text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and clinical data management and processing service providers. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes a review of certain information security measures of certain vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our internal technology systems or sensitive information, or those used by our third-party collaborators, vendors, contractors or consultants, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."

companyName: Rani Therapeutics Holdings, Inc.

ticker: RANI

secItem: Item 1C


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our management, including our CFO, who oversees our information security team and has over 2 years of experience overseeing such function.


text: Our CFO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. The incident management team helps us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the board of directors for certain cybersecurity incidents. The board receives periodic reports from management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The board also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: HilleVax, Inc.


text: We design and assess our program based on the Center for Internet Security Framework (CISF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CISF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • an external security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Risks Related to Our Business Operations and Industry - Our information technology systems, or those of any of our service providers, may fail or suffer security breaches, loss or leakage of data and other disruptions, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Audit Committee) oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from management, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including the General Counsel and Chief Administrative Officer and Senior Director, IT, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants.


text: Our management team's experience includes extensive experience working in the information technology field and securing corporate information technology systems, including engaging with third party security vendors to perform cyber risk assessments and penetration testing.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program and information technology function and are designed to help protect our information assets and operations from cyber threats, protect employee and patient information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, and routine review of our operations to identify risks and enhance our practices. We engage certain external parties, including consultants and computer security firms, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers when engaging them in order to help protect us from any related vulnerabilities.

companyName: Trevi Therapeutics, Inc.

ticker: TRVI


text: Our board of directors does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: The audit committee of our board of directors provides direct oversight over cybersecurity risk and provides updates to the board of directors regarding such oversight. The audit committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: We have also established a Cybersecurity Committee that meets on a quarterly basis to review and agree on actions to address cybersecurity risks. The Cybersecurity Committee is led by our chief information officer, or CIO, who is a part-time consultant and includes our chief executive officer and chief financial officer. Our CIO, who reports to our chief financial officer, is responsible for the strategic leadership of our cybersecurity programs, identification of cybersecurity risks and the mitigation plans that address these risks. With over 25 years of experience in information technology, the CIO works alongside individuals across other functions, such as clinical operations, legal and quality compliance, to establish and implement our cybersecurity strategy. Our CIO has a bachelor's degree in Technology and an M.B.A. along with over 10 years of experience in information technology in the life sciences industry.


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, and asset use, and educates employees on the importance of reporting all incidents immediately. We conduct frequent phishing simulations requiring employees to identify and report simulated phishing emails. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: Cybersecurity Risk Management and Strategy As part of our enterprise risk management process, we have adopted a cybersecurity risk management program designed to assess, identify, and mitigate risks from cybersecurity threats. Our cybersecurity risk management program is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Our cybersecurity risk management program is supported by third parties, including a managed services provider that assists the Company with, among other things, threat monitoring and incident response.

companyName: Fusion Pharmaceuticals Inc.


text: Our cybersecurity risk management program utilizes tools and processes designed to prevent, detect, and mitigate current and emerging cybersecurity threats, and we maintain procedures to address cybersecurity incidents. These tools and procedures include, but are not limited to, the use of external virtual chief information security officer (vCISO) services, annual cybersecurity risk assessments, and vulnerability scans and penetration tests. Our annual cybersecurity risk assessments are centered on three key components of cybersecurity risk management: (1) the identification of cybersecurity risks and threats; (2) the evaluation of the likelihood that these cybersecurity risks will manifest into cybersecurity threats and, should they manifest, the severity of their potential consequences; and (3) the establishment of policies and procedures intended to mitigate and contain the harm posed by cybersecurity threats.


text: To encourage consideration of cybersecurity risks across functions, we require employees to participate in annual cybersecurity risk awareness trainings and phishing exercises. Further, we maintain cybersecurity incident response procedures supported by our internal cybersecurity incident management team. The cybersecurity incident management team is comprised of individuals across several areas of the organization – including legal, finance, quality, regulatory, IT, and investor relations. Our cybersecurity incident response program maintains procedures designed to mitigate the harm posed by cybersecurity threat actors as well as to escalate cybersecurity incidents within the organization, if necessary. We engage in tabletop exercises to test our incident response plan.


text: Before purchasing third-party technology or other solutions that involve exposure to the Company's systems or electronic information, we conduct a cybersecurity review of such third parties. This cybersecurity review involves the vendor's completion of questionnaires and, as appropriate, participation in cybersecurity audits.


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats that could affect our information or systems. For more information, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Cybersecurity Governance The Board of Directors has delegated oversight of the Company's cybersecurity program to the Audit Committee of the Board of Directors. As provided in the Audit Committee Charter, the Audit Committee is responsible for reviewing reports on data management and cybersecurity initiatives and significant existing and emerging cybersecurity risks, including cybersecurity incidents, the impact on the Company and its stakeholders of any significant cybersecurity incident and any disclosure obligations arising from any such incidents. Our Senior Director, Information Technology ("IT"), who reports directly to our Chief Financial Officer, has primary responsibility for the day-to-day management of our cybersecurity risk management program. The individual currently operating as our Senior Director, IT has approximately thirty-four years of experience with information technology, including seventeen years of experience managing cybersecurity risk management programs. Our Senior Director, IT is supported by our internal IT team and external IT consultants, and their responsibilities include assessing, monitoring, and managing our cybersecurity risks.


text: Our Senior Director, IT and Chief Financial Officer present, at least annually, to the Audit Committee to discuss management's ongoing cybersecurity risk management program. The annual presentation to the Audit Committee includes information about the sources and nature of risks the Company faces, how management assesses such risks, progress on vulnerability remediation, and current developments in the cybersecurity landscape. In turn, the Chair of the Audit Committee provides an annual readout to the full Board of Directors that includes a summary of the Senior Director, IT and Chief Financial Officer's presentation, to enable discussion of cybersecurity risk management at the full Board level. When appropriate, members of our internal incident response team will also update the executive management team on developments relating to cybersecurity and, if needed, cybersecurity incidents.


text: Assessment, Identification and Management of Material Risks from Cybersecurity We rely on the cybersecurity strategy and policies implemented by Inland. Inland's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Inland's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Inland has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: IPC Alternative Real Estate Income Trust, Inc.


text: Inland's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help our sponsor and Advisor to prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us, our Advisor, and Dealer Manager. Inland's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us, our Advisor, and Dealer Manager, is integrated into Inland's risk management program. In addition, Inland periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs, including performing penetration testing of Inland's networks, and security assessments of the effectiveness of Inland's information technology environment to identify potential vulnerabilities.


text: Inland's cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities as well as regular phishing simulations for all of the employees of the Advisor and its affiliates. Inland undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of our Advisor, and Dealer Manager, and our critical third-party vendors (including the transfer agent) and other partners.


text: Inland has established a Computer Security Incident Response Team ("Inland CSIRT"), which aims to manage and mitigate the impact of cybersecurity breach events, including those arising from or impacting our Advisor, Dealer Manager and service providers (including the transfer agent), tenants, and other business contacts. Members of the Inland CSIRT include Inland's VP Director of IT Infrastructure & Information Security, who has more than 19 years of experience in information technology security and leads Inland's cybersecurity program, and its Head of Technology Strategy, as well as members of the firm's legal, risk, and communications groups. Inland has established a notification decision framework to determine when the Inland CSIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including members of our Advisor's management, and our Board and Audit Committee, as appropriate.


text: Oversight of Cybersecurity Risks The Board and our Audit Committee oversee our cybersecurity risk exposures and the steps taken by management to identify, monitor and mitigate cybersecurity risks to align our risk exposure with our strategic objectives. With respect to such cybersecurity risk oversight, our Board and/or our Audit Committee receive periodic reports and/or updates from management on the primary cybersecurity risks facing us and the Advisor, and the Dealer Manager and the measures we, the Advisor, and the Dealer Manager are taking to mitigate such risks. In addition to such reports and updates, our Board and/or our Audit Committee receive updates from management as to changes to our and the Advisor's and the Dealer Manager's cybersecurity risk profile or certain newly identified risks. In the event of an incident, we intend to follow Inland's incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel, senior leadership and the Board or Audit Committee, as appropriate.


text: Impact of Cybersecurity Risks As of the date of this filing, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Part I, Item 1A, Risk Factors, Risks Related to Our Organizational Structure" for more information regarding cybersecurity risks.


text: Risk Management, Strategy and Governance The Fund is externally managed by the Adviser and has no employees or internal information systems. Thus, the Fund relies on the Adviser as well as its administrator, custodian and other service providers to protect the Fund's information from cybersecurity threats. The Fund's Chief Compliance Officer (the "CCO"), in coordination with the Adviser's Compliance Department and Information Security Working Group (the "ISWG"), which includes the Adviser's Chief Technology Officer – Infrastructure and Cybersecurity (the "CTO"), Chief Compliance Officer, General Counsel and Chief Financial Officer or their respective designees and teams, oversees the Fund's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board of Trustees. The ISWG uses various security tools that help the Adviser identify, escalate, investigate, resolve and recover from cybersecurity incidents in a timely manner.

companyName: Silver Point Specialty Lending Fund


text: The Adviser also reviews the Fund service providers' compliance and risk management policies and procedures related to cybersecurity matters, monitors such service providers' use of information systems which have the potential to subject the Fund to information technology vulnerabilities and receives regular reports from the Fund's service providers regarding cybersecurity threats and incidents. The CCO provides quarterly reports to the Board of Trustees regarding significant risks to the Fund, including, among others, those relating to cybersecurity. In addition, the CCO informs the Board of Trustees regarding material cybersecurity risks as they arise.


text: The Adviser takes a risk-based approach to cybersecurity and has implemented cybersecurity policies and procedures throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the Adviser deploys specialized security technologies and operational controls including, but not limited to, firewalls, anti-virus systems, passwords, restricted access, and electronic surveillance/monitoring. The Adviser also conducts regular internal penetration testing to assess information technology vulnerabilities, utilizes third-party technology solutions for real-time vulnerability management and engages a third-party consultant to conduct a cybersecurity assessment and preparedness analysis annually. In addition, the ISWG meets quarterly and on an as-needed basis.


text: The ISWG: (i) reviews any material information security incidents and documents the results of any such reviews and any responsive or remedial actions taken in connection therewith; (ii) escalates any significant incidents involving threats to, or breaches of, the cybersecurity protections set forth in the Adviser's Information Security Program and Policies and Procedures (the "Information Security Program") to the Adviser's Compliance Committee or Operating Committee; and (iii) updates the Information Security Program as needed, based on, among other things: (a) results of testing and monitoring pursuant to the Information Security Program; (b) changes to applicable laws, rules, or regulations; (c) new or prospective cyber threats; and (d) material changes to the business and operation of the Adviser and the Fund. In addition, the ISWG is informed by the CTO of: (i) any risks to personal information and the Adviser's information systems; (ii) ways to manage and control such risks; (iii) any concerns regarding third party vendor arrangements that could impact information security; (iv) the results of testing done in connection with the Information Security Program; and (v) any other matters that the CTO believes should be reviewed by the ISWG. The Information Security Program: (i) implements and maintains administrative, technical, and physical safeguards for the protection of personal information; (ii) protects against any anticipated threats or hazards to the security of such information, other Adviser information, and the Adviser's information systems; and (iii) prevents unauthorized access to or use of the Adviser's systems or personal information. In addition, the ISWG maintains an Incident Response Plan designed to define, in advance, the actions to be taken in the event that the Adviser suffers a digital attack or a potential cybersecurity breach.


text: The Adviser partners with third parties to assess the effectiveness of our cybersecurity prevention and response policies and procedures. The Adviser utilizes a third party to perform penetration testing once a year. Penetration testing involves scanning the Adviser's internet points of entry and attempting to detect potential vulnerabilities. Remediation is performed, if needed, and a second scan is conducted. Internal penetration testing is performed by a combination of regularly scheduled vulnerability scans and using a third party service for real-time vulnerability management. To assess the capability to maintain operation of its business in the event of serious failure or disruption of essential services located in its primary data center, the Adviser also performs business continuity testing twice a year. See "Item 1A. Risk Factors—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, financial condition and operating results."


text: Cyber Risk Management and Strategy We, under the oversight of the audit committee of our board of directors, have implemented and maintain a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats. Our risk management is supported by various tools and technologies, including third-party security solutions, monitoring, and alerting tools, designed to monitor, identify, and address risks from cybersecurity threats.

companyName: Cabaletta Bio, Inc.

ticker: CABA


text: We engage with other third-party providers and consultants to support our cyber risk management efforts, including through periodic security testing and assessments. We have a process to assess certain major third-party vendors and service providers, including through a review of responses to compliance questionnaires and contractual requirements, as appropriate.


text: We, like other companies in our industry, face a number of risks from cybersecurity threats in connection with our business. Although such risks have not materially affected, and we do not believe they are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our data and systems. For more information about the risks from cybersecurity threats we face, please see Item 1A- Risk Factors.


text: Governance Related to Cybersecurity Risks Our board of directors, as a whole and through its committees, has responsibility for the periodic review and oversight of information technology risks, including risks from cybersecurity threats.


text: The audit committee is responsible for oversight of our cyber risk management program. The day-to-day management of the cyber program is directed by the Director of IT under the direction of the Chief Financial Officer. Currently, the Director of IT reports to the Chief Financial Officer and provides periodic updates to the Chief Financial Officer on cyber matters.


text: The Director of IT meets with the Chief Financial Officer periodically to discuss and review our cybersecurity risk management processes and to address matters related to potential cybersecurity and information technology risks, with input from the Company's third-party technology providers, as appropriate. The Chief Financial Officer provides periodic reports on cybersecurity and information technology matters to the audit committee, which is responsible for reviewing and overseeing the Company's risk management process, including risks from cybersecurity threats, as set forth in the audit committee charter. The audit committee periodically reports on cybersecurity risk management to the full board of directors.


text: Cyber Risk Management and Strategy Disc Medicine, under the oversight of the audit committee of the board of directors, has implemented and maintains processes to review and manage enterprise risks, including annual assessments of cybersecurity risks, across the Company.

companyName: Disc Medicine, Inc.

ticker: IRON


text: Our cybersecurity risk management program, which is informed by and incorporates elements of recognized industry standards, is designed to identify, assess, and mitigate critical risks from cybersecurity threats. This program includes, but is not limited to, ongoing monitoring for potential critical risks from cybersecurity threats using automated tools. To support our cybersecurity risk management program, we leverage a managed service provider (MSP) that provides ongoing support for the protection of our information technology infrastructure as well as a virtual Chief Information Security Officer, or vCISO. Our cybersecurity risk management strategy is informed by periodic conversations with, and risk assessments conducted by, our vCISO.


text: We have an employee security awareness training program, offered upon employee onboarding and on an annual basis, that is designed to raise awareness of cybersecurity threats across functions as well as to encourage consideration of cybersecurity risks across our Company. As part of this employee training program, we periodically conduct phishing simulations designed to raise employee awareness of such risks.


text: We have also implemented a process to review contractual requirements related to information security obligations included in our agreements with certain third-party vendors and service providers, as appropriate.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems and infrastructure. For more information, please see Item 1A - Risk Factors.


text: Governance Related to Cybersecurity Risks Our Head of Information Technology (IT), under the oversight of our General Counsel, is responsible for the administration and maintenance of our cybersecurity risk management program, including the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who currently holds the title of Head of IT has more than 20 years of experience in information security and cybersecurity risk management.


text: Our Head of IT directly reports to, and meets periodically with, our General Counsel to discuss and review our cybersecurity risk management processes, with input from the Company's MSP and vCISO, as appropriate.


text: Our board of directors has delegated oversight of the Company's cybersecurity program to the audit committee of the board of directors. As provided in the audit committee charter, the audit committee is responsible for reviewing and discussing the Company's information security and risk management programs, controls, and procedures, including high-level review of the threat landscape facing the Company and the Company's strategy to mitigate cybersecurity risks and potential breaches. Under the audit committee charter, the audit committee is also responsible for reviewing the recovery and communication plans for any unplanned outage or security breach.


text: Our Head of IT, twice a year, provides reports to the audit committee on the status of our cybersecurity program, including measures implemented to monitor and address risks from cybersecurity threats, as appropriate. He also reports on a quarterly basis to the executive committee on cybersecurity and information technology matters. The chair of the audit committee provides periodic reports on cybersecurity risk management to the full board of directors. Our General Counsel, on an annual basis, discusses the results of our enterprise risk assessment processes, including risks related to cybersecurity, with the full board of directors.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, information related to our clinical trials, and information of our employees, or Information Systems and Data.

companyName: Landos Biopharma, Inc.


text: The Company's Director of Operations & Administration, with assistance from our third-party cybersecurity vendors, is responsible for identifying, assessing and managing the Company's cybersecurity threats and risks. Together, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, and evaluating threats reported to us.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response policy; incident detection and response tools; risk assessments; encryption of certain data; segregation of certain data; network security controls; access controls; asset management, tracking and disposal; employee training; and monitoring of certain systems. We also have cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise Risk Management Plan which is reviewed by management on a regular basis.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, including legal counsel and certain cybersecurity service providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations, contract manufacturing organizations, application providers, and information technology support. We prioritize the use of known vendors with experience specific to our industry needs and, depending on the nature of the services to be provided, our contracts with certain vendors include certain contractual provisions related to security.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences".


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. Our audit committee of the board of directors is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of risks from cybersecurity threats, as outlined in its charter.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by the Director of Operations & Administration, who reports to the Chief Executive Officer, or CEO, and has experience in identity and access management, escalation and incident response, and risk management. The Director of Operations & Administration is responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Financial Officer, or CFO, and CEO. Management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from the CFO concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives regular reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We are committed to ensuring the confidentiality, availability and integrity of our data. Our cybersecurity strategy is informed, maintained and updated through various methodologies and external resources. As the concerns and issues evolve in cybersecurity, we remain focused on resiliency and continuous improvement to help enhance our cyber posture. We regularly reevaluate the threat landscape and evolve our controls to address new vulnerabilities and threats.

companyName: GTJ REIT, INC.


text: Risk Management and Strategy We regularly utilize information technology and data to operate our business. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, software, and hardware. Our critical data includes confidential, personal, and proprietary data (collectively "Information Assets"). The Company's risk management program is designed to manage identified material risks, which would include material cybersecurity risks. We rely on a team of internal and external resources, including external information technology and information security vendors to assess how identified cybersecurity threats could impact our business. These assessments may leverage, among other processes, industry tools and metrics designed to assist in the assessment of risks from such cybersecurity threats.


text: Accordingly, we work with third party providers to assess the environment to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on the risk assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business.


text: We implement and maintain various technical, physical and organizational controls designed to manage and mitigate material risks from cybersecurity threats to our Information Assets. The cybersecurity risk management and mitigation measures we implement for certain of our Information Assets include: policies and procedures designed to address information security, including external assessments to consider our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; encryption of data; network security controls; physical and electronic access controls; asset management, tracking and disposal; systems monitoring; and employee security training. We also have a cybersecurity training and compliance program in place for the Company whereby our connected employees are tested routinely through simulated phishing attempts.


text: We have not identified known risks, including as a result of prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, refer to Part I, Item 1A. Risk Factors for additional information about cybersecurity-related risks.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by Company management. The Chief Executive Officer, President and Chief Financial Officer discuss the cybersecurity programming. The Chief Financial Officer is responsible for the ongoing engagement of outside third parties to evaluate and update controls as recommended. Management is also responsible for working with appropriate third party vendors to evaluate the Company's risk profile and to update the controls for the Company's technology resources. Management is tasked with integrating cybersecurity considerations into the Company's overall risk management strategy, focus on appropriate priorities and approving related budgets, helping prepare for cybersecurity incidents, and soliciting and reviewing security assessments.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The Board also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: Management is involved with the Company's efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures. Management participates in cybersecurity incident response by anticipating and directing the Company's response to cybersecurity incidents. Our cybersecurity incident response processes are designed to identify and escalate certain cybersecurity incidents and vulnerabilities to members of management. Depending on the circumstances, management may work with third party experts and escalate to the Board as necessary.


text: Risk Management and Strategy As a company externally managed by the Advisor, we rely on Starwood Capital's information technology ("IT") systems, including data hosting facilities and other hardware and software platforms, some of which are hosted by third-party service providers, to assist in conducting our businesses. Starwood Capital's IT systems, like those of most companies, may be vulnerable to certain cybersecurity threats such as ransomware, interruption of services, data breaches, or any other cybersecurity incidents, or a series of related cybersecurity incidents, that could adversely impact our financial condition, results of operations, cash flows or business strategy, including our ability to operate core business functions. In the last fiscal year, Starwood Capital continually monitored the risk landscape and did not experience any cybersecurity breaches, including malware and computer virus attacks that have materially affected, or are reasonably likely to materially affect our financial condition, results of operations, cash flows, or business strategy. For more information on our cybersecurity-related risks, see Part I, "Item 1A. Risk Factors" included elsewhere in this Annual Report on Form 10-K.

companyName: Starwood Real Estate Income Trust, Inc.

ticker: SWDR


text: Starwood Capital considers cybersecurity risks, along with other top risks, within its Enterprise Risk Management ("ERM") framework. The ERM framework includes internal reporting at the business and enterprise levels, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. Starwood Capital has implemented a cybersecurity program that employs various controls and activities aimed at identifying, protecting against, detecting, and responding to cybersecurity threats. These controls and activities include hardware and software inventory tracking, endpoint protection, and network security measures to safeguard our assets from unauthorized access and attacks. Starwood Capital prioritizes data protection through access management designed to permit access only by authorized personnel. Starwood Capital's cybersecurity incident response plan, integrated into the ERM framework, outlines a structured process for handling information security incidents involving assets or data. It guides Starwood Capital's cybersecurity incident response team in containing, eradicating, and recovering from incidents while minimizing damage and disruption. The plan includes a clearly defined notification framework ensuring timely communication with business and management teams based on the incident's severity and potential impact. Additionally, Starwood Capital maintains a cybersecurity insurance policy to mitigate risks associated with cybersecurity incidents. The cybersecurity insurance policy covers both our company and other Starwood Capital affiliates.


text: Starwood Capital also periodically performs simulations and tabletop exercises at a management level and utilizes external resources and consultants, as needed. All employees of Starwood Capital are required to complete an annual computer-based Security Awareness Training Program that includes various topics on cybersecurity risk management best practices. This program educates users on how to identify information security threats and what actions should be taken in the event of a cybersecurity breach. Additionally, the employees of Starwood Capital are regularly tested with phishing campaigns reinforcing their awareness of email threats.


text: Annual risk assessments of Starwood Capital's Information Security Program are conducted to identify emerging information security and third-party risks. In addition, periodic vulnerability assessments and penetration tests are conducted throughout the year to support the identification of risks.


text: Further, Starwood Capital utilizes on-premises and cloud-based security solutions, with real-time monitoring provided by specialized managed third-party security service providers. These third parties collect events generated by critical systems in real-time, filter non-security events, and then correlate the information using security data analytical engines so that personnel of Starwood Capital can identify and analyze threats. With respect to the software platforms that are hosted by third parties, Starwood Capital utilizes an external vendor risk management platform to evaluate, rate, monitor and track vendor risk. The security practices and processes of our third-party service providers are monitored regularly. In addition, we have engaged a third-party to evaluate and review the remediation of cyber risks of our third party service providers, including financial service providers, property managers and professional service firms. For any hosted applications, Starwood Capital inquires if the vendor issues a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, Starwood Capital takes additional steps to assess its cybersecurity preparedness and assess the relationship on that basis. Starwood Capital's assessment of risks associated with the use of third party service providers is part of Starwood Capital's overall cybersecurity risk management framework.


text: Our board of directors is ultimately responsible for the oversight of risks from cybersecurity threats and has delegated responsibility for such oversight of cybersecurity matters to the audit committee. The audit committee receives at least quarterly, or more frequently as needed, updates from the Advisor on our cybersecurity program, including measures taken to address cybersecurity risks and significant cybersecurity incidents.


text: Starwood Capital's Chief Technology Officer, an industry veteran that has been focused on technology for over 40 years and in technology leadership roles at financial institutions for 20 years, leads the overall cybersecurity function and is responsible for developing and implementing Starwood Capital's Information Security Program and managing our response to threats. In addition to its in-house cybersecurity capabilities, at times Starwood Capital also engages third parties to assist with assessing, identifying, and managing cybersecurity risks. Members of Starwood Capital's IT security team, including the third-party security firms utilized as part, of its program, have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification.


text: Risks related to Cybersecurity Incidents We face significant risks related to cybersecurity threats, which could adversely affect our business, financial condition, and results of operations. Cybersecurity incidents, including but not limited to unauthorized access, data breaches, and other malicious activities, could result in the loss or theft of sensitive information, disruption of our operations, and damage to our reputation. While we have implemented measures to protect our information systems, there can be no assurance that these measures will effectively prevent all cybersecurity incidents.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: 1. Data Breaches: A breach of our information systems could lead to unauthorized access to customer or employee data, resulting in reputational harm and legal liabilities.


text: 2. Operational Disruption: Cybersecurity incidents could disrupt our operations, leading to delays in production, delivery, or fulfillment of customer orders.


text: 3. Intellectual Property Theft: Unauthorized access to our proprietary information could result in intellectual property theft, impacting our competitive position in the market.


text: 4. Regulatory and Legal Compliance: Cybersecurity incidents may subject us to regulatory investigations, legal claims, and penalties, affecting our compliance with applicable laws and regulations.


text: 5. Third-Party Relationships: Our reliance on third-party vendors and service providers exposes us to additional cybersecurity risks, and a security breach affecting these entities could impact our operations.


text: Although, to date, cybersecurity incidents have not materially impacted our business strategy, results of operations, or financial condition, there can be no assurances that they will not do so in the future. Refer to "Item 1A. Risk factors" in this Annual Report for additional information about cybersecurity-related risks.


text: Risk Management and Strategy Assessing, Identifying, and Managing Material Cyber Threats We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. We consult with external parties, such as cybersecurity firms and risk management and governance experts, on risk management and strategy. We use a team of outside vendors and government services specializing in IT and cybersecurity that provide expertise, tools, and methodologies to identify and assess vulnerabilities and potential threats. Automated tools and AI-based user behavior analytics also support identification and management of cyber threats. Response to a broad category of threats is immediate and automatic. Security personnel and members of our management are alerted when cyber threats or anomalies are detected. Persistent threats or issues that, in the opinion of management, are material are immediately brought to the attention of our board of directors.


text: In the event of a detected cyber incident by 24/7 monitoring software or employee notification, our IT and cybersecurity provider performs a detailed assessment of the incident, identifies the source of the problem, and resolves the issue as appropriate. If they are unable to resolve the issue, the problem is escalated to our cybersecurity monitoring and detection software provider for resolution. Events which are not routinely resolved by our IT and cybersecurity provider are brought to the attention of the board.


text: In order to mitigate risks of cybersecurity incidents, critical business and operational data are backed up at night and stored offsite for security purposes and to restore data in the event of a breach. Additionally, we provide cybersecurity awareness training of our employees, incident response personnel, and senior management.


text: Our management team, including our vice president of technology, is primarily responsible for assessing and managing our material risks from cybersecurity threats. Management supervises both our internal cybersecurity and IT personnel, as well as our retained external cybersecurity consultants and vendors. Additionally, they supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefing from internal or external security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants or vendors engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Our board of directors, through its Audit & Risk Committee, provides oversight and oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Management, including our vice president of technology, and our Audit & Risk Committee members, of which two members of our committee have received training and certifications on cyber risk governance for public companies, regularly brief our board of directors on our cybersecurity and information security posture as well as cybersecurity incidents deemed to have a moderate or higher business impact, even if viewed as immaterial to us. As cyber threats evolve and become more sophisticated, we believe that the board's involvement in cybersecurity governance ensures that we are adequately focused on resources and protecting the Company's assets and reputation.


text: Vital aspects of our cybersecurity governance that are currently in process or have been implemented include the following: • Governance and Strategy: Management, the Audit & Risk Committee and the board ensure that our cybersecurity strategy is aligned with our business strategy. • Risk Management and Oversight: Our Audit & Risk Committee and the board, as part of the board's enterprise risk management oversight, actively oversee our cybersecurity risk management framework, ensuring that material risks are identified, assessed, and mitigated. • Resource Allocation: o Budget Approval: The board reviews and approves cybersecurity budgets and resource allocations to ensure we have adequate resources to implement and maintain effective cybersecurity measures.


text: o Investment Decisions: The board, based upon recommendation of management or our external vendors and consultants, evaluates and approves significant investments in cybersecurity technologies, training, and talent.


text: o Regulatory Compliance: Management and the board both play a role in overseeing compliance with relevant cybersecurity regulations and legal requirements.


text: o Legal Oversight: Management and the board ensure we have appropriate legal counsel to address cybersecurity-related issues, including breach notification requirements.


text: o Training and Awareness: Members of management and members of our board take reasonable steps to stay informed about cybersecurity trends, threats, and best practices through ongoing education and training. Management reviews Company employee training programs to ensure employees are being trained appropriately and kept up to date on evolving cyber trends.


text: o Board Training: Certain of our board members have received training to understand cybersecurity risks and their role in overseeing cybersecurity.


text: o Periodic Updates: The board receives periodic updates from management, responsible staff and the Audit & Risk Committee regarding the Company's cybersecurity posture, incidents, and risk management efforts.


text: o Communication Strategy: Management, together with the board, are in the process of establishing a communication strategy for addressing cybersecurity disclosures with stakeholders, including customers, employees, and the public.


text: • Performance Evaluation: Included in the board's annual evaluation of the performance of the Company's chief executive officer is the effectiveness of implementing cybersecurity policy and measures, ensuring that cybersecurity policies and practices are effective and aligned with organizational goals. • Cybersecurity Culture: The board fosters a cybersecurity-aware culture throughout the organization, supporting management's efforts to build risk management including cyber into the fabric of the operating culture.


text: Despite these efforts, the rapidly evolving nature of cybersecurity threats requires ongoing vigilance, and there can be no assurance that our efforts will prevent all incidents. In addition to the foregoing, management and the board are evaluating, and intend to implement, further cybersecurity related measures, including without limitation developing a more robust internal policy framework, incident response plan, crisis management planning, and third-party vendor assessments and contractual obligations for third parties that the Company engages with. The Company intends to progress these efforts throughout 2024.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: MiNK Therapeutics, Inc.

ticker: INKT


text: We design and assess our program based on the Information Systems Audit and Control Association's Control Objectives for Information Technologies framework and National Institute of Standards and Technology cybersecurity framework, as well as threat trends identified by multiple external and internal cybersecurity intelligence reports.


text: We contract with external firms to assess our cybersecurity controls. We have processes in place to identify and evaluate risks associated with third party vendors and suppliers. In addition, we have systems in place to maintain business continuity and disaster recovery. Some or all of this work is done through our services agreement with Agenus. To date, we have not experienced any material cybersecurity incidents.


text: We describe whether and how risks from cybersecurity threats are reasonably likely to affect our business, results of operations and financial condition, under the heading "Our internal computer systems, or those of our third-party vendors, collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business" included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which is incorporated by reference into this Item 1C.


text: Cybersecurity Governance Our Audit Committee of the Board of Directors has oversight responsibility for risks and incidents related to cybersecurity threats. As part of our services agreement with Agenus, Agenus' Chief Information Officer provides the Audit Committee and the Board of Directors periodic reports on our cybersecurity risks and any material cybersecurity incidents.


text: Our team of cybersecurity professionals is led by Agenus' Chief Information Officer, who has over 20 years of experience in cybersecurity in regulated industries. Our cybersecurity team monitors the prevention and detection of cybersecurity events and is responsible for incident response and remediation.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: KINETA, INC./DE


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process, appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, among others: • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • undertake regular reviews of our consumer facing policies and statements related to cybersecurity; • proactively inform our customers of substantive changes related to customer data handling; • conduct annual customer data handling and use requirements training for all our employees; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; • conduct regular network monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K); • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and • conduct annual training with all employees on our security standards and requirements.


text: In the event of a cybersecurity incident, we will coordinate with our third-party cybersecurity advisor to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: As part of the above processes, we regularly engage with assessors, consultants, auditors, and other third parties, including by regularly having a third party review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.


text: Our internal processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. We determine an overall risk assessment of potential cybersecurity issues with our third-party suppliers. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. Additionally, if appropriate, we require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management.


text: Our audit committee is responsible for the oversight of risks from cybersecurity threats. At least annually, the audit committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the audit committee generally receives materials including a cybersecurity scorecard and other materials indicating current and emerging material cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and discusses such matters with certain members of management, which include our CFO and President. Members of the audit committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our President. Such individual completed a certificate program with Stanford University on Foundations of Information Security in the first quarter of 2024. In addition, he has over 20 years of executive responsibility for managing public company IT operations, including managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and deployment of internal training and company technology standards. This member of management is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: As discussed above, this member of management reports to the audit committee about cybersecurity threat risks, among other cybersecurity related matters.


text: We take cyber risk seriously as a part of modern enterprise risk management, protecting our stakeholders and assets, and building resilient processes. The modern threat landscape requires us to consider cyber risks, and make determinations regarding how to treat the risks. We evaluate cybersecurity risks alongside other business risks.

companyName: Dianthus Therapeutics, Inc. /DE/

ticker: DNTH


text: In the ordinary course of our business, we collect, use, store, and transmit digitally confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To that end, we rely on a multidisciplinary team (including from our IT function, senior management, and third-party service providers, as described further below) to assess how identified cybersecurity threats could impact our business. These assessments may leverage, among other processes, industry tools and metrics designed to assist in the assessment of risks from such cybersecurity threats.


text: Senior management is directly involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing incident response plans and engaging vendors to conduct penetration tests. Senior management participates in cybersecurity incident response efforts by being part of the incident response team and helping direct our response to cybersecurity incidents.


text: To augment internal knowledge, we have engaged a virtual Chief Information Security Officer ("vCISO") from a third-party firm that has provided IT and security services for over 17 years and utilizes industry expertise to recommend and implement best practice solutions for operational needs. The service provides a named vCISO as part of an advisory team to assess and help manage our cybersecurity program.


text: Cybersecurity risks are identified and processed in a Risk Register by an information security team that includes the vCISO and internal management. We conduct risk assessments, penetration testing, vulnerability scanning, receive alerts from security tools, and engage in an ongoing discussion of business processes and policy management. We use advanced tools to track governance, risk, and compliance tied to a security framework tailored from industry standards and best practices, and we test our tools and policies regularly.


text: Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. We have implemented and maintain information security processes designed to identify, assess, and manage material risks from cybersecurity threats to critical computer networks, third-party hosted services, communications systems, hardware, software, and our critical data including confidential, personal, proprietary, and sensitive data. Accordingly, we maintain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess any potential material impact to our business. Based on our assessment, we implement and maintain risk management processes to our information assets and mitigate harm to our business. In addition to internal systems and concerns, we manage risks from third parties that are a part of business operations. This includes assessing cybersecurity risks during the vetting process and recurring assessments during the life of the engagements. Relative levels of assessment are considered with regard to business criticality of the relevant third parties. We rely heavily on our third party CROs and CDMOs to manage our clinical trials and manufacture our investigational products, and a cybersecurity incident at a CRO, CMDO or other third party upon which we rely could materially adversely impact us. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. See "Risk Factors" in this Annual Report on Form 10-K for additional information on cybersecurity risks we face.


text: Information from the risk management process is managed by the Information Security Team and is reported to the Board of Directors on a regular basis. We provide cybersecurity updates to our Audit Committee on a quarterly basis. In the case of an incident, relevant members of the Information Security Team are involved to assess and oversee Incident Response operations as needed, including adequate reporting of material incidents if/when appropriate.


text: Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature, including clinical trial data ("Information Systems and Data").

companyName: ARS Pharmaceuticals, Inc.

ticker: SPRY


text: Our Chief Executive Officer supervises our IT department (the "IT Department"), which coordinates with our cybersecurity incident management team, which consists of, among others, our Chief Financial Officer, Chief Legal Officer, Head of IT, and a third-party IT and cybersecurity consultant ("CSI Management Team") to identify, assess and manage our cybersecurity threats and risks. Members of our IT Department and CSI Management Team identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, internal and external audits, conducting threat assessments for internal and external threats, third-party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and evaluating threats reported to us.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a cybersecurity incident response policy; incident detection and response; vulnerability management processes; a disaster recovery and business continuity plan; risk assessments; encryption of certain of our data; network security controls; segregation of certain of our data; access controls; physical security; asset management, tracking and disposal; systems monitoring; vendor risk management processes; employee training; penetration testing; and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the IT Department works with the CSI Management Team to prioritize our risk management processes and mitigate cybersecurity threats that are expected to be more likely to lead to a material impact to our business. In addition, our management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which, together with the board of directors, evaluates our overall enterprise risk.


text: We use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including for example: a third-party IT and cybersecurity consultant; professional services firms, including legal counsel; threat intelligence service providers; cybersecurity software providers; managed cybersecurity service providers; penetration testing firms; and dark web monitoring services.


text: We use third-party service providers to perform a variety of functions throughout our business, such as conducting nonclinical and clinical trials; supply and quality testing; development and manufacturing; and professional services firms, including legal counsel. Additionally, we rely on third-party service providers and technologies to operate critical business systems to process sensitive data in a variety of contexts, including, without limitation, cloud-based infrastructure, encryption and authentication technology for certain environments and systems, employee email, and content delivery. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, which may include reputational due diligence and vendor risk evaluations.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Risk Factors—If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including the CSI Management Team. Certain members of the CSI Management Team are information technology and security professionals, and we also rely on third-party security analysts who have certain certifications related to cybersecurity.


text: Our Chief Executive Officer, Chief Financial Officer and Chief Legal Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Additionally, they are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer. These members of management work with our CSI Management Team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our cybersecurity incident response policy includes reporting to the audit committee of our board of directors for certain cybersecurity incidents.


text: The audit committee periodically reviews and discusses with the appropriate members of our management material risks relating to data privacy, technology and information security, including cybersecurity, threats and back-up of information systems and our processes for assessing, identifying, and managing such risks, as well as our internal controls and disclosure controls and procedures relating to cybersecurity incidents. The board and audit committee are also provided with reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), International Organization for Standardization (ISO) 27001, and Payment Card Industry Data Security Standard (PCI DSS). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: KOHLS Corp

ticker: KSS


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, including our incident response personnel; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who access our critical systems and data.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors- Legal and Regulatory Risks".


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Our Audit Committee receives regular reports from management on our cybersecurity risks, and our full Board receives a periodic update. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as significant incidents.


text: Our Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. Board members receive presentations on cybersecurity topics from our Chief Technology Officer (CTO), Chief Risk and Compliance Officer (CRCO), and Chief Information Security Officer (CISO) or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our CTO, CRCO, and CISO, has overall responsibility for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 25 years of technology and finance leadership experience across multiple industries for our CTO, over 30 years of experience in the Legal, Risk and Compliance disciplines for our CRCO, and over 20 years of cybersecurity leadership experience for our CISO.


text: Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of key cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data (such as information related to our product candidate development, collaboration activities and clinical trials), including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and sensitive personnel data and other personal data (collectively, "Information Systems and Data").

companyName: Bolt Biotherapeutics, Inc.

ticker: BOLT


text: Our information technology department, supported by certain service providers, identifies, assesses and manages the Company's cybersecurity threats and risks. Our information technology department (led by our Director of IT Operations and Security), identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, real-time monitoring of network events, subscribing to reports and services that identify cybersecurity threats, evaluating threats and actors reported to us, conducting scans of the threat environment, evaluating our and our industry's risk profile, coordinating with law enforcement concerning threats when appropriate, conducting (and working with third parties, as appropriate) assessments and audits for internal and external threats and vulnerabilities, and using of external intelligence feeds.


text: We implement and maintain various technical, physical, and organizational measures, processes, and policies, designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, an incident detection and response plan; vulnerability management processes; risk assessments; implementation of security standards; encryption of certain data; network security controls; segregation of certain data; access controls including multi-factor authentication for certain Information Systems and Data; physical security; asset management, tracking and disposal; systems monitoring; vendor risk management program; employee training; penetration testing; and cybersecurity insurance. Our assessment and management of material risks from cybersecurity threats is integrated into the Company's overall risk management processes. For example, our information technology department presents updates on our IT environment and cybersecurity threats to the audit committee of the board of directors, which evaluates our overall enterprise risk and the effectiveness of our risk management approaches.


text: We use service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats. Such providers include but are not limited to legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed security service providers, and penetration testing firms.


text: We use service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. We have a vendor management program designed to manage cybersecurity risks associated with our use of certain of these providers. The program includes a risk assessment for certain vendors that host our Information Systems and Data. For vendors who host our critical data, we have processes designed to assess the vendor's ability to support business continuity and disaster recovery. Where appropriate, we conduct security questionnaires and a review of vendors' security. This review may include reviewing program documentation, security reports and audits, conducting security assessment calls with the vendor's security personnel, and imposing information security-related contractual obligations on the vendor. We also request data privacy assessments from certain vendors as appropriate. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see the risk factor in Part 1. Item 1A, including the risk factor entitled "Our internal computer systems, or those used by our CROs or other contractors or consultants, may fail or experience security breaches or other unauthorized or improper access."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of IT Operations and Security, Senior Director of IT, and Chief Financial Officer.


text: Our Director of IT Operations and Security and Senior Director of IT are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, reviewing security assessments and other security-related reports, and communicating key priorities to relevant personnel. For example, our Director of IT Operations and Security holds a Master of Science in information security and assurance, holds relevant certifications such as Certified Ethical Hacker, Computer Hacking Forensics Investigator, Security+ and Network+, and has worked for approximately nine years in the field of cybersecurity. Our Senior Director of IT has 25 years of IT management experience at various public biotechnology companies. Our Chief Financial Officer is responsible for helping prepare budgets, helping prepare for cybersecurity incidents, and approving certain cybersecurity processes.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Financial Officer. Our Chief Financial Officer receives regular reports on the status of our cybersecurity measures, and works with the Company's incident response team in an effort to help the Company mitigate and remediate cybersecurity incidents of which they are notified, and to assess and determine materiality for reporting purposes.


text: The audit committee receives periodic written and verbal reports from our Chief Financial Officer and directly from the information technology department concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented that are intended to address them. The audit committee also receives from the Director of IT Operations and Security or the Senior Director of IT, various written reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: The Sponsor, FMR LLC, and their respective affiliates operating as a business organization (collectively, "Fidelity") and its Enterprise Cybersecurity organization, on behalf of the Trust, have established a comprehensive risk management program, which includes processes to identify, assess, and manage cybersecurity risks, including material risks from cybersecurity threats, and to put in place appropriate controls to mitigate these risks and reduce the potential impact to the Trust and its Shareholders. The Trust does not have any employees and relies upon Fidelity and its Enterprise Cybersecurity organization for the Trust's day-to-day operations and to establish strategies, policies, and standards for the security of, and operations in, cyberspace.

companyName: Fidelity Wise Origin Bitcoin Fund

ticker: FBTC


text: The Trust depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. Through its vendor management program, and on behalf of the Trust, Fidelity oversees and identifies risks from cybersecurity threats associated with the use of third-party service providers. This vendor oversight program includes periodic reviews of the cybersecurity controls of third-party service providers. The frequency of such reviews is generally based on the nature of Trust's information processed by the vendor and the vendor's criticality to business operations.


text: On behalf of the Trust, Fidelity engages third-party consultants to assess, identify, and/or manage material risks from cybersecurity threats. For example, Fidelity engages third-party consultants to perform audits of its cybersecurity measures and risk management processes, including those applicable to Trust. Fidelity has also hired qualified independent assessors to review applicable security controls in accordance with the American Institute of Certified Public Accountant's System and Organization Controls assurance programs. Additionally, Fidelity utilizes third-party consultants with specific areas of cybersecurity expertise to review and report on various aspects of its cybersecurity program, including those applicable to the Trust. The results of these consulting engagements are shared with the Sponsor as part of periodic reports.


text: Fidelity's Enterprise Cybersecurity organization has a threat intelligence program which monitors for emerging cyber threats. Taking information gathered from public and private sources, including industry groups such as the U.S. Cybersecurity and Infrastructure Security Agency and the Financial Services Information Sharing and Analysis Center, the organization analyzes such information and incorporates tactics, techniques, and procedures into the program's security monitoring and detection tools and processes.


text: The potential impact of risks from cybersecurity threats on the Trust are assessed on an ongoing basis, and how such risks could materially affect the Trust's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Sponsor did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Trust, including its day-to-day operations, financial condition, and business strategies. In conjunction with Fidelity's Enterprise Cybersecurity, the Sponsor, on behalf of the Trust, participates in regular testing of applicable incident response processes to ensure appropriate escalation, mitigation, communication and reporting processes are in place.