text: The Company recognizes that the security of our operations is critical to protecting our customers and maintaining the reputation of the Company. Management is committed to managing Information Security ("IS") risk, which includes cybersecurity, that may impact the Company. The Enterprise Risk Committee ("ERC") of the Board of Directors provides oversight of the Company's written Information Security Management and Information Technology Governance Programs (the "Programs"). Through the Programs, the Company has established polices, processes, controls, and systems designed to identify, assess, measure, manage, monitor, and report risks related to cybersecurity and help prevent or limit the effect of possible cybersecurity threats and attacks. As cybersecurity threats continue to evolve, the Company expects to continue to monitor and enhance the current controls and systems in place to detect and prevent cybersecurity attacks and to remediate discovered vulnerabilities.

companyName: LAKE SHORE BANCORP, INC.


text: The Company's Information Security Officer ("ISO") is responsible for the design and execution of the Information Security Management Program and the information and cyber security aspects of the Information Technology Governance Program. The ISO works in concert with members of the Information Technology ("IT") Department, including the Bank's Chief Information Officer ("CIO"), to ensure the execution of the Programs. The aforementioned individuals meet with management on a monthly basis through an IT Steering Committee in which management assesses IS and IT risk.

secItem: Item 1C


text: Additionally, the ISO provides the ERC with regular reports on the status and effectiveness of the Programs and risk management activities, as well as cyber and IS issues that may affect the Company.


text: The ISO has served various roles involving anti-money laundering, law enforcement, security, and information technology for over 7 years. The ISO holds an undergraduate degree in Legal Studies and master's degree in Criminal Justice and Criminology. The ISO reports to the Chief Financial Officer ("CFO") as well as the Chairperson of the ERC. The CIO has served various roles in audit, information risk, information technology, and information security in multiple industries for over 12 years. The CIO holds an undergraduate degree in Management Information Systems and has attained the ISACA Certification in Certified Information Systems Auditor ("CISA"). The CIO reports to the Chief Executive Officer ("CEO").


text: The Company utilizes the following guidelines and frameworks to develop and maintain the Information Security Management Program: Federal Financial Institutions Examination Council ("FFIEC") Information IT Examination Handbooks, FFIEC Cybersecurity Assessment Tool ("CAT"), Center for Internet Security Critical Security Controls, National Institute of Standards and Technology Special Publication 800 Series, National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), 12 CFR Appendix B to Part 30 - Interagency Guidelines Establishing Standards for Safety and Soundness Gramm-Leach-Bliley Act ("GLBA") 501(b).


text: The Information Security Management Program features layered controls of network and endpoint intrusion detection and prevention, enterprise malware protection, threat-monitoring, and a Security Operations Center that provides full time support and additional operational measures to monitor and respond to data breaches and cyberattacks. The Company leverages regular assessments to identify current and potential threats and vulnerabilities within the Company's environment. Technical vulnerabilities are identified through regular automated vulnerability scans and periodic vulnerability and penetration testing performed by independent third parties. Non-technical vulnerabilities are identified through the IT and IS Assurance Program by conducting regular process and procedural reviews as well as risk assessments. The Company uses the FFIEC CAT and NIST CSF to help identify cybersecurity risks and determine our cybersecurity preparedness. The Company's information security and cybersecurity risk appetite statements define the levels of risk the Company is willing to accept and guide the risk management decisions of the Company. The risk appetite statements are approved by the Board of Directors annually.


text: The Company has an Incident Response Plan to help reduce the risks related to security incidents by providing guidelines on responding to incidents; focusing on a roadmap for coordinating personnel, policies, and procedures to ensure incidents are detected, analyzed, and handled appropriately.


text: The Company also recognizes the risks associated with the use of third party providers and maintains a Third Party Management Program that is responsible for the oversight of outsourced services. This enables the Company to identify risks related to third parties through an inherent risk assessment and a due diligence review process designed to ensure third parties are in compliance with the Company's risk and information security expectations.


text: The Company's Security Awareness Program provides annual, mandatory training for personnel on information security to prepare personnel with the knowledge of how to properly use and protect Company resources from internal and external threats. The Program also conducts regular phishing assessments and targets new hires and other groups with specific training related to their job activities or risk levels. The Program also communicates information security policies, standards, and practices to personnel and requires annual review and acknowledgement of the policies.


text: For the year ended December 31, 2024, the Company has not identified any specific risk from a cybersecurity threat that has materially affected, or is reasonable likely to affect, the Company's business strategy, results of operation, or financial condition, other than those described in Item 1A. Risk Factors - Risks Related to Operations.


text: The Company is externally managed by the Adviser and has no employees or internal information systems. As such, the Company relies on the Adviser's risk management program and process, which include cyber risk assessments, as well as other third-party service providers to protect the Company's information from cybersecurity threats.

companyName: First Eagle Private Credit Fund


text: Cybersecurity Risk Management and Strategy The Adviser has implemented policies and associated controls and procedures to safeguard both firm and client data and assets (the "Cybersecurity Program"), and the Cybersecurity Program continues to evolve in an effort to keep pace with industry best practices and ever-changing cyber threat environment. The Cybersecurity Program is designed to protect the confidentiality, integrity, and availability of client and consumer information systems, and the Adviser's proprietary information in compliance with SEC Guidance 2015-02 regarding Cybersecurity, and FINRA's guidance regarding Customer Information Protection, and interagency guidance on safeguarding information. Periodic updates on the Cybersecurity Program are provided to the Adviser's Head of Risk, along with the Adviser's Risk Committee, and the Board.


text: The Cybersecurity Program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, as amended. These NIST functions are used as high-level categories to organize and report on the status of the Cybersecurity Program and are tailored to the Adviser's business objectives. There are areas within the NIST framework that the Adviser might not find applicable to its business and not necessary to fulfill the objectives of the Cybersecurity Program. The Adviser utilizes an aggregated approach to cybersecurity and considers the acceptance, avoidance, transfer, and mitigation of risks in attaining long term business objectives and minimizing financial loss. In terms of security incident and event management, the Adviser implements multiple technologies (including, but not limited to, enterprise grade next generation firewalls, well-known anti-malware protection, application whitelisting, and end detection and response software) in different layers of the Adviser's network, including utilizing a third-party vendor that provides monitoring of the Adviser's systems on a 24 hour/day, seven days/week basis. In addition, the Adviser has developed customized firm-wide cybersecurity training sessions for employees with the assistance of an outside vendor. Cybersecurity training is provided to all new employees upon hire and annually for all employees. In addition, the Adviser conducts phishing training on a monthly basis and sends out periodic newsletters on pertinent cybersecurity-related topics and events. In 2022, the Adviser engaged a consultant to conduct an independent cybersecurity risk assessment, and the Adviser has since then implemented all priority recommendations from this engagement. Other non-priority recommendations have been considered for implementation over time.


text: Cybersecurity Governance Management's Role in Cybersecurity Risk Management The Company's chief compliance officer (the "CCO"), in partnership with the Adviser's Chief Information Security Officer (the "CISO"), oversees the Company's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board. Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company.


text: Additionally, as part of the Adviser's vendor management program, members of the Adviser's information security teams will conduct periodic due diligence on the cybersecurity/data security programs of the Company's third-party service providers (this review is conducted annually with respect to the Company's custodian, sub-administrator and transfer agent). As part of their oversight of third-party service providers to the Company, the Company's CCO and the Adviser's CISO review key Company service providers' compliance and risk management policies and procedures related to cybersecurity matters and evaluate the service providers' use of information systems which may give rise to information technology vulnerabilities. Potential cybersecurity risks are identified and implications of such risks, if any, to the Company are assessed and monitored. In addition, the CCO receives regular reports from the third-party service providers regarding any cybersecurity threats and incidents at such service provider.


text: The Adviser's CISO has over 9 years of experience managing risks from cybersecurity threats and developing and implementing cybersecurity policies and procedures. The responsibility of the CISO is to maintain confidentiality, availability, and integrity of the Adviser's data and that of its clients and shareholders. The CISO also reports to the Adviser's Enterprise Operations Committee on a semiannual basis. The committee is charged with determining the security posture of the Adviser. It is responsible for accepting, deferring, or mitigating the risks presented by the CISO. The CISO is also responsible for maintaining all policies and controls pertaining to cybersecurity and conducting annual risk assessments. The Company's CCO has over 15 years of experience advising on and managing compliance risks, including those related to cybersecurity, and developing and implementing policies and procedures to address such risks. The CCO reports to the general counsel of the Sub-Adviser and Administrator of the Company and to the Board on all compliance risk related matters, including those related to cybersecurity.


text: The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO and CISO regarding the overall state of the Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company. Additionally, the CCO provides updates to the Board on any reported incidences of the Company's service providers. The CCO informs the Board of material cybersecurity matters as they arise.


text: Assessment of Cybersecurity Risk The Company assesses the potential impact of risks from cybersecurity threats on an ongoing basis, and how such risks could materially affect the Company's investment strategy, operations and financial condition. As of the date of this Annual Report, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company. However, future incidents could have a material impact on our business strategy, results of investment activities and operations, or financial condition. For additional information about these risks, see "Item 1A. Risk Factors".


text: Cybersecurity Risk Management and Strategy As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of our Manager, a subsidiary of ACRES Capital Corp. ("ACRES"). As such, our Manager participates in ACRES' processes for assessing, identifying, and managing risks from cybersecurity threats, as detailed below.

companyName: ACRES Commercial Realty Corp.

ticker: ACR


text: ACRES upholds a robust cybersecurity initiative, encompassing policies and protocols aimed at safeguarding its systems, operations, and entrusted data, including ours, from potential threats or risks. ACRES employs a range of protective measures within its cybersecurity framework including physical and digital access controls, identity verification, mobile device management software, employee training programs emphasizing cybersecurity awareness and best practices, tools for identifying abnormal activities, and vigilant monitoring of data usage, hardware, and software.


text: At least annually, ACRES' third-party cybersecurity compliance consultant conducts a cybersecurity risk assessment. We periodically review reporting on these risks and our cybersecurity threats, the status of our security infrastructure, our risk management activities and the status of, and our responses to, any cybersecurity incidents. We also periodically perform simulations and tabletop exercises. All employees are required to complete training that includes various topics on cybersecurity risk management best practices. Additionally, employees are regularly tested with phishing campaigns reinforcing their awareness of email threats.


text: Cybersecurity threat risks have not materially affected our company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Operations—Our business is highly dependent on communications and information systems, and systems failures or cybersecurity incidents could significantly disrupt our business, which may, in turn, negatively affect the market price of our common stock and our ability to operate our business" in this report.


text: Cybersecurity Governance As described above, ACRES has engaged a third-party IT firm and cybersecurity compliance consultant to whom we have outsourced primary responsibility to oversee, implement and manage our processes and controls to assess, identify, and manage material risks from cybersecurity threats. ACRES management team oversees the work of the third-party IT and cybersecurity compliance consultant and regularly communicates with members of the team. Through the policies and controls described above, including an incident response policy, representatives of the third-party IT firm as well as members of ACRES management team are informed about cybersecurity threats and incidents affecting our information systems and direct our efforts to prevent, detect, mitigate and remediate cybersecurity threats and incidents.


text: The representatives of our third-party IT firm and cybersecurity compliance consultant who lead our cybersecurity risk management and risk assessment process have experience in managing information systems, developing cybersecurity strategy, implementing information security and cybersecurity programs, identifying and assessing cybersecurity risks and establishing incident response plans.


text: Our Company's Board and the audit committee are jointly responsible for overseeing our overall risk assessment and risk management program as well as our Manager's policies and practices related to our information technology systems, information security and cybersecurity risks. The Company's Board and the audit committee reviews at least annually our enterprise risks and related risk management program. In addition, the Company's Board receives periodic reports from our cybersecurity compliance firm on the primary cybersecurity risks that we and our Manager face and the measures we are taking to mitigate such risks. The chair of the audit committee would be notified following any cybersecurity incident meeting specified severity levels, and the Company's Board would also be expected to review the Manager's materiality assessment regarding any cybersecurity incident requiring disclosure to the SEC.


text: Risk Management and Strategy We manage cybersecurity threats as part of our oversight, evaluation, and mitigation of enterprise-level risks. We have implemented a cybersecurity risk management program, in accordance with our risk profile and business size, that is designed to detect, identify, assess, and respond to current and emerging cybersecurity threats. Our cybersecurity risk management program is supported by third-party information technologies and vendors, including a managed services provider that assists us with, among other things, information technology system monitoring, detection and alerting tools, and response support services. We also leverage third-party information technology service providers to monitor and evaluate our cybersecurity posture through cybersecurity risk reviews and assessments. Our cybersecurity risk assessments are informed by industry standards and frameworks and incorporate elements of the same, including elements of the National Institute of Standards and Technology ("NIST") cybersecurity framework.

companyName: MBX Biosciences, Inc.

ticker: MBX


text: We have adopted an incident response plan designed to coordinate the steps to identify, contain, eradicate, and recover from cybersecurity incidents. We also have a process for newly-hired employees to participate in security awareness training. We also have a process to review certain third-party information technology service providers and vendors, including through contractual requirements and proactive threat intelligence monitoring, as appropriate.


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, however, like other companies in our industry, we and our third-party information technology service providers and vendors have from time to time experienced threats that could affect our information or systems. For more information, please refer to Item 1A, "Risk Factors," in this Annual Report.


text: Our Senior Director of Information Technology coordinates with our Chief Financial Officer ("CFO") and relevant third parties, such as consultants and external legal advisors, to assess and manage material risks from cybersecurity threats. Our Senior Director of Information Technology has over fifteen years of experience in information technology, including over five years in cybersecurity and information security. Our Senior Director of Information Technology is also supported by a cross-functional security incident response team, which is responsible for identifying, reporting, investigating, documenting, and mitigating cybersecurity incidents pursuant to our incident response plan and policy.


text: Our board of directors has overall oversight responsibility for our risk management, and delegates its oversight of risk assessment and management guidelines to the audit committee of the board of directors. Members of the audit committee receive periodic updates from our CFO, who is briefed by our Senior Director of Information Technology, regarding matters of cybersecurity. These discussions may include updates on management's efforts to address and mitigate cybersecurity risks, cybersecurity incidents (if any), and the status of key information security initiatives. Executive management will promptly update our board of directors regarding significant threats and incidents as they arise.


text: The Company has partnered with Alasconnect LLC to evaluate the cyber risk and IT control capabilities within the enterprise. The goal is to increase cyber-resilience and cyber-threat response preparedness. Cyber policies, procedures and practices are extended to all third-party vendors and appropriately communicated to both management and the Board by way of strategic cyber incident tabletop exercises and quarterly board IT governance report ing. Any material risks identified from cyber security threats will be communicated to the management team which will evaluate and manage the risk. Although to-date the Company has not experienced any material losses relating to cyber-attacks or other information security breaches, there can be no assurance that the Company will not incur such losses in the future. The Company's risk and exposure to these matters cannot be fully mitigated because of, among other things, the evolving nature of these threats. As a result, cyber security and the continued development and enhancement of controls, processes and practices designed to protect systems, computers, software, data and networks from attack, damage or unauthorized access remain an area of attention.

companyName: Contango ORE, Inc.

ticker: CTGO


text: Cybersecurity Risk Management and Strategy We maintain a team, tools, policies, and processes for identifying, assessing, and managing material risks from cybersecurity threats. Threats like malware attacks, system vulnerabilities, and data breaches are actively identified, monitored, evaluated, and mitigated along with other Company risks. Our security team maintains centralized documentation regarding known security risks and mitigation. Consideration of material risks from cyber threats is integrated into our enterprise risk management processes and is a standing agenda item for discussion at our Audit Committee meetings. An Information Security Executive Committee representing multiple areas of the Company is responsible for assessing material risks from cybersecurity threats and represents multiple functions of the business including Finance, Human Resources, Legal, and the Information Technology ("IT") departments. We have certain employee cybersecurity awareness campaigns and training designed to help promote a culture of cybersecurity awareness throughout the organization. Cybersecurity tools, processes, policies, and controls are periodically reviewed and updated in response to changes in the business environment and evolving threats, as well as to align with broader risk management objectives.

companyName: Pursuit Attractions & Hospitality, Inc.

ticker: PRSU


text: Our information security function, led by our Chief Information Officer ("CIO"), implements and maintains the processes and controls to help identify, assess, and manage material risks from cybersecurity threats. These controls include, but are not limited to, the following Center for Internet Security ("CIS") controls: • Account Management; • Access Control Management; • Continuous Vulnerability Management; • Network Infrastructure Management; • Incident Response Management; • Security Awareness and Skills Training; and • Data Protection - Encrypt Data on End-User Devices. Supporting these controls are specific security measures that include threat intelligence monitoring, vulnerability scanning, and policy enforcement.


text: We use third-party service providers to assist us in identifying, assessing, and managing material risks from cybersecurity threats, including professional service firms, legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, and forensic investigators. We have a Cybersecurity Incident Response Plan ("IRP") that includes procedures for responding to and, to the extent applicable, disclosing material cybersecurity incidents in a timely manner. We have third-party risk management processes designed to assess risks from key vendors and suppliers, including application providers and hosting companies. Key software service providers utilized by the Company undergo a review process for security, reliability, and effectiveness. We have processes in place to address access to our network by such third parties, to the extent applicable, including network access controls designed to provide access on a 'least privilege' basis.


text: For a discussion of risks from cybersecurity threats that may materially affect the Company, see "Risk Factors" under the heading "We are vulnerable to cybersecurity attacks and threats." (Part I, Item 1A of this 2024 Form 10-K).


text: Cybersecurity Governance Cybersecurity risk management is a part of our risk management process and is subject to oversight by our Board of Directors and management. Our Board of Directors has delegated oversight and mitigation of risks from cybersecurity threats to our Audit Committee. Our Audit Committee receives quarterly reports from either our CIO or our General Counsel concerning any significant cybersecurity threats, risks, and the tools and processes we have implemented for mitigation. Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including the following: • The Information Security Executive Committee consists of our Legal Counsel, Chief Accounting Officer, Chief Compliance Officer, CIO, and Vice President of People & Culture. They are responsible for setting broad policy and communicating to the Chief Executive Officer, Chief Financial Officer, and the Board of Directors on potential material cybersecurity incidents that may require disclosure. • The Information Security Council consists of our CIO, the Senior Director of Information Security, in-house information security experts, and information technology experts and leaders from across the Company. The CIO leads this committee and communicates with the Information Security Executive Committee as required. • The Information Security Team consists of cybersecurity professionals primarily responsible for managing cybersecurity at Pursuit. This team has the primary responsibility for identifying, assessing, and managing material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware, software, and critical data. This team is led by our CIO, who has over 25 years of experience in information technology including cybersecurity oversight. This team includes the following: • The Senior Director of Information Security reports directly to the CIO and is an information security professional with over 20 years of experience in the development and implementation of information security processes, procedures, and practices. • The Senior Director of Global Infrastructure & Operations reports directly to the CIO and is responsible for implementing, maintaining, and providing oversight of the IT Infrastructure and the Information Security Team. • The Security Engineer leads the day-to-day operations of the Information Security Team and oversees individual analysts and IT experts on the team. • The Security Incident Response Team ("SIRT") is responsible for executing the IRP. The SIRT comprises individuals from multiple departments, divisions, and disciplines. Members of the SIRT are trained in incident response and reporting procedures.


text: Cybersecurity Risk Management and Strategy We have implemented a cybersecurity program in accordance with our risk profile and business size that is informed by recognized industry standards, including elements of the National Institute of Standards and Technology Cybersecurity Framework. We leverage the cybersecurity services of third-party vendors, including virtual chief information security officer services, to support our cybersecurity risk management program.

companyName: Metagenomi Therapeutics, Inc.

ticker: MGX


text: Our cybersecurity risk management program is comprised of a number of components, including but not limited to a risk assessment incorporating elements of industry-standard frameworks, penetration testing, endpoint detection and response, system log monitoring and alert platform, and security operations center, functioning 24x7. We have an employee training program that includes annual cybersecurity awareness training that is reinforced by frequent phishing campaigns. We also maintain an incident response plan and related processes to help guide our response to cybersecurity incidents.


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the vendor's programs. Our current vendor evaluation procedures include, as appropriate, a review of certain vendors' security standards.


text: We have no t identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors have experienced threats relating to our and our third-party vendors' information systems. For more information, please see "Item 1A, Risk Factors."


text: Governance Related to Cybersecurity Risks Our Head of Information Technology ("Head of IT") is responsible for the strategic leadership and direction of the Company's information technology organization. Our current Head of IT has over thirty years of experience leading information technology teams in the life sciences industry. The Head of IT reviews threat intelligence, and receives updates from the Company's third-party providers, to help identify risks from cybersecurity threats.


text: The Head of IT reports to the Chief Financial Officer (CFO), and attends regular meetings with the CFO to discuss updates relating to the Company's cybersecurity program. The Head of IT also provides cybersecurity updates on a quarterly basis to the Company's executive team.


text: The Board of Directors has delegated oversight of cybersecurity risk management to the Audit Committee. The Audit Committee reviews the Company's major cybersecurity risk exposures and the steps that the Company's management has taken to monitor and control such exposures. Specifically, the Audit Committee reviews updates on data management, security initiatives, and significant existing and emerging cybersecurity risks, including material cybersecurity incidents, the impact on the Company and its stakeholders of any significant cybersecurity incident, and any disclosure obligations arising from any such incidents.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Atai Beckley N.V.

ticker: ATAI


text: As part of our risk management program, we reference security industry frameworks and other guidance to help us assess, identify, and manage cybersecurity risks. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include, but are not limited to: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors based on their criticality and risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Cyberattacks, data security incidents or other failures in our telecommunications or information technology systems, or those of our collaborators, CROs, third-party logistics providers, distributors or other contractors or consultants, could result in information theft, data corruption, legal liability, damage to our reputation, and significant disruption of our business operations which could materially affect our operating results, financial condition, and business."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our General Counsel, Chief Financial Officer, Head of IT, other internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including other internal staff such as the Head of IT and Chief Operating Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's and their delegates' collective experience include over ten years of cybersecurity, incident response, and the safeguarding of organizational assets expertise. Specifically, our Head of IT has over ten years of experience leading cybersecurity teams and programs, while our Chief Operating Officer has over seven years of experience risk management and three years of cybersecurity oversight.


text: Our management team stays informed and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Sana Biotechnology, Inc.

ticker: SANA


text: We conduct periodic risk assessments to identify cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate personnel, including our Vice President, Information Technology, who reports to our Executive Vice President, Chief Technology Officer, and Head of Operations, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train relevant personnel on these safeguards. These efforts are led by our Information Security function. All personnel are expected to engage in security awareness training. We engage third parties to perform security assessments to test our safeguards and, when appropriate, implement modifications to or add new safeguards based on the results of such assessments.


text: We generally require each of our relevant third-party service providers to implement and maintain appropriate security measures and to promptly notify us of any suspected breach of security that may affect our company. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers and other members of senior management are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as well as through our audit committee.


text: In connection with our November 2024 portfolio prioritization, our Vice President, Information Technology assumed from our former Head of Information Security responsibility for assessing and managing our material risks from cybersecurity threats. He has worked in various roles pertaining to Information Technology for more than fifteen years. The processes by which he is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following: vulnerability management, third party risk management, data security management, security awareness training, systems management, operations security, security incident and event management, and incident response management. We use third parties for managed detection and active response to cybersecurity incidents.


text: Our Vice President, Information Technology provides quarterly briefings to our audit committee regarding our cybersecurity risks and activities, such as any recent cybersecurity incidents and related responses (including those of third parties), if any, and cybersecurity systems testing. Our audit committee provides periodic updates to the board of directors that include any material information included in such briefings. In addition, our Vice President, Information Technology provides annual briefings to our board of directors on cybersecurity risks and activities.


text: Risk Management and Strategy Kodak has implemented various processes designed to help assess, identify and manage risk from cybersecurity threats. Kodak's cybersecurity program follows the structure and objectives of the U.S. National Institute of Standards and Technology ("NIST") Cybersecurity Framework and is designed to satisfy multi-jurisdictional regulatory requirements. Key areas of Kodak's cybersecurity risk management processes and strategy currently include: • Cross-Functional Collaboration and Coordination. Our IT security operations and risk management team ("IT Security Team"), led by our Chief Information Security Officer ("CISO"), has first line responsibility for the implementation and operation of our cybersecurity risk management processes. However, this team works together with other internal teams to coordinate efforts, priorities and oversight. These include: o our IT Risk Council (the "Council"), which is comprised of key leaders from stakeholder groups throughout the Company and led by our CISO, and meets monthly to review metrics and discuss risks and recent events;

companyName: EASTMAN KODAK CO

ticker: KODK


text: o our Risk Management and Compliance Committee (the "Risk Committee"), which is responsible for evaluating and assessing overall enterprise risk, including cybersecurity risk;


text: o our Internal Audit Department, which monitors certain IT systems controls that are integrated into our larger Sarbanes-Oxley control environment;


text: o our Chief Privacy Officer; and o our crisis management team, a cross-functional team of senior management and subject matter experts from across the Company established to be ready to respond to crisis events, including those arising from cybersecurity incidents.


text: • Routine Evaluation and Assessment of Systems and Processes. We routinely evaluate our IT systems and infrastructure, including with respect to system security, and regularly implement upgrades to improve system functionality and performance as well as to enhance security. Security controls are routinely assessed by our annual general controls audit and other audits and assessments as well as a thorough assessment performed during the annual cyber insurance application process. In addition to periodic in-depth evaluations of our systems and processes, we monitor our IT systems and processes on a regular basis with the goal of identifying and remediating real and potential threats as they arise. • Security Awareness Program to Train and Test Personnel. We operate a security awareness program that includes regular, mandatory trainings for relevant personnel on data protection and malware detection, policy and process awareness, periodic phishing simulations and other kinds of preparedness testing. • Incident Response Process and Team. We maintain an incident response process with defined roles, responsibilities and reporting protocols. This process focuses on responding to and recovering from any significant breach as well as mitigating any impact to our business. Generally, when a breach or suspected breach is identified, the IT Security Team would escalate the issue to the Council for initial analysis and guidance. In the event of a serious IT incident, the crisis management team would be notified and the incident response team would typically be tasked with preparing an initial response. The incident response team, in consultation with others regarding impact and materiality, would be responsible for determining whether a particular incident (alone or in combination with other factors) triggers any reporting or notification responsibilities. • Regular Evaluation of Initiatives, Results and Priorities. The IT Security Team, in consultation with the Council and other members of senior management, updates its strategy at least annually to account for changes in our business strategy, legal and regulatory developments, and further developments in the cybersecurity threat landscape. In addition, we periodically engage a third-party provider to conduct an external assessment of our security program. The results of this assessment, which are reported to the Audit and Finance Committee (and the Board, as appropriate), assist us in determining whether any further changes to our existing policies and practices are warranted.


text: We expect that our cybersecurity risk management processes and strategy will continue to evolve as the cybersecurity threat landscape evolves.


text: We engage third-party providers to assist us with our cybersecurity risk management and strategy. Examples of services provided by these third-party providers include threat monitoring, incident response support, testing, mitigation strategies, updates on emerging trends and developments and policy guidance. Prior to exchanging any sensitive data or integrating with key third-party providers, we assess their security fitness against our risk posture and request changes as we deem necessary. Security controls are imposed through comprehensive standard terms and conditions that include privacy and incident reporting requirements, and third parties are periodically re-evaluated for security risk.


text: Since the beginning of the last fiscal year, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, "Risks Related to Kodak's Business and Operations—Cyber-attacks or other data security incidents that disrupt Kodak's operations or result in the breach or other compromise of proprietary of confidential information about our workforce, our customers, or other third parties could disrupt our business, harm our reputation, cause us to lose customers, and expose us to costly regulatory enforcement and litigation, any of which could lead to material adverse effects on Kodak's results of operations, business and financial condition" in this Form 10-K.


text: Consistent with the overall risk management governance structure, management is responsible for the day-to-day management of cybersecurity risk while the Board and its Audit and Finance Committee perform an oversight function.


text: Board Oversight. The Board has delegated to its Audit and Finance Committee the responsibility for overseeing cybersecurity risk exposures in addition to our broader risk management program. Management (including the Chief Information Officer ("CIO") and the CISO) reports at least annually to the Audit and Finance Committee on information security and data privacy and protection. These presentations address a wide range of topics, including trends in cyber threats and the status of initiatives intended to bolster security systems and the cyber readiness of personnel.


text: Management's Role. The IT Security Team addresses and responds to cyber risk, including cyber risks related to security architecture and engineering, identity and access management and security operations. The team oversees compliance with the cybersecurity framework within the organization and facilitates cybersecurity risk management activities throughout the organization. The IT Security Team also assists with the review and approval of policies, completes benchmarking against applicable standards, and oversees the security awareness program.


text: The IT Security team is led by the CISO. The CISO reports to the CIO who, in turn, reports to the Executive Chairman and Chief Executive Officer. The CISO has 40 years of IT experience, with over 20 of those focused on IT security functions and strategies. Collectively, the other members of the IT Security Team have decades of relevant education and experience and maintain a wide range of industry certifications. Cybersecurity training is provided for the IT Security Team upon joining the IT Security Team, on an annual basis and more frequently when necessary.


text: As noted previously, the CISO is a member of the Council, which meets monthly to provide operational direction to the IT Security Team considering the evolving risk landscape. The IT Security Team and the Council, through ongoing communication, help monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The CISO or CIO, in consultation with the Council and other members of senior management, reports such threats and incidents to the Audit and Finance Committee, as appropriate. These reports may be included in, or in addition to, the regular annual reports to the Audit and Finance Committee.


text: The Corporation's risk management program includes focused efforts to identify, assess and manage cybersecurity risks including, but not limited to, the following: • Developing and maintaining a standardized Written Information Security Policy ("WISP"), which provides specific provisions pertaining to employee training, network security, data security, and confidential information for use and adherence by all pertinent operating entities of the Corporation; • Developing and maintaining an Incident Response Plan ("IRP"), which provides specific directives in the event of a cyber-attack including identifying the attack, containing and eradicating the cyber-threat, avoiding and minimizing damages, reducing recovering time, and mitigating future cybersecurity risks; • Aligning the Corporation's risk management program, as outlined in the WISP and the IRP, with the National Institute of Standards and Technology Cybersecurity Framework to prevent, detect and respond to cyber-attacks; • Requiring all employees with access to the Corporation's networks to participate in regular and mandatory training on how to be aware of, and help defend against, cybersecurity risks, combined with periodic testing to measure the efficacy of the training efforts; • Testing vulnerability of the Corporation's key systems to cybersecurity risks, including targeted penetration testing, tabletop incident response exercises, periodic audits by outside industry experts, and regular vulnerability scanning; • Maintaining adequate business continuity plans and critical recovery backup systems; • Engaging external cybersecurity experts in incident response development and management; and • Maintaining adequate cyber insurance for damages caused by a cyber-attack.

companyName: AMPCO PITTSBURGH CORP

ticker: AP


text: The Corporation's information security program is managed by its Data Protection Manager ("DPM") and its Information Technology Department (collectively, the "IT Team"). The DPM has extensive experience in cyber and global data protection initiatives with the Corporation and reports directly to the Corporation's Chief Executive Officer. The IT Team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.


text: In addition, the Corporation has established a Cybersecurity Materiality Assessment Team ("CMAT") for the purpose of evaluating specific cyber incidents or a series of related incidents. It includes certain of the Corporation's senior managers with cross-functional representation from operations, finance/accounting, information technology, risk management and human resources. CMAT is responsible for assessing the potential materiality of a cyber-incident based on the actual and anticipated potential impact to the Corporation's results of operations, financial position and cash flows; operations including disruptions and downtime; strategic plans; confidential information; employee and community health and safety; customers and vendors; investors; regulatory compliance; and reputation.


text: Engage Third Parties As part of the Corporation's cybersecurity risk management process, the Corporation engages a range of third parties, including consultants, advisors and software providers, to assist with security assessments and operations, employee training and awareness, compliance, penetration testing, network and endpoint monitoring, threat intelligence, and the Corporation's vulnerability management platform. These relationships enable the Corporation to access specialized knowledge and insights with respect to its cybersecurity strategies and processes.


text: Risks from Cybersecurity Threats From time to time, the Corporation has experienced attempts by unauthorized parties to access or disrupt its information technology systems. To date, it has not experienced any known material breaches or material losses related to cyber-attacks. However, a failure of the Corporation's information systems or a cybersecurity breach could materially and adversely affect its business, results of operations and financial condition. The Corporation manages its cybersecurity risk by limiting its threat landscape. For example, the Corporation does not store, transmit or process many of the types of data commonly targeted in cyber-attacks, such as consumer credit card or financial information. The Corporation recognizes cyber-threats are a permanent part of the risk landscape, and new threats are constantly evolving. For these and other reasons, cybersecurity is a top risk management priority.


text: Monitoring Cybersecurity Incidents The Corporation's efforts to prevent and detect cybersecurity incidents include continuous monitoring of the Corporation's networks. Employees throughout the Corporation are trained to report cybersecurity threats as they are identified. If an incident occurs or is suspected, it is reported to the DPM who completes an initial assessment of the incident and assigns a priority level, as outlined in the IRP, to the incident. Simultaneously, the DPM initiates the review process with CMAT and proceeds with the remediation process for recovery and eradication.


text: The CMAT assesses potential materiality of the confirmed or suspected security incident based on the actual or anticipated potential impact to the Corporation's results of operations, financial position and cash flows; operations including disruptions and downtime; strategic plans; confidential information; employee and community health and safety; customers and vendors; investors; regulatory compliance; and reputation.


text: The DPM reviews any material cybersecurity threats or incidents, as defined in the IRP, with the Audit Committee when they occur and non-material threats or incidents on a regular basis. Materiality of a cybersecurity threat or incident gives consideration to the potential and actual impact of the cybersecurity threat or incident.


text: Board of Directors' Oversight The Audit Committee of the Board of Directors (the "Audit Committee") oversees and reviews the design and effectiveness of the Corporation's cybersecurity program and its contingency plans and provides regular reports to the Board of Directors of the Corporation. The DPM provides periodic reports to the Audit Committee, the Corporation's Chief Executive Officer, Chief Financial Officer, and other members of senior management at each of the Audit Committee meetings and in the event of a cyber incident deemed material. These reports include updates on the Corporation's cyber risks and threats, the status of projects to strengthen its information security systems, assessments of the information security program, and the emerging threat landscape.


text: We strive to safeguard our important data, hardware, and internal network from digital attacks, theft and damage. In the ordinary course of our business, we collect, use, store, and digitally transmit confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. At Gyre Therapeutics, these processes are managed and monitored by a third-party information technology ("IT") consulting company (the "Managed Service Provider") and are overseen by our Chief Financial Officer. At Gyre Pharmaceuticals, these processes are managed and monitored by a dedicated Information Security team, which is led by the General Manager. Gyre Therapeutics' and Gyre Pharmaceuticals' processes include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data. In the process of advancing the systematic development of information security, we seek to maintain a robust approach that encompasses policy formulation, organizational structuring, technological application enhancement, process optimization, and personnel training. For example, Gyre Therapeutics and Gyre Pharmaceuticals maintain software and hardware inventories, perform security monitoring and alerting, and complete ongoing risk assessments. Gyre Therapeutics and Gyre Pharmaceuticals also conduct regular employee trainings on cyber and information security, among other topics. In addition, both companies consult with outside advisors and experts on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: GYRE THERAPEUTICS, INC.

ticker: GYRE


text: Our Chief Financial Officer, who reports directly to our Chief Executive Officer, is responsible for assessing and managing Gyre Therapeutics' cybersecurity risks with support from the Managed Service Provider, which employs IT consultants with over 20 years of experience managing information technology and cybersecurity matters and are certified as Microsoft Certified Systems Engineers. Our Gyre Pharmaceuticals information security team, who reports to the Secretary of the General Manager at Gyre Pharmaceuticals, comprises of three employees with an average of 20 years of experience managing information technology and cyber security matters. The Secretary of the General Manager reports to the General Manager at Gyre Pharmaceuticals, and the General Manager reports to the Board of Directors and is responsible for assessing and managing Gyre Pharmaceuticals' cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Breach, failure or disruption in or to our information system could compromise sensitive information related to our business and expose us to liability or reputational harm, and our ability to effectively manage our business operations could be adversely affected."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our management team. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Cybersecurity Governance and Responsibilities Our Board of Directors recognizes that cybersecurity represents an important component of the Company's overall enterprise risk management ("ERM"). Throughout the year, our Board of Directors and its Committees engage with management to discuss and mitigate a wide range of enterprise risks, including cybersecurity.

companyName: KYNTRA BIO, INC.

ticker: KYNB


text: We seek to mitigate cybersecurity risks through a cross-functional approach, including our Cybersecurity Committee, focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to and remediating cybersecurity incidents as and if they occur.


text: Our Cybersecurity Committee is comprised of information technology, finance, legal, human resources and data privacy employees. It meets regularly to review and oversee the Company's data security programs, policies, and strategies, including with respect to cybersecurity risk mitigation, business continuity, and business resiliency. Our Cybersecurity Committee (along with the Chief Financial Officer and General Counsel) also reviews, analyzes, and responds to cybersecurity incidents and breaches.


text: Our Audit Committee of the Board of Directors has the responsibility to review and discuss with management the Company's guidelines, policies, and governance with respect to financial risk exposures and enterprise risk management (including with respect to cybersecurity) and to regularly report to the full Board. Our Audit Committee also oversees our internal audit department and management's internal controls over financial reporting, including with respect to cybersecurity. Our Audit Committee receives regular presentations and reports on cybersecurity risks, progress on continued updates to The Company's cybersecurity procedures, as well as is made aware, on a timely basis, of any cybersecurity incidents deemed significant enough to be raised to their attention by management, as well as ongoing updates regarding any such incident until it has been remediated.


text: Our head of Information Technology ("IT") oversees overall cybersecurity management and implements our cybersecurity programs with the IT group, including appropriate risk mitigation strategies, systems, processes, and controls and provides periodic reports to our Audit Committee at least semi-annually. The head of IT holds a Masters in Computer Information Systems and a Bachelor of Science degree in Microbiology, and has served in leadership roles within the pharmaceutical and biotechnology industries for over 25 years, including leading enterprise-wide cybersecurity strategies, regulatory compliance programs, and IT transformation initiatives at leading biopharmaceutical companies. The head of IT has expertise spanning cybersecurity governance, risk management, cloud security, AI-driven cybersecurity enhancements, infrastructure modernization, and enterprise-wide IT resilience. The head of IT plays a key role in aligning cybersecurity frameworks with industry regulations such as SOC compliance, SOX, GxP, and data privacy standards, ensuring a secure and compliant IT environment to support business objectives.


text: Risk Management and Strategy We periodically assess and test our cybersecurity procedures. We identify and assess material risks from cybersecurity threats by engaging outside advisors and experts to identify, anticipate, and assess future threats and trends, to perform assessments on our cybersecurity risk and measures to mitigate such risk, including information security maturity assessments of our information security control environment. The results of such assessments and reviews are reported as appropriate to the Cybersecurity Committee and Audit Committee, and we adjust our cybersecurity procedures as necessary based on the information provided by these assessments and reviews.


text: Cybersecurity Technical Safeguards We continually invest in information and cybersecurity services and technologies. Technical safeguards are designed to protect the Company's information systems from cybersecurity threats, including firewalls, continuous intrusion detection and response system(s), data leak prevention strategies, enhanced email protection software, antimalware functionality and access controls. These safeguards are evaluated and improved through periodic assessments and review of cybersecurity threat intelligence. We rely on third parties to support its cybersecurity program, including but not limited to email security management, security operations and vulnerability management.


text: Cybersecurity Incident Response and Recovery Planning We have established and maintain incident response and data recovery plans that address our response to a cybersecurity incident. Our Cybersecurity Committee and members of the Cyber Security Incident Response Team (which contains additional information technology specialists) regularly test and evaluate the effectiveness of these incident response and data recovery plans. In addition to the incident detection safeguards described above, our cybersecurity policy requires employees and third party vendors to report any and all cybersecurity incidents to our IT department.


text: Third-Party Risk Management We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could materially impact our business in the event of a cybersecurity incident affecting those third-party systems. Depending on the nature of the services provided, we may conduct different amounts of diligence into the cybersecurity practices of the third party, monitor the third party for cybersecurity issues, and impose contractual obligations relating to privacy and cybersecurity onto the third party.


text: Education and Awareness We provide regular (at least annual) training for personnel regarding cybersecurity threats to equip our personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security procedures.


text: Current Cybersecurity Risk Posture For an additional description of the risks from cybersecurity threats that may materially affect the Company, see "Risk Factors" in this Annual Report on Form 10-K, including " If our information technology systems or data, or those of third parties upon which we rely, are or were compromised by a cybersecurity incident, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: Our current digital age has seen a remarkable growth in information technologies that allows for greater connectivity capabilities and faster sharing of data and information than ever before. These rapid advances in technology have been of great benefit to organizations like our own, which seek to deliver cutting-edge and life-enhancing solutions for our customers. In our pursuit of these objectives, we acknowledge and take seriously our responsibility to maintain the highest level of confidentiality, integrity, and availability of data belonging to our customers, prospects, external partners, and internal workforce members, and to protect our critical information technology systems and infrastructure against current and ever evolving cybersecurity threats and attacks.

companyName: Hyperfine, Inc.

ticker: HYPR


text: It is our organization's aim to comply with all cybersecurity and data privacy laws and regulations in applicable jurisdictions. Additionally, we are committed to meeting national and international standards and best practices for our industry for effective cybersecurity risk management of the organization's confidential information and critical IT infrastructure. Our cybersecurity and data protection policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or "NIST", and other applicable industry standards and frameworks such as HITRUST and SOC 2. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the data that we collect and store, and information systems and technologies through which that data is processed, by identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents when they occur. Our organization's internal administrative, technical, and physical security measures (controls) are tested for compliance to these frameworks and reviewed annually. The domains and controls associated with these frameworks are tested and reviewed annually. Certifications of compliance, and/or Auditor's 'Letters of Opinion' Attestation of Compliance from the applicable auditors are provided once the audits are completed each year.


text: The status of our cybersecurity program is regularly reported to our organization's board of directors. Our board of directors is actively involved in oversight of our cybersecurity risk management activities, and cybersecurity represents an important element of our organization's overall approach to risk management in the pursuit of its business goals and objectives.


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our data and information systems are effectively secured and prepared for information security risks by internal and external threat actors. Our program involves regular monitoring of our internal IT assets, data inventories, and potential security exploits and/or threats to those assets' confidentiality, integrity, and availability. We employ a range of technical security tools and external security services, including regular network and endpoint monitoring, compliance audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk posture, remediation plans and cybersecurity investments.


text: We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. As discussed in more detail under "Cybersecurity Governance; Management" below, our board of directors and our audit committee provide oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Compliance Officer, Chief Administrative Officer, Chief Operating Officer, Security Officer, Data Protection Officer, Senior Director of Cybersecurity and IT, and Governance Risk and Compliance Manager.


text: We also identify our cybersecurity threat risks by comparing our processes to standards established by HITRUST and SOC2 frameworks and any findings resulting from penetration testing and threat modeling conducted by third party service providers. To provide for the confidentiality, integrity, and availability of critical data and information systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following internal security measures: • maintain a cybersecurity program through formally-defined documented policies, standards, processes, and procedures to ensure internal security measures are implemented to protect against cybersecurity threats, to assess emerging cybersecurity and data privacy laws, and to implement changes to our processes that are designed to comply with laws applicable to our organization; • implement policies and procedures to identity organizational assets, data and critical IT systems, assess (and periodically re-assess) those assets, data, and systems for cybersecurity risks, and to develop management plans for identifying and remediating identified risks; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to handle confidential data and systems in a legally compliant and acceptable manner; • employ technical security tools that are designed to protect our critical data and information systems from cybersecurity threats, including network firewalls and access controls, vulnerability scanners, intrusion prevention and detection systems, anti-malware/endpoint protection systems, and identity and access management systems which are evaluated for effectiveness and improved through vulnerability assessments and cybersecurity threat intelligence; • provide quarterly, mandatory training for our employees regarding cybersecurity threats to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • implement administrative processes and procedures to define acceptable security parameters and baselines of IT assets and information systems, and utilize access controls to prevent unauthorized alterations to system parameters and to maintain oversight over configuration changes and modifications to those systems; • conduct third party security reviews of critical and high-risk third-party suppliers and vendors; • conduct quarterly phishing email simulations for all employees with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • run annual tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • implement a formal Incident Response Plan, based upon NIST, HITRUST, and SOC2 frameworks, to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident, which Incident Response Plan includes processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation; and • carry information security risk insurance to insure against potential losses arising from a cybersecurity incident.


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties, including annually having a third-party independent Risk Assessor review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers, manufacturers and other third parties who have access to patient and employee data or our IT systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and we continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading under Risk Factors titled "Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation", which disclosures are incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and any expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none. As needed, we will contract a professional cybersecurity investigation firm to conduct a full forensic analysis of any suspected material incident. To date, we have concluded that there has not been any evidence of material concern involving malware, persistence mechanisms or other compromised exchange of on-premises accounts within the Company's environment.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our audit committee to oversee risks from cybersecurity threats.


text: At least quarterly, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Our audit committee generally receives materials that include a cybersecurity scorecard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Chief Compliance Officer, Chief Administrative Officer, Chief Operating Officer, Security Officer, Data Protection Officer, Senior Director of Cybersecurity and IT, and Governance Risk and Compliance Manager. Such individuals have collectively over 50 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. Our audit committee is also designated to receive prompt and timely information regarding any material cybersecurity incident that meets reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Members of our audit committee are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: AGENUS INC

ticker: AGEN


text: We design and assess our program based on the Information Systems Audit and Control Association's Control Objectives for Information Technologies framework and National Institute of Standards and Technology cybersecurity framework, as well as threat trends identified by multiple external and internal cybersecurity intelligence reports.


text: Our cybersecurity risk management program is aligned to our business strategy and has been incorporated into our enterprise risk management process.


text: We contract with external firms to assess our cybersecurity controls. We have processes in place to identify and evaluate risks associated with third party vendors and suppliers. In addition, we have systems in place to maintain business continuity and disaster recovery. To date, we have not experienced any material cybersecurity incidents.


text: We describe whether and how risks from cybersecurity threats are reasonably likely to affect our business, results of operations and financial condition, under the heading "Our internal computer systems, or those of our third-party CROs, CMOs, licensees, collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption in our business and operations or could subject us to sanctions and penalties that could have a material adverse effect on our reputation or financial condition. " included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which is incorporated by reference into this Item 1C.


text: Cybersecurity Governance Our Audit Committee of the Board of Directors has oversight responsibility for risks and incidents related to cybersecurity threats. Our Chief Information Officer is a member of our Enterprise Risk Management Committee and provides the Audit Committee and the Board of Directors periodic reports on our cybersecurity risks and any material cybersecurity incidents.


text: Our team of cybersecurity professionals is led by our Chief Information Officer, who has over 20 years of experience in cybersecurity in regulated industries. Our cybersecurity team monitors the prevention and detection of cybersecurity events and is responsible for incident response and remediation.


text: The Company recognizes the importance of developing, implementing, and maintaining cybersecurity measures to ensure the security of our information systems and networks and the confidentiality, availability, and integrity of our data.

companyName: Turtle Beach Corp

ticker: TBCH


text: Risk management and strategy Turtle Beach uses a risk-based approach to cybersecurity, utilizing industry-standard frameworks and methodologies to assess and manage risks. The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes have been integrated into the Company's overall risk management processes and include an incident response plan to assess and remediate cybersecurity attacks.


text: The incident response plan provides guidance in identifying, assessing, investigating, remediating, and reporting any confirmed or suspected: (i) compromise of physical, network or system security; (ii) unauthorized access or acquisition of personal information or proprietary information; or (iii) material noncompliance with Company information privacy and security policies and procedures. The plan and associated processes have flexibility to ensure a tailored response based on the circumstances of the incident.


text: From time to time, the Company engages third party experts to assess the Company's cybersecurity controls and processes. For example, in 2021, the Company engaged an information security consultant to conduct and external, design-focused assessment using the National Institute of Standards and Technology framework to evaluate the Company's cybersecurity controls. The Company's management used the assessment to assist them in evaluating the Company's cybersecurity controls, and its Company's policies and procedures to further align them with industry standards.


text: The Company also has processes to identify and oversee cybersecurity threats associated with its use of third-party service providers. These processes include diligence of third-party cybersecurity risk through SOC-2 audits and use of independent vendors who provide cybersecurity ratings. In addition, the Company maintains an insurance policy which specifically provides coverage for qualifying information security breaches.


text: The Company has not experienced a material information security breach in the last five years, nor has it incurred any expenses or penalties or paid any settlements related thereto. The Company is not currently facing any cybersecurity threats reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition.


text: Cybersecurity is an important part of the Board's risk oversight. Although the full Board retains responsibility for cybersecurity oversight, the Audit Committee of the Board (the "Audit Committee") has authority to immediately assess and manage a cybersecurity incident if one were to occur. The Company's senior management briefs the Audit Committee and the Board periodically on cybersecurity matters and would promptly brief the Audit Committee if a cybersecurity incident occurred.


text: The Company's management has day-to-day responsibility for managing cybersecurity risks. The management team includes our Chief Financial Officer, who has cybersecurity expertise through prior leadership positions in networking and software businesses, and our Senior Director of Information Technology, who has formal data security training and certifications. In addition to using industry-standard tools to monitor cybersecurity risks, management receives direct reporting of cybersecurity threats from our employees, who are trained annually on cyber security risks and reporting.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying and managing material cybersecurity risks, and have integrated these processes into our overall risk management processes. We have also established policies and processes for managing and responding to material cybersecurity incidents.

companyName: Identiv, Inc.

ticker: INVE


text: We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments when there is a material change in our business practices that we believe could affect information systems that are vulnerable to cybersecurity threats. These risk assessments include identifying reasonably foreseeable internal and external risks and the potential harm if the risks were to materialize using tools such as a SIEM (Network and Cloud Platform Log Collector), Network Vulnerability Scanner, and other utilities for monitoring all Company assets. We conduct these risk assessments directly and also engage security product platform support teams as needed.


text: Following these risk assessments, we evaluate how to appropriately implement and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate members of our management team, including our executive staff, information technology ("IT") team, and Global Director of IT who reports to our Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO"), to manage the risk assessment and mitigation process. As part of our overall risk management, we collaborate cross-functionally to monitor and test our safeguards and to train our employees on cybersecurity risks and safeguards. We offer cybersecurity training programs for employees at all levels and departments.


text: We require appropriate third-party service providers to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect our Company. We oversee and identify risks from cybersecurity threats associated with our use of service providers through an onboarding vendor risk management program.


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business strategy, results of operations, or financial condition, there can be no guarantee that we will not experience such threats or incidents in the future. Like any technology provider, we have experienced cybersecurity incidents in the past which were remediated on a case-by-case basis. See "Risk Factors" for more information on our cybersecurity risks.


text: Cybersecurity Governance One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing our strategic risk exposure with respect to cybersecurity risks and the audit committee of our board of directors oversees management of such risks. Our executive officers, including our CEO and CFO, are responsible for day-to-day management of the material risks we face.


text: Our Global Director of IT, in coordination with our executive officers, including our CEO and CFO, are responsible for assessing and managing material risks from cybersecurity threats, as well as managing and responding to material cybersecurity incidents if any occur. Our Global Director of IT has over 30 years of experience in various information technology roles, which experience includes management of cybersecurity matters, including over 20 years of experience as an IT Director. Our CFO has over 10 years of experience in risk management at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Our Global Director of IT provides weekly briefings to the CEO and CFO about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In the event threats and incidents are identified as potentially significant, the CEO and CFO will promptly report to our audit committee. Our Global Director of IT also provides periodic updates to the audit committee on the Company's cybersecurity policies and processes, material cybersecurity risks and mitigation strategies, and the audit committee provides periodic reports to the board of directors on such matters.


text: Cybersecurity Risk Management and Strategy As an externally managed BDC, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Investment Adviser, an indirect subsidiary of AGM. AGM determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for us and other affiliated entities managed by AGM, and we rely on AGM for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: MidCap Apollo Institutional Private Lending


text: AGM's Board of Directors is involved in overseeing AGM's risk management program, including with respect to cybersecurity, which is a critical component of AGM's overall approach to enterprise risk management ("ERM"). AGM's cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are, in part, based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.


text: As one of the critical elements of AGM's overall ERM approach, AGM's cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance," AGM's Board of Directors has an oversight role, as a whole and also at the committee level, in overseeing management of AGM's risks, including its cybersecurity risks. AGM's Chief Information Security Officer ("CISO") and the Chief Information Security Officer of Athene Holding Ltd. ("AHL's CISO"), a subsidiary of AGM, with support from the broader AGM Technology team, are responsible for information security strategy, policies and practices, and also receive support, as appropriate, from our executive officers and other representatives of the Investment Adviser and its affiliates. • Collaborative Approach. AGM utilizes a cross-functional approach involving stakeholders across multiple departments, including AGM Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with our management and our Board, as applicable, in a timely manner. • Technical Safeguards. AGM deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. AGM has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. AGM maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. AGM provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.


text: AGM engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. AGM regularly engages third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to AGM's risk management function, and AGM adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Cybersecurity threat risks have not materially affected our company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Business and Structure—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, a misappropriation of funds, and/or damage to our business relationships, all of which could negatively impact our financial results."