text: Since the management of cybersecurity risks is ultimately the responsibility of the Board of Directors, it devotes significant time and attention to the oversight of cybersecurity and information security risks, and benefits from the technical expertise of its members. The Board of Directors reviews an Enterprise Risk Position report that reflects key risk measures and trends across the Company, including cybersecurity. The Board of Directors also reviews and approves the Information Security Policy annually and frequently receives presentations on and discusses cybersecurity and information security risks, industry trends and best practices.


text: The Audit & Risk Committee, which is charged with assisting the Board of Directors in fulfilling its oversight responsibilities related to the Company's enterprise-wide risk management framework, receives an operational risk update at least quarterly that includes a review of cybersecurity and information security risk.

companyName: BANK OF HAWAII CORP

ticker: BOH

secItem: Item 1C


text: The Board of Directors is also responsible for the approval and oversight of the Information Security (IS) Program. Our Chief Information Security Officer (CISO), who is designated as the IS Program Coordinator, has extensive information technology, security and program management experience. The Information Risk and Controls Management Department, under the direction of the CISO, administers the IS Program with an objective of preventing cybersecurity incidents by ensuring the confidentiality, integrity and availability of company information. Central to incident management is the Information Security Incident Response Team (ISIRT), which is responsible for responding expeditiously and effectively to security incidents to minimize risks to the business, customers and consumers. In the event of an incident, we follow the detailed incident response plan, which outlines the steps to be followed from incident identification to mitigation, recovery and notification, including notifying functional areas, regulators, as well as senior leadership and the Board, as appropriate.


text: All of our employees also have a responsibility to protect the privacy of bank confidential and proprietary information. They are required to undergo periodic information security awareness training to ensure a clear understanding of their roles in protecting information assets and to create a security-minded culture.


text: We continue to strengthen the management and oversight of cybersecurity risks through new security system enhancements, policies, testing, identification and reporting. We also engage a third-party to perform penetration testing and ongoing analysis to identify potential vulnerabilities and areas for additional enhancements.


text: We utilize third party service providers to support and facilitate business and operational activities and to achieve strategic goals. However, third parties may expose us and our customers to various risks. We have implemented a Third Party Risk Management framework, which provides the tools and practices utilized in the oversight of third party service providers, with an objective to meet legal and regulatory obligations, contractual requirements, performance expectations, and our own principles and values.


text: We are subject to extensive federal and state regulation of customer privacy and the security of financial information. Our federal regulator, the FRB, is part of the Federal Financial Institutions Examination Council (FFIEC), which publishes extensive guidelines and examination procedures that are used to review the security of Bank of Hawai i and other financial institutions.


text: For the 2023 period, we reported no material cybersecurity incidents affecting the confidentiality, integrity, or availability of data or systems. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: For further information, please see our risk factor titled "An interruption or breach in security of our information systems or those related to merchants and third-party vendors, including as a result of cyber attacks, could disrupt our business, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, or result in financial losses."


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our customer's confidential information ("Information Systems and Data").

companyName: Xometry, Inc.

ticker: XMTR


text: Our information security function, which is led by our Chief Technology Officer ("CTO"), helps identify, assess, and manage our cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including using manual and automated tools, analyzing reports of threats and actors, evaluating our risk profile, conducting audits, conducting threat and vulnerability assessments, and performing tabletop incident response exercises.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including incident detection and response, a vulnerability management policy, business continuity plans, risk assessments, encryption of certain data, access controls, employee training, penetration testing, cybersecurity insurance, systems monitoring and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. Certain information about our assessment and management of material risks from cybersecurity threats is included in risk management reports, as applicable, to senior leadership and the Audit Committee.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, cybersecurity consultants and software providers, managed cybersecurity service providers, penetrating testing firms, and forensic investigators.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and third-party manufacturing organizations. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider (such as by reviewing certain vendor's security assessments or reports) and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor titled "If our information technology systems or those of our third-party partners or service providers or our data are or were compromised, we may experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruption to our business, harm to our reputation and brand, and exposure to liability."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee of our board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including (i) our CTO, Mr. Leibel, who has previously served as the Senior Director of Engineering at various large technology companies and holds a Master of Information Technology degree from Virginia Tech; and (ii) our Vice President of Information Technology and Security, Mr. Brendan Hamilton, who has previously worked as a Vice President at an international bank with supervisory responsibility for cybersecurity issues and is a Certified Information Systems Security Professional.


text: Our Chief People Officer, CTO and recruiting personnel are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our management, including our CTO and Chief Financial Officer, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer, CTO, Chief Financial Officer, and General Counsel, who works with our incident response team to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.


text: The Audit Committee receives periodic reports from the CTO concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. Our board of directors receives such reports periodically from the Audit Committee and from our CTO. The board of directors also receive various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Innoviva, Inc.

ticker: INVA


text: We conduct risk assessments to identify cybersecurity threats at least annually, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote internal and external resources and designate high-level personnel to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, legal, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage internal auditors and other third parties in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: During the year ended December 31, 2023, we did not identify any risks from known cybersecurity threats, including because of any prior cybersecurity incidents, that have materially affected us. However, in the future, we may face certain ongoing cybersecurity risks or threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our operations could be disrupted by failure of our information systems or cyber-attacks."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our executive team, primarily consisting of Chief Accounting Officer, Chief Financial Officer, and Chief Executive Officer, in conjunction with our information security team and third-party consultants, is primarily responsible in assessing and managing our material risks from cybersecurity threats. The qualifications of our executive and information security teams include a combination of formal education, current trainings and certifications in systems, network, and cybersecurity and over 50 years of combined experience in information technology and cybersecurity matters.


text: They oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which the executive team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: • They provide briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. • In addition, they provide briefings of any significant cybersecurity matters to the board of directors as well as an annual update of cybersecurity risks and activities.


text: Our cybersecurity risk management and strategy program consists of cybersecurity-related policies and procedures, industry standard technology solutions including antivirus, firewalls and monitoring tools, awareness training for all employees, periodic testing, and insurance coverage. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature.

companyName: Nuvation Bio Inc.

ticker: NUVB


text: The audit committee of our board of directors is responsible for oversight the Company's cybersecurity risk. On the management-side, our head of information technology is responsible for integrating cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, reviewing security assessments and other security-related reports, and retaining assessors, consultants, auditors, or third parties in connection with the company's cybersecurity program.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) security management works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk, and (4) we have a cybersecurity incident response plan to identify, assess, respond to, and inform escalating levels of management based on the nature and severity of such incidents. We have not identified any material cybersecurity incidents to date.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see the section titled "Risk Factors" in Item 1A of this Annual Report on Form 10-K, including the risk factor titled "—Our internal computer systems, or those used by our CROs or other contractors or consultants, may fail or experience security breaches or other unauthorized or improper access."


text: Cyber Risk Management and Strategy We have developed, implemented, and continue to maintain processes and procedures to identify and mitigate cybersecurity risks across our company (including our offices in Europe). Because we rely on various information technology systems and software programs to operate our business, we have an extensive cybersecurity program designed to protect our properties and confidential data. Our cybersecurity risk management and strategy program includes the following: • implementing the latest software releases and tools (including multi-factor authentication) in a timely manner; • seek to minimize the amount of personal information collected and stored about our employees and seek to avoid any collection and storage of non-financial or contact information from our tenants/borrowers; • constant security monitoring of computers, networks, and cloud-based information assets to detect and respond to cybersecurity risks and threats; • third party internal and external vulnerability assessments and penetration testing; • annual review and audit of cyber controls and procedures; • periodic review of cybersecurity procedures and implementation of new procedures as necessary to adhere to cybersecurity standards set forth by the National Institute of Standards and Technology; • periodic evaluation and review of cybersecurity risks associated with our use of key third-party business partners, vendors, and service providers. Because we do not control the systems or cybersecurity plans put in place by such third parties, and we may have limited contractual protections with such parties, we may be negatively impacted as a result of threats or incidents experienced by such third parties; • security awareness training provided during employee onboarding process and successful completion required at least annually for all employees with passing requirements; • employee anti-phishing campaigns performed at least quarterly; • a cybersecurity incident response plan, which is reviewed annually, but generally consists of a coordinated approach to investigating, containing, documenting, and reporting findings and keeping management and others informed and involved as appropriate; and • a cybersecurity risk insurance policy.

companyName: MEDICAL PROPERTIES TRUST INC

ticker: MPT


text: We have not identified any known cybersecurity threats or incidents within the prior year that have materially affected or are reasonably likely to materially affect us, including our overall business strategy, results of operations, or financial condition. Although we have taken steps to protect the security of our information systems and the data maintained in those systems, there is no guarantee the measures and security we have implemented will be successful in detecting and preventing a cybersecurity incident. Please refer to Item 1A of this Annual Report on Form 10-K for more information regarding additional risks related to cybersecurity and information technology.


text: Cyber Governance Cybersecurity holds a pivotal role in our comprehensive risk management processes and is a key focus for both our Board and management. Our management has primary responsibility for identifying, assessing, and managing our exposure to cybersecurity threats and incidents. However, the Board, led by members of the Risk Committee, oversees the enterprise risk management process, specifically addressing material risks stemming from cybersecurity threats.


text: The Board receives regular updates from the Computer Security Incident Response Team ("CSIRT") to provide insight into significant cybersecurity risks, potential impacts on business operations, and management's strategies for identifying, monitoring, and mitigating these risks. This includes sharing results from assessments or audits of relevant processes.


text: Led by our Director of Information Technology and Security ("Director of IT") with over 40 years of experience in Information Technology, our CSIRT, comprising cross-functional professionals, collaborates to execute our cybersecurity risk assessment and management processes by reviewing and assessing cybersecurity initiatives, including the incident response plan, cybersecurity compliance, training, and overall risk management efforts. The collaborative efforts of the Board and our skilled CSIRT team underscore our commitment to effectively addressing and mitigating cybersecurity risks within the organization.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats and employee, health care professionals, or HCPs, and patient information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and improve our practices. We engage certain external parties, including consultants, independent privacy assessors, and computer security firms to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: Apellis Pharmaceuticals, Inc.

ticker: APLS


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: The Audit Committee of the Board of Directors provides direct oversight over cybersecurity risk. The Audit Committee receives quarterly updates from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our Head of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees, HCPs and patients to address cybersecurity risks. The Head of Information Technology cybersecurity function brings security credentials and expertise, with broad global cybersecurity and compliance experience in life science, healthcare, and federal government. In addition to our cybersecurity team, a managed security service provider provides us with additional coverage to monitor, detect and respond to threats and vulnerabilities.


text: In an effort to deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with cybersecurity information and training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. Our third-party risk management program is integrated with global sourcing and procurement, and requires vendor risk assessments, incident reporting, and data protection controls. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We face risks associated with security breaches through cyber attacks, cyber intrusions or otherwise, and other significant disruptions of information technology networks and related systems. Refer to Risk Factors in Part I, Item 1A for a disclosure of our cybersecurity risks. We have not experienced a material information security breach and as a result, we have not incurred any material expenses. We continue to monitor cybersecurity risks to prevent and mitigate materially negative impacts on the Company's reputation, financial performance, customer or vendor relationships and potential litigation or regulatory investigations or actions.

companyName: CBL & ASSOCIATES PROPERTIES INC

ticker: CBL


text: As part of its regular oversight of risk management, our audit committee is responsible for the oversight of cybersecurity risk and threat mitigation related to our information technology and information systems including protection and security of employee and customer data. Our Vice President – Technology Solutions is responsible for the day-to-day management of our cybersecurity program and reports directly to our President. Our Vice President – Technology Solutions has served in this role for over three years and has more than 25 years of experience in the aggregate, including ten years with the Company, in various information technology roles. Our audit committee is responsible for overseeing cybersecurity risks, and our management team reports to our audit committee on the Company's cybersecurity program, current cybersecurity projects and industry trends and efforts to mitigate cybersecurity risk on at least a semi-annual basis.


text: We have a comprehensive program designed to mitigate cybersecurity risk. We have adopted and require employees to abide by our personally identifiable information policy to help protect personal employee, vendor and tenant information. Employees are required to complete regular cybersecurity training and education annually, which is followed-up with quarterly testing and re-training, as necessary. We also maintain an incident response plan which outlines our response and action in the event of a major cybersecurity incident. The cybersecurity incident response plan sets forth a process for detecting and responding to cybersecurity incidents, determining their scope and risk, developing an appropriate response to mitigate and remediate the incident, communicating effectively to all stakeholders and participants and reducing the likelihood of similar future incidents. In the event of a real or perceived cybersecurity incident, the Vice President – Technology Solutions would, as soon as practicable, inform management's technology solutions steering committee, the members of which would then collaborate with the Vice President – Technology Solutions to manage material risks.


text: We contract with a third party to perform a cybersecurity risk and vulnerability assessment annually. We regularly test areas of potential vulnerability, utilizing penetration testing, ransomware-focused disaster recovery tests as well as testing exercises for other higher risk areas. We have also implemented most of the voluntary practices recommended under the National Institute of Standards and Technology cybersecurity framework. Additionally, the Company maintains cybersecurity risk insurance coverage.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to align with industry best practices and provide a framework for evaluating and implementing methods to assess, identify and manage material risks from cybersecurity threats and properly respond to incidents, including threats and incidents associated with the use of services provided by third-party service providers. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat (including whether the cybersecurity threat is associated with a third-party service provider), implementing cybersecurity countermeasures and mitigation strategies and informing management and our Board of Directors of material cybersecurity threats and incidents. Our cybersecurity team leads a regular cybersecurity working group meeting with representatives from across the Company's centers of excellence, as well as a quarterly cybersecurity steering committee meeting with executives from across the Company, to facilitate coordination across different functional groups within our Company and ensure broad awareness of ongoing cybersecurity initiatives and assessments. These committees also hold ad hoc meetings as necessary to address urgent threats that arise in between meetings. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to all employees annually.

companyName: Pactiv Evergreen Inc.


text: Our Board of Directors has overall oversight responsibility for our risk management and has delegated cybersecurity risk management oversight to the Audit Committee of the Board. The Audit Committee of the Board is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and procedures to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee of the Board also reports material cybersecurity risks to our full Board of Directors. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining our cybersecurity program. Our cybersecurity program is managed under the direction of our Senior Vice President for Business Transformation, who receives reports from our cybersecurity team, including our Chief Information Security Officer, or CISO, and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. The CISO, in coordination with senior management, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to respond promptly to any material cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications, the CISO and these teams inform senior management about, and monitor the prevention, detection, mitigation and remediation of, cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: Our CISO has 42 years of experience in a diverse array of information and security technologies and has managed various domains, with expertise in enterprise resource planning, finite scheduling, middleware technologies, network control, operational control, identity access and governance and data center management. He and our other dedicated cybersecurity personnel collectively hold numerous certifications, including in relation to forensic investigation, threat hunting and digital forensics, risk and information system controls, Google cybersecurity, information security auditors and fraud examiners. Additionally, the collective cybersecurity team members have substantial experience in information technology disciplines and prioritize remaining educated on current threats.


text: Our cybersecurity team regularly updates the Audit Committee of the Board on our cybersecurity program, material cybersecurity risks and mitigation strategies and provides quarterly cybersecurity reports that cover, among other topics, third-party assessments of the Company's cybersecurity program, developments in cybersecurity and updates to the Company's cybersecurity program and mitigation strategies.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see the risk factor above entitled "Cybersecurity breaches and improper access to or disclosure of our data or user data, or other infiltration, hacking and phishing attacks on our systems, could harm our reputation and adversely affect our business."


text: Risk Management and Strategy The Trust's cybersecurity risk management is established and governed by the Sponsor. The Sponsor determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for the Trust and the Trust relies on the Sponsor for assessing, identifying and managing material risks to the Trust's business from cybersecurity threats. The Sponsor's cybersecurity policies and practices are set out in the Sponsor's compliance manual and are reviewed on an annual basis. In addition, all officers of the Sponsor and all employees of Bitwise receive annual compliance training and annual cybersecurity training. Attendance at the annual cybersecurity training and the annual compliance training is tracked and recorded.

companyName: Bitwise 10 Crypto Index ETF

ticker: BITW


text: The Sponsor engages a selection of third-party security experts ("Experts") to assist its internal legal, compliance and engineering personnel in developing, implementing and testing its cybersecurity policies and procedures. The Experts assist in performing assessments, penetration tests and reviewed areas of potential vulnerability. In addition, the Experts work with the Sponsor to conduct cybersecurity training, exercises and quarterly internal phishing tests. The Sponsor uses the findings of such exercises and campaigns to improve its practices, procedures, and technologies. The Sponsor also engages the Experts to support its cybersecurity threat and incident response management and maintains information security risk insurance coverage.


text: The Sponsor conducts due diligence on the Experts and all third-party service providers both at the beginning of any contractual relationship and on an ongoing, periodic basis. The Sponsor reviews a selection of all of its service providers on an annual basis, with specific emphasis on any service providers deemed to be high risk and utilizes external compliance partners to assist with this review. As part of this review, the Sponsor tracks any identified deficiencies and requires that its third-party service providers have in place appropriate technical and organizational security measures and security-control principles based on recognized cybersecurity standards. The Sponsor also obtains contractual assurances from third-party service providers relating to their security responsibilities, controls, reporting, and roles and responsibilities as it pertains to cybersecurity incident response policies and notification requirements.


text: While neither the Sponsor nor the Trust has experienced a material cybersecurity incident, cybersecurity threat risks may materially affect either the Sponsor or the Trust, including the Trust's business strategy, results of operations or financial condition. For further discussion of the risks the Trust faces from cybersecurity threats, see "Item 1A. Risk Factors--The Trust is subject to the risk of cybercrime and security breaches and incidents."


text: The Trust does not have any directors, officers or employees. Under the Trust Agreement, all management functions of the Trust have been delegated to and are conducted by the Sponsor, its agents and its affiliates. As a result, Katherine Dowling, the General Counsel, Chief Compliance Officer and Vice President of the Sponsor, is responsible for assessing and overseeing the Sponsor's and the Trust's cybersecurity risks and providing direction and oversight for risk mitigation action, in conjunction with Hong Kim, the Chief Technology Officer of Bitwise. Ms. Dowling has served as a Chief Compliance Officer at various companies since 2015 and has more than ten years of experience as an Assistant U.S. Attorney, most recently in the Economic Crimes Unit of the U.S. Attorney's Office for the Northern District of California. Ms. Dowling receives periodic reports from the Experts, outside legal representatives and members of the Sponsor's Legal and Compliance team who take part in cybersecurity review, implementation and testing. Mr. Kim graduated from the University of Pennslyvania with a Bachelor of Science in Computer Science, and, prior to Bitwise, worked on Google's backend infrastructure for Google Drive and worked in software security for the South Korean military.


text: Bitwise, the parent of the Sponsor, has a board of directors that is ultimately responsible for managing and directing the affairs of the Sponsor, including maintaining oversight of risks from cybersecurity threats. Mr. Kim serves on the Bitwise board of directors. Ms. Dowling serves as the General Counsel and Chief Compliance Officer of Bitwise and therefore is able to report directly to Bitwise's board of directors regarding cybersecurity risks to the Trust and the Sponsor.


text: Risk Management and Strategy We are committed to our goal to protect sensitive business-related and personal information, as well as our information systems. We are subject to numerous and evolving cybersecutity risks that could adversely and materially affect our business, financial conditions and results of operations.

companyName: Domtar CORP


text: We have implemented a cybersecurity risk management program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework to assess, identify and manage cybersecurity risk that may result in material adverse effects on the confidentiality, integrity and availability of our business and information systems.


text: Our program includes regular risk assessments, penetration testing performed by the internal team and independent third parties, patch management, and vulnerability scanning to identify potential threats and vulnerabilities. We have also implemented a robust security awareness program that includes regular phishing tests and requires employees to undergo annual security awareness training. Our cybersecurity strategy is focused on establishing the zero-trust security model to protect our information assets' confidentiality, integrity, and availability. We also have an incident response process and various incident response plans that are designed to provide timely and effective actions in the event of a cybersecurity incident. Our incident response plan includes procedures for determining the root cause and impacts of the incident, containment actions to mitigate the impacts, and notifying affected parties.


text: With respect to third-party service providers, we perform information security assessments and due diligence reviews prior to entering into a contractual agreement.


text: Despite our efforts, we recognize that no system is completely secure, and our main material cybersecurity risks are related to ransomware attacks, phishing attacks, insider threats, and third-party attacks. We monitor our systems against these risks and adjust our cybersecurity strategy accordingly. Our IT systems have been, and will likely continue to be, subject to computer viruses or other malicious codes, unauthorized access attempts, phishing, and other cyber-incidents, none of which, to Domtar's knowledge, have had a material impact on its business information systems or operations. While we cannot guarantee that our security efforts will prevent breaches or breakdowns to our IT systems or those of our third-party providers, we have a robust disaster recovery process that is exercised annually. For more information about cybersecurity risks, see the Risk factors discussion in Item 1A of this Form 10-K.


text: Our Management Leadership Team reviews cybersecurity risks as part of their oversight and execution of the Company's business operations and strategy. The Company's Management Board, with the support of its committees, oversees risk management to ensure that the processes designed, implemented and maintained by our executives are functioning as intended and adapted when necessary to respond to changes in our Company's strategy as well as emerging risks. We have established oversight mechanisms intended to provide effective cybersecurity governance, risk management, and timely incident response.


text: Cybersecurity is critical to the delivery of our services to our clients. We face cybersecurity threats that are common to most industries. We have a cybersecurity risk management program in place that is designed to assess, identify, manage, and govern material risks from cybersecurity threats. This program is a key component of our enterprise risk management program. The Company's Board is responsible for oversight of the Company's information technology systems, including cybersecurity, and has delegated such oversight to the Audit Committee. The Audit Committee regularly reviews the status of the initiatives such as the seeking of certifications associated with our information technology systems and receives regular updates on matters relating to information technology and cybersecurity. Our corporate information security organization, led by our Senior Director of IT who reports to our Chief Financial Officer, is responsible for our overall information security strategy, policy, security, operations and cyber threat detection and response. Our current Senior Director of IT has an extensive background and experience in information technology management and design, and data security. An integral part of our cybersecurity framework is our Security Response Team which is responsible for the detection, review, and response to cybersecurity incidents. In the event of a security incident, we intend to follow our detailed incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas as well as senior leadership and the Board, as appropriate.

companyName: HACKETT GROUP, INC.

ticker: HCKT


text: We regularly review the effectiveness of our cybersecurity controls, promptly addressing any identified risk areas and subject our information technology systems to testing performed by external parties on an annual basis. Our employees are required to successfully complete training on topics relating to our cybersecurity, data privacy and information security policies and procedures. Training is administered and tracked through online training modules. In addition, we perform periodic testing to evaluate the effectiveness of our training programs and to help prevent loss associated with the disclosure of electronic information. We also leverage third-party service providers and solutions across our operations to review, test, and assess our security systems and controls, as well as assist in the mitigation of any potential cyber risks. We recently obtained the ISO 27001 certification.


text: To further bolster our cybersecurity controls, we also have a third-party risk management program in place applicable to all of its contractors, vendors, and service providers which includes risk assessments, cybersecurity questionnaires, data privacy addendums, and contractual flow-downs of legal and regulatory requirements. We also require our contractors, subcontractors, vendors and service providers to report security incidents to us without undue delay.


text: To date, the Company has not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business operations or financial condition. Despite the extensive approach we take to cybersecurity, prevention of a cybersecurity incident cannot be completely guaranteed. Please refer to "Item 1A. Risk Factors – We rely on information technology and security systems and any damage, interruption or compromise of our information technology and security systems or data could disrupt and harm our business" and "Item 1A. Risk Factors – A breach of our information technology and security systems could materially adversely affect our business" for further information.


text: Cybersecurity Risk Management and Strategy We maintain a team, tools, policies, and processes for identifying, assessing, and managing material risks from cybersecurity threats. Threats like malware attacks, system vulnerabilities, and data breaches are actively identified, monitored, evaluated, and mitigated along with other Company risks. Our security team maintains centralized documentation regarding known security risks and mitigation. Consideration of material risks from cyber threats is integrated into our enterprise risk management processes and is a standing agenda item for discussion at our Audit Committee meetings. An Information Security Executive Committee representing multiple areas of the Company is responsible for assessing material risks from cybersecurity threats and represents multiple functions of the business including Finance, Human Resources, Legal, and the Information Technology ("IT") departments. We have certain employee cybersecurity awareness campaigns and training designed to help promote a culture of cybersecurity awareness throughout the organization. Cybersecurity tools, processes, policies, and controls are periodically reviewed and updated in response to changes in the business environment and evolving threats, as well as to align with broader risk management objectives.

companyName: Pursuit Attractions & Hospitality, Inc.

ticker: PRSU


text: Our information security function, led by our Chief Information Officer ("CIO"), implements and maintains the processes and controls to help identify, assess, and manage material risks from cybersecurity threats. These controls include, but are not limited to, the following Center for Internet Security ("CIS") controls: • Account Management; • Access Control Management; • Continuous Vulnerability Management; • Network Infrastructure Management; • Incident Response Management; • Security Awareness and Skills Training; and • Data Protection - Encrypt Data on End-User Devices. Supporting these controls are specific security measures that include threat intelligence monitoring, vulnerability scanning, and policy enforcement.


text: We use third-party service providers to assist us in identifying, assessing, and managing material risks from cybersecurity threats, including professional service firms, legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, and forensic investigators. We have a Cybersecurity Incident Response Plan ("IRP") that includes procedures for responding to and, to the extent applicable, disclosing material cybersecurity incidents in a timely manner. We have third-party risk management processes designed to assess risks from key vendors and suppliers, including application providers and hosting companies. Key software service providers utilized by the Company undergo a review process for security, reliability, and effectiveness. We have processes in place to address access to our network by such third parties, to the extent applicable, including network access controls designed to provide access on a 'least privilege' basis.


text: For a discussion of risks from cybersecurity threats that may materially affect the Company, see "Risk Factors" under the heading "Cybersecurity and Data Privacy Risks." (Part I, Item 1A of this 2023 Form 10-K).


text: Cybersecurity Governance Cybersecurity risk management is a part of our risk management process and is subject to oversight by our Board of Directors and management. Our Board of Directors has delegated oversight and mitigation of risks from cybersecurity threats to our Audit Committee. Our Audit Committee receives quarterly reports from either our CIO or our General Counsel concerning any significant cybersecurity threats, risks, and the tools and processes we have implemented for mitigation. Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management including the following: • The Information Security Executive Committee consists of our General Counsel, Chief Accounting Officer, Chief Compliance Officer, CIO, and Vice Presidents of Human Resources from select business units. They are responsible for setting broad policy and communicating to the Chief Executive Officer, Chief Financial Officer, and the Board of Directors on potential material cybersecurity incidents, which may require disclosure. • The Information Security Council consists of our CIO, Chief Information Security Officer ("CISO"), in-house information security experts, and information technology experts and leaders from across the Company. The CIO leads this committee and communicates with the Information Security Executive Committee as required. • The Information Security Team consists of cybersecurity professionals primarily responsible for managing cybersecurity at Viad. This team has the primary responsibility for identifying, assessing, and managing material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware, software, and critical data. This team is led by our CIO, who has over 30 years of experience in information technology including cybersecurity oversight. This team includes the following: • The CISO is an external expert who works with the Viad Information Security team on a fractional basis, reporting directly to the CIO and reporting periodically to our Board of Directors. The CISO is an information security professional with over 20 years of experience guiding and overseeing multiple companies' development and implementation of information security strategy. • The Vice President of Global Infrastructure is an internal role directly reporting to the CIO and responsible for implementing, maintaining, and providing oversight of the IT Infrastructure and the Information Security Team. • The Security Architect is an internal role who leads the day-to-day operations of the Information Security team and oversees the individual analysts and IT experts on the team. • The Security Incident Response Team ("SIRT") is responsible for executing the IRP. The SIRT comprises individuals from multiple departments, divisions, and disciplines. Members of the SIRT are trained in incident response and reporting procedures.


text: Introduction: The medical device industry faces unique cybersecurity challenges, given the sensitive nature of the data and the critical role of devices in patient care. Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as information about our employees, contractors, vendors, suppliers, patients and customers. We remain committed to implementing robust security measures to protect against potential cyber threats and vulnerabilities that are constantly evolving across the globe.

companyName: Inogen Inc

ticker: INGN


text: Risk Management and Strategy: We have processes for assessing, identifying, and managing cybersecurity threats, and cybersecurity is an integral part of our overall enterprise risk management program which is overseen by our Audit Committee and the Board. Our strategy includes a comprehensive cybersecurity framework, utilizing advanced technologies and methodologies, such as cloud migrations and deployment of threat detection tools to effectively mitigate potential risks. Continuous risk assessments help us better refine our strategy, guiding the deployment of technical safeguards and shaping our incident response plans. For acquired companies, our integration strategies prioritize establishing comprehensive timelines for harmonizing information security, data privacy, and cybersecurity practices. This includes a strong focus on aligning employee education programs to ensure a seamless transition and uphold security and privacy standards across our entities.


text: Our cybersecurity infrastructure is based on a multi-layered defense framework, aligned with the U.S. National Institute of Standards and Technology (NIST) guidelines. We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers, ensuring the service providers adhere to our security standards, thereby safeguarding our integrated operations. The strategic migration of our data centers and infrastructure to secure cloud environments, coupled with the implementation of targeted technical cybersecurity measures, underscores our dedication to establishing foundational security across our users, applications, data, systems, and networks.


text: We have established a comprehensive incident response plan to swiftly address and recover from cybersecurity incidents, minimizing operational impact. We conduct regular trainings and simulations to enhance our team's awareness and preparedness against cyber threats. Biannual penetration testing and regular assessments by external experts validate the effectiveness of our cybersecurity measures. Our proactive approach to addressing identified vulnerabilities affirms the continuous improvement of our security posture.


text: Use of Consultants and Advisors: We engage various third-party cybersecurity service providers to assess and enhance our cybersecurity practices and assist with protection and monitoring of our systems and information, including with respect to, network monitoring, endpoint protection, vulnerability assessments and penetration testing. We engage cybersecurity consultants, auditors, and other third parties to assess and enhance our cybersecurity practices, such as a third-party consulting firm to evaluate our cyber processes including an assessment of our incident response procedures.


text: We have processes to evaluate third-party service providers and vendors that have access to sensitive systems and company and customer data, which may include due diligence procedures such as assessments of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. Following an assessment, we determine and prioritize service provider risk based on potential threat impact and likelihood, and such risk determinations drive the level of due diligence and ongoing compliance monitoring required for each service provider.


text: Board Oversight and Management's Role: The Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee oversees the proper functioning of our cybersecurity risk management program to ensures strategic alignment and governance of our cybersecurity efforts at the highest level. In particular, the Audit Committee assists the Board in its oversight of management's responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our information technology systems, processes and data.


text: Management has implemented risk management structures, policies and procedures, and Management is responsible for our day-to-day cybersecurity risk management. Our Chief Data and Information Officer (CDIO) is responsible for our day-to-day assessment and management of cybersecurity risks. Our Enterprise Enablement function facilitates a cross-departmental approach, ensuring the executive leadership team receives quarterly updates on cybersecurity from various teams. This strategy promotes a comprehensive stakeholder engagement and enhances management oversight on cybersecurity. The updates cover progress on ongoing cybersecurity initiatives, insights from any potential threats or incidents, outputs and action plans from external vulnerability and penetration tests, and key performance metrics in line with industry standards.


text: Risks from Material Cybersecurity Threats: Despite ongoing threats like cyber-attacks, phishing, and ransomware, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on our business strategy, results of operations or financial condition. Our proactive security measures, alongside those of our third-party vendors, aim to protect our information technology systems and the sensitive data they hold. Although these risks have not yet materially impacted our business, we remain vigilant, continuously monitoring and adapting to evolving cybersecurity threats.


text: Risk Management and Strategy Standard BioTools regularly assesses risks from cybersecurity threats; monitors our information systems for potential vulnerabilities; and tests those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to protect against cyber security incidents, as well as to identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. As part of this program, we conduct periodic assessments of our assets to evaluate the effectiveness of applicable security controls. These assessments are informed by industry standard frameworks (NIST, ISO) and include a review of our information security controls, policies and procedures to assess cybersecurity maturity against industry standards. In accordance with our IT Risk Management Program, we actively identify and assess risks based on the probability and potential impact to key business systems and processes. All risks identified will be assessed to identify the range of possible outcomes and risks will be prioritized by their level of importance. Each risk will be assigned to a risk owner who will track, monitor, and report on the status with a risk response aligned to the probability and impact of occurrence. Risks that are considered high are incorporated into our corporate risk management program overseen by the Audit Committee and our Board of Directors.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB


text: All employees receive cybersecurity training upon hire with at least annual training thereafter with job-specific topic considerations. Our Information Security team, consisting of the VP of Information Technology, Sr. Manager of Network Security and IT Security Manger, among others, engage third-party vendors to assist with providing timely cybersecurity threat alerts in addition to monitoring for cybersecurity threats and our defenses against cyberattacks. This monitoring includes the proactive identification of vulnerabilities in our systems through testing and threat intelligence awareness. The employees within our Information Security team and broader IT team who specialize in cybersecurity operations are responsible for coordinating and overseeing the activities of these third-party vendors.


text: Additionally, we require each third-party service provider with access to our internal systems, applications or data to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. Our practice is to perform due diligence, including the completion of security questionnaires and risk assessments, as appropriate, on these third parties.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition in our risk factor titled "Security incidents, loss of data, cyberattacks, and other information technology failures could disrupt our operations, damage our reputation, and adversely affect our business, operations, and financial results," in Part I, Item 1A. "Risk Factors." Refer to this risk factor for additional description of cybersecurity risks and potential related impacts on our Company.


text: As previously disclosed, in early 2019, we became aware of a ransomware attack that infiltrated and encrypted certain information technology systems, including systems containing critical business data. The financial impact of this incident was not material, and there were no changes to the previously released financial results or financial statements. As previously disclosed, immediately following the discovery, we commenced an investigation and were able to recover access to the compromised systems and restore their operation without significant loss of business data within weeks of the incident. Following the incident, we implemented additional protective measures and internal control policies and procedures. We also retained a professional cybersecurity investigation firm to conduct a full forensic analysis of the incident, and concluded that there was no evidence of malware, persistence mechanisms or other compromised exchange on-premises accounts within the Company's environment.


text: In early 2024, Standard BioTools completed a merger with SomaLogic Operating Co, Inc. Critical to integration activities has been a wholesale review of policies, procedures and tools relevant to the combined cybersecurity environment with the objective of deploying and maintaining those which serve to reinforce our security presence to the greatest extent. While these activities persist, it has been noted that the SomaLogic organization takes a comparable, if not more stringent, approach to their cyber and information security posture inclusive of their ongoing ISO 27001 compliance certification.


text: While our management team is responsible for the day-to-day management of the risks Standard BioTools faces, our Board has the responsibility to oversee management's processes for identifying, monitoring, and addressing enterprise risks, evaluate and discuss with management its assessments of matters relating to enterprise risks, and oversee and monitor management's plans to address such risks. The Board takes an enterprise-wide approach to risk management designed to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance, and to enhance stockholder value. In order to understand the most significant risks faced by the Company and the steps being taken to manage those risks, Standard BioTools conducts quarterly enterprise risk management assessments, facilitated by the Company's executive leadership team in collaboration with the internal audit function, which are presented by management at each quarterly Board meeting. The Board's review of our business is an integral aspect of its assessment of management's tolerance for risk and its determination as to the appropriate level of risk for our Company.


text: Although the Board has determined that enterprise risk management should be the responsibility of the Board as a whole, it has delegated responsibility to oversee specific areas of risk management to its committees. Our Audit Committee oversees and reviews the Company's cybersecurity, data privacy, and other information technology risks, controls and procedures, including the Company's plans to mitigate cybersecurity risks and respond to data breaches. At periodic meetings of the Board and its committees and in other meetings and discussions, management reports to the Board and its committees with respect to the most significant risks that could affect our business, including cybersecurity-related risks. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident to meet reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our cybersecurity risk management and strategy processes are led by our Chief Financial Officer and our Vice President of Information Technology. Our Vice President of Information Technology has over 18 years of work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and has carried relevant degrees and certifications, including Certified Information Systems Auditor. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the Audit Committee of our Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, on an at least annual basis. Should a material breach be identified, as defined by the Board and the executive team, these management team members will notify the executive team and the Board and draft the required disclosure.


text: We maintain processes for identifying, assessing, and managing material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K) as part of our broader enterprise risk management program under the oversight of the Audit Committee of the Company's Board of Directors. These processes include a wide variety of mechanisms, controls, technologies, systems, and methods that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting data. We also use systems and processes to oversee and identify risks from cybersecurity threats associated with our third-party service providers.

companyName: Xperi Inc.

ticker: XPER


text: Our corporate information security organization, led by our Chief Information Officer ("CIO"), is responsible for our cybersecurity risk management and mitigation, incident prevention, detection, and remediation. This team's leadership includes professionals with deep cybersecurity expertise. This team collaborates with technical and business stakeholders across our businesses to analyze risk and form detection, mitigation and remediation strategies. They engage outside legal counsel, experts, consultants, and other third parties to perform regular audits, assist with forensic investigations, or address cybersecurity threats and incidents. As appropriate, they obtain input on the security industry and threat trends from external experts and consultants.


text: Significant incidents are reviewed by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as being or becoming potentially material is promptly escalated for further assessment and reported to designated members of senior management. Senior management is responsible for assessing the materiality of an incident, complying with any regulatory requirements, and communicating relevant information to the Audit Committee, as appropriate. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters.


text: Although the risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition to date, there can be no assurance that they will not be materially affected by such risks or a material incident in the future, or that we have not experienced an undetected cybersecurity incident. As discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to the Company, including potentially to our results of operations and financial condition. See "Risk Factors — Our systems, networks and online business activities and those of third parties that we utilize in our operations are subject to cybersecurity and stability risks, information technology system failures, and security breaches."


text: The Company's Board of Directors has oversight of our strategic and business risk management and has delegated cybersecurity risk management oversight to the Audit Committee of the Board. The Audit Committee oversees the guidelines and policies governing the process by which management assesses and manages our exposure to risk, including material risks from cybersecurity threats. The Audit Committee receives regular updates from management, including our CIO, regarding our cybersecurity risk management program, including cybersecurity risks, threats, incidents, and mitigation strategies.


text: Cybersecurity Risk Management and Strategy Due to the prevalence of cyberattacks and other cyber incidents directed at public companies, cybersecurity is a principal element of our overall enterprise risk management program. We have a multilayered approach for assessing, identifying and managing cybersecurity risks, which is designed to help protect the Company's information assets and operations from internal and external cyber threats by understanding and seeking to manage risk while protecting employee and customer information from unauthorized access or attack, as well as secure our networks, systems and devices. Cybersecurity is one of the top enterprise risks that we have identified. As part of our quarterly enterprise risk management meetings, we discuss efforts to manage this risk and we assess the degree of risk and whether it is increasing or decreasing.

companyName: LL Flooring Holdings, Inc.


text: We devote significant resources to protecting and evolving the security of our computer systems, software, networks and other technology assets. Our cybersecurity risk management processes include physical, procedural and technical safeguards. Our cybersecurity policies, standards and procedures include cyber and data breach response plans, which are benchmarked against the National Institute of Standards and Technology Cybersecurity Framework. The Company's incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations. The Company seeks to continually improve its policies and practices to identify potential and emerging security risks and develop mitigations for those risks. For example, the Company regularly conducts phishing tests, penetration tests and tabletop simulations to help discover potential vulnerabilities, which enable improved decision-making and prioritization and promote monitoring and reporting across compliance functions. As part of its overall risk mitigation strategy, the Company also maintains cyber insurance coverage.


text: We engage external parties, including consultants, computer security firms, forensic firms, public relations professionals and attorneys, to advise us on our preparedness and risk management activities. We also regularly consult with industry groups and law enforcement on emerging industry trends.


text: In order to oversee and identify risks from cybersecurity threats associated with the Company's use of third-party service providers, we conduct a security risk assessment on all proposed new third party vendors who will have access to our information and data. We have standard contractual language that we require for vendors who will have access to sensitive data.


text: We do not believe that there are currently any risks from cybersecurity threats of which we are aware that are reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition. We did experience a network security incident in 2019, which was disclosed previously, from which we have incorporated lessons learned and improved our risk management program. Despite our security measures, however, there is no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For additional information regarding the risks to the Company associated with cybersecurity incidents, see "If our management information systems, including our digital platform or our customer contact center, experience disruptions, it could disrupt our business and reduce our net sales" included in Part I, Item 1A (Risk Factors) of this Annual Report.


text: Cybersecurity Governance and Oversight The Audit Committee of the Company's Board of Directors provides direct oversight over cybersecurity risk. The Audit Committee receives and provides feedback on quarterly updates from management regarding cybersecurity and is notified between such updates regarding new cybersecurity threats or incidents. Information presented at the quarterly updates includes any emerging risks or key topics and includes training initiatives, the status of projects to strengthen cybersecurity, cyber readiness, incident tracking, mitigation efforts and response plans. The full Board of Directors receives regular reports from the Audit Committee, as well as an annual report from management highlighting key aspects of our cybersecurity risk management activities and the emerging threat landscape.


text: The Company has a Chief Information Security Officer (the "CISO") whose team (the "IT Security Team") is responsible for leading company-wide cybersecurity strategy, policy, standards and processes and works across all areas of the Company to protect the Company and its employees and customers against cybersecurity risks, perform investigations and respond to cybersecurity incidents. The CISO reports to the Chief Technology Officer ("CTO") who is also actively involved with assessing and managing cybersecurity risks. The CISO and the CTO are responsible for the quarterly updates to the Audit Committee regarding cybersecurity. The CISO has 28 years of experience in the IT field, with ten of those years in cybersecurity. The IT Security Team has a combined experience of 42 years and two members of the IT Security Team have obtained their Certified Ethical Hacker certifications. The CTO has over 34 years of experience in the IT field with a broad understanding of e-commerce and customer facing technologies.


text: In an effort to prevent and detect cyber threats, the Company provides all employees with cybersecurity prevention training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately.


text: Risk Management and Strategy We have implemented procedures for assessing, identifying and managing significant risks from cybersecurity threats and have incorporated these procedures into our overall risk management systems and processes. We regularly evaluate significant risks from cybersecurity attacks, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information stored there. The program to manage cybersecurity risks has tools and activities designed to identify, examine and manage current and potential cybersecurity threats, as well as plans and strategies designed to deal with threats and incidents.

companyName: 89bio, Inc.


text: We regularly evaluate the cybersecurity risks that could affect our information systems, as well as on an ad hoc basis when there is a significant change in how we do business that may expose our information systems to more such risks. These evaluations include identifying the possible internal and external risks, how likely and harmful they are, and whether our current policies, procedures, systems, and safeguards are adequate to handle them.


text: We use these risk assessments to design, implement, and maintain appropriate safeguards that are intended to mitigate identified risks, address any shortcomings in our existing safeguards, and regularly check how well our safeguards work. Our information technology ("IT") department is primarily responsible for evaluating, overseeing, and handling our cybersecurity risks to manage the process of risk assessment and mitigation. We have established a cross-functional IT Security Steering Committee that oversees the management of our cybersecurity risks and execution of any mitigation efforts.


text: Our IT department and Company management work together to check and improve our safeguards as part of our overall risk management system. We also periodically provide training to our employees on these safeguards and keep them informed of our cybersecurity policies through regular communications across the Company.


text: We work with consultants or other third parties as part of our risk assessment processes, when appropriate. They help us create and execute our cybersecurity policies and procedures and check and test our safeguards. We ask key third-party service providers to confirm that it can apply and keep appropriate cybersecurity measures in line with all relevant laws, to apply and keep reasonable cybersecurity measures when they work with us, and to promptly report any possible breach of their cybersecurity measures that could impact our company.


text: We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. For additional information regarding these risks, please refer to Item 1A, "Risk Factors," "We depend on our information technology systems and those of our third-party collaborators, service providers, contractors or consultants. Our internal computer systems, or those of our third-party collaborators, service providers, contractors or consultants, may fail or suffer security breaches, disruptions, or incidents, which could result in a material disruption of our development programs or loss of data or compromise the privacy, security, integrity or confidentiality of sensitive information related to our business and have a material adverse effect on our reputation, business, financial condition or results of operations" in this Annual Report on Form 10-K.


text: Our board of directors oversees our overall risk management process and significant risks facing us, including cybersecurity risks. The audit committee, which is comprised solely of independent directors, has been designated by our board of directors to oversee cybersecurity risks. Our board of directors oversees and evaluates strategic risk exposure, while our executive officers manage the significant risks we encounter on a daily basis.


text: The audit committee receives periodic briefings from our Chief Financial Officer, the Chair of the IT Security Steering Committee, regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, and activities of third parties. Our audit committee provides periodic updates to the board of directors on such reports.


text: The IT Security Steering Committee, which is in charge of our cybersecurity policies and procedures, including the ones discussed in "Risk Management and Strategy" above, is led by our Chief Financial Officer, who has eight years of senior leadership experience at public biotechnology companies, including five years with 89bio. The IT Security Steering committee also includes our Director of IT, who is an experienced Information Technology professional and has over 20 years of experience managing information technology, of which 10 years pertain to cybersecurity related experience.


text: Cybersecurity Risk Management Process We have developed and continue to enhance our cybersecurity program to help secure our computer systems, software, networks, and data against material risks from cybersecurity threats, and help manage the material cybersecurity risks associated with our use of third-party service providers.

companyName: BARRETT BUSINESS SERVICES INC

ticker: BBSI


text: BBSI has integrated cybersecurity risk management into our overall risk management framework to identify, assess, and manage cybersecurity risks. As part of our integrated risk management process, our technology and information security team work closely with our management team on an ongoing basis to identify and respond to cybersecurity threats. Our proactive approach to cybersecurity risk management includes cybersecurity risk assessments performed internally by our IT security team and externally by third-party experts, penetration and vulnerability testing using third-party vendors and tools, tabletop exercises that simulate cybersecurity incidents, cybersecurity awareness training, and internal audit assessments of critical IT controls.


text: Use of Cybersecurity Experts Due to the complex and evolving cybersecurity threat landscape, BBSI engages third-party experts to conduct in-depth threat assessments, identify vulnerabilities, monitor and detect threats, and offer strategic insights into our risk management process. Leveraging the knowledge, expertise, and resources of third-party experts, we regularly evaluate our cybersecurity risk management strategy to help us align with best practices and address cybersecurity threats that could impact our ability to achieve our business objectives.


text: Third-Party Service Provider Risk Management We utilize third-party service providers for a variety of reasons, including, without limitation, infrastructure and SaaS cloud computing services, technology and business process service providers, content delivery to customers, back-office support, and other functions. Such providers may have access to information about BBSI or that we hold about our customers, associates or vendors.


text: To mitigate the cybersecurity risk associated with the use of third-party service providers, we tier our third-party service providers based on their risk profile to establish applicable cybersecurity risk review standards and evaluate those providers in accordance with the tiering process. BBSI also relies on its third-party service providers to maintain cybersecurity control environments that address the risks associated with the products and services they provide to BBSI.


text: Cybersecurity Threats We are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect BBSI, including our business strategy, results of operations, or financial condition. Despite our efforts to ensure the integrity of our computer systems, software, networks, third-party relationships, and other technology assets, we may not be able to anticipate, detect, or recognize threats to our systems and assets, or to implement effective preventative measures against all cyber threats, given the sophistication of the techniques used. For further discussion, see Item 1A. "Risk Factors – Risks Related to Technology."


text: Board Oversight of Cybersecurity Risk Our Board of Directors has a significant role in the oversight of BBSI's cybersecurity risk. The Board's Risk Management Committee provides oversight of BBSI's enterprise-wide risk management framework, including the strategies, policies, procedures, processes, and systems established by management to identify, assess, measure, monitor, and manage cybersecurity and other risks facing the Company. The Board of Directors also periodically receives reports from third-party consultants on the current cybersecurity threat environment, the results of third-party penetration testing, and the evaluation of the Company's cybersecurity preparedness.


text: Management's Role in Assessing and Managing Cybersecurity Risk BBSI's Chief Information Security Officer ("CISO") leads our enterprise information security program and is primarily responsible for the assessment and management of the Company's cybersecurity risk. The CISO has extensive experience in information technology and cybersecurity, including at another publicly traded company. The CISO oversees our cybersecurity risk management framework and manages a team of IT security professionals to identify and prioritize cybersecurity risks. The CISO also utilizes the expertise of third-party security partners to provide threat detection support, vulnerability management, incident response, penetration testing, and consulting services.


text: Ongoing Monitoring and Reporting of Cybersecurity Incidents The Company has an internal security team, supplemented with third-party security partners, to consistently monitor, detect and respond to potential cybersecurity incidents. The Company has a cybersecurity incident reporting protocol that provides a mechanism for the appropriate members of management and the Board to be made aware of cybersecurity incidents. The Company also requires security awareness training for all employees to enable employees to understand their role in preventing and reporting cybersecurity incidents.


text: Reporting to the Board of Directors The CISO and Chief Information Officer ("CIO") regularly update the Board's Risk Management Committee on cybersecurity risks that the Company faces and the risk mitigation strategies that the Company employs to respond to those risks, with meetings generally occurring quarterly.


text: Cybersecurity Risk Management and Strategy The Company is externally managed by the Advisor and has no employees or internal information systems. Thus, the Company relies on the Advisor, BlackRock, Inc. ("BlackRock") as well as the custodian and other service providers to protect the Company's information from cybersecurity threats. The Company's chief compliance officer (the "CCO") oversees the Company's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board of Directors. The CCO and the Advisor also review key Company service providers' compliance and risk management policies and procedures related to cybersecurity matters, evaluate such service providers' use of information systems, which have the potential to subject the Company to information technology vulnerabilities, and receive reports from the Company's service providers regarding any cybersecurity threats and incidents.

companyName: BlackRock Direct Lending Corp.


text: Specifically, the Company relies on the enterprise risk management ("ERM") framework of BlackRock, Inc. ("BlackRock") for the Company's cybersecurity risk management and strategy. The Board of Directors of the Company periodically receives reports from BlackRock and from the Advisor regarding BlackRock's cybersecurity program. Key aspects of the ERM framework are summarized below.


text: BlackRock's Enterprise Risk Management Framework BlackRock recognizes the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Cybersecurity represents an important component of BlackRock's approach to ERM. BlackRock leverages a multi-lines-of-defense model with cybersecurity operational processes executed by global information security and other teams and dedicated internal audit technology and technology risk management ("TRM") teams that independently review technology risks. BlackRock's cybersecurity program is fully integrated into its ERM framework and is aligned with recognized frameworks, including NIST CSF, FFIEC CAT, FedRAMP, SOC 1/2, ISO 27001/2 and others. BlackRock aims to inform and continuously improve its cybersecurity program through engagement with regulatory, client, insurer, vendor, partner, peer, government and industry organizations and associations, as well as external audit, technology risk, information security and other assessments.


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas: o Governance: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's board of directors (BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC").


text: o Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks.


text: o Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls; perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention; tabletop exercises, ongoing vulnerability and patch management; vendor due diligence; multi-factor authentication; device encryption; application security, code testing and penetration testing; endpoint security, including anti-malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges; employee awareness, training, and phishing testing; data loss prevention program and monitoring; information security incident reporting and monitoring; and layered and comprehensive access controls.


text: o Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis.


text: o Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third-party systems. Operational incidents can arise as a result of failures by third parties with which BlackRock does business, such as failures by internet, communication technology and cloud service providers or other vendors to adequately follow processes and procedures, safeguard their systems or prevent system disruptions or cyber-attacks. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.


text: o Education and Awareness: BlackRock's employees and contractors are required to complete an annual information security training to equip them with effective tools to address cybersecurity threats, and to receive communications on BlackRock's evolving information security policies and procedures.


text: BlackRock's global information security team, in collaboration with the technology risk and internal audit teams, engages in the periodic assessment and testing of BlackRock's cyber risks and cybersecurity program. These efforts may include a wide range of activities, including audits, assessments, wargames and "tabletop" exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. BlackRock also participates in financial services industry and government forums in an effort to improve both internal and sector cybersecurity defense. BlackRock regularly engages third parties and advisors to assess its cybersecurity control environment. The results of certain program and control assessments are reported to the Risk Committee, and BlackRock adjusts its cybersecurity program as appropriate based on the information provided by these assessments.


text: As of December 31, 2023, the Company is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.


text: Cybersecurity Governance The Board of Directors of the Company periodically receives reports from BlackRock and from the Advisor regarding BlackRock's cybersecurity program. The CCO delivers quarterly reports to the Board of Directors of the Company. Team members who support the Company's information security program have relevant educational and industry experience.


text: At the BlackRock parent level, BlackRock's Board is actively engaged in the oversight of BlackRock's risk management program. The Risk Committee assists the Board with its oversight of BlackRock's levels of risk, risk assessment, risk management and related policies and processes, including risks arising from cybersecurity threats. The Risk Committee receives regular reports on BlackRock's cybersecurity program, technology resilience risk management and related developments from members of our information security team, including the CISO. The Board and the Risk Committee also receive information regarding cybersecurity incidents that meet certain reporting thresholds. On an annual basis, senior members of BlackRock's technology, risk and information security teams provide a comprehensive overview of BlackRock's cyber risk and related programs to a joint session of the Board's Risk and Audit Committees.


text: Technology and cybersecurity risks at BlackRock are also overseen by the TRCC, a dedicated management risk governance committee and sub-committee of the firmwide ERC. The chair of the TRCC is appointed by the head of Enterprise Risk Management at BlackRock and its members include the CISO as well as a broad range of senior business stakeholders across BlackRock. The TRCC is responsible for oversight of BlackRock's technology and cybersecurity risk management practices and helps ensure that technology and cybersecurity risks remain within firmwide risk tolerances and technology and cybersecurity risk issues are escalated as appropriate to the ERC and other committees. The TRCC also reviews any relevant technology and cybersecurity risk related issues and helps ensure that they are appropriately escalated, reported, and remediated.


text: BlackRock's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by BlackRock's CISO. As of December 31, 2023, the CISO had over 30 years of experience in information technology with a 25-year concentration in information security, including previously serving as the CISO at several global financial institutions, and held the Certified Information Systems Security Professional certification. The CISO works closely with the leadership team and other subject matter experts in the global cybersecurity group, who collectively have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and overseeing cybersecurity controls in technology risk and audit functions, as well as having relevant degrees and industry-leading certifications.


text: The CISO and members of the TRCC monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation of BlackRock's incident response plan.