, including forensic specialists, public relations and data breach resolutions firms, outside attorneys and other third parties, to among other things, obtain information of a cybersecurity incident and isolate compromised systems and electronic data from further exposure; and determine and execute mitigation and remediation options and plans. • Education and Awareness: The Company provides awareness training to its personnel regarding cybersecurity threats to help identify, avoid and mitigate cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: Management's Expertise The Company's Senior Vice President, Information Technology, holds a Master's degree in business administration and industrial psychology. He has served in various roles in information technology for over 27 years. Staying informed on developments in the cyber industry is crucial to the Company's effective prevention, detection, mitigation and remediation of any cybersecurity incidents.


text: Risk Management and Strategy We and our advisor have processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into our overall risk management systems as they have been designed to fit within and complement the enterprise-wide risk assessment framework as implemented by our management and our advisor and as overseen by our board of directors. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers.

companyName: Pacific Oak Strategic Opportunity REIT, Inc.

ticker: PCOK


text: Our management and our advisor are responsible for establishing and monitoring the integrity and effectiveness of our controls and other procedures, which are designed to ensure that all information required to be disclosed is recorded, processed, summarized and reported accurately and on a timely basis, and all such information is accumulated and communicated to management and the audit committee, as appropriate, to allow for timely decisions regarding such disclosures. The controls and procedures subject to the board's oversight include processes related to managing material risks from cybersecurity threats. Accordingly, our cybersecurity processes have been integrated into our overall processes.


text: In the last three fiscal years, cybersecurity threats have not materially affected us, including our business strategy, results of operations or financial condition. See also, Item 1A, "Risk Factors—Risks Related to an Investment in Us—We face risks associated with security breaches through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our information technology (IT) networks and related systems."


text: The audit committee oversees, among other things, a system of internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee is composed of all of our independent directors.


text: We continue to work with third-party cybersecurity vendors to assist us in best practices for implementing strengthened cybersecurity procedures. All Company employees and third-party vendors are instructed to promptly report any suspected breach of its security measures that may affect our Company to the Senior Director, Head of IT. Our Chief Financial Officer and Senior Director, Head of IT provide periodic briefings to the Audit Committee regarding our Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third-parties, and related matters. The Audit Committee provides regular updates to the full Board of Directors on such reports.


text: Our advisor utilizes a team of dedicated external IT professionals, which leads enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The IT professionals provide periodic reports to our board of directors, our advisor and its affiliates, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on our cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by our advisor and external experts with the results of those reviews reported to senior management and the board of directors. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: Our advisor utilizes a team of dedicated external IT professionals, which leads enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The IT professionals provide periodic reports to our board of directors, our advisor, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on our cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by our advisor and external experts with the results of those reviews reported to senior management and the board of directors. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.


text: One of the key responsibilities of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly and through the Audit Committee, which conducts regular risk assessments related to all matters affecting the enterprise, including cybersecurity, and receives periodic reports on the Company's cybersecurity risks and activities.


text: Our Chief Financial Officer and our Senior Director, Head of IT and Informatics are the Company employees primarily responsible for assessing and managing material risks from cybersecurity threats with assistance from third-party service providers. Our Chief Financial Officer has served as a biotechnology executive for 15 years, whose responsibilities have included direct oversight of his companies' cybersecurity risks. Our Senior Director, Head of IT and Informatics has served as an information technology professional for over ten years and has held senior IT positions at multiple biotechnology companies, where his primary responsibilities included maintaining direct oversight over his companies' cybersecurity risks.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We engage consultants or other third parties in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, and monitoring and testing our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our Company. Our Chief Financial Officer and Senior Director, Head of IT and Informatics provide periodic briefings to the Audit Committee regarding our Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and related matters. The Audit Committee provides regular updates to the full Board of Directors on such reports.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: One of the key responsibilities of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly and through the Audit Committee, which conducts regular risk assessments related to all matters affecting the enterprise, including cybersecurity, and receives periodic reports on the Company's cybersecurity risks and activities. Our Chief Financial Officer and our Senior Director, Head of IT are the Company employees responsible for developing and implementing a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We partner with external cybersecurity vendors to enact a layered defense approach with controls deployed that seek to meet the requirements of the NIST Cybersecurity Framework.


text: Our Chief Financial Officer has served as a biotechnology executive for 20 years, whose responsibilities have included direct oversight of his companies' cybersecurity risks. Our Senior Director, Head of IT has served as an Information Technology professional for over ten years and has held senior IT positions across several companies including a large pharmaceutical company.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. Our Senior Director, Head of IT oversees the cybersecurity program through risk management, employee security training, and oversight and escalation of threat monitoring and incident response. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. In the event of a major security incident, we have established an escalation path for stakeholder notification and remediation efforts, and major incidents are immediately escalated to the Head of IT, Chief Financial Officer, and Chief Operations Officer. In 2024, we proactively conducted a thorough and robust cybersecurity assessment, performed by an external cybersecurity partner, to evaluate our risks and identify key areas to improve our cybersecurity posture. We have implemented processes when evaluating third-party service providers, for example by reviewing available audit reports including the System and Organization Controls (SOC 2) reports and requesting disclosure of any previous cybersecurity events. We also perform quality audits of certain regulated vendors, which includes an assessment of the vendor's information technology system and associated controls.


text: Additionally, we conduct periodic risk assessments to identify and monitor against potential cybersecurity threats and incidents, as well as assess for any changes in our business practices that may affect our cybersecurity position. This risk oversight includes identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks and address any identified gaps in existing safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity program is delegated to our Senior Director, Head of IT, who reports on IT operations, risk mitigation and assessment efforts, and other general cybersecurity matters to our Chief Financial Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards.


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for service providers, suppliers, and vendors.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We utilize various risk management guides, as well as the protocols of certain certifications as described below to identify, assess, and manage cybersecurity risks relevant to our business through our risk management program. Our cybersecurity risk management program includes a cybersecurity incident response plan.