text: Our cybersecurity program, which is overseen by the C-ROC, is managed by IT Management as part of its responsibility for enterprise-wide cybersecurity strategy, policies, implementing our monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes and various other technological and administrative safeguards. The team is led by our Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and our Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of our cybersecurity program.


text: Our Board has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity risk, to the Audit Committee. Our Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on our cybersecurity program, the external threat environment and our programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.

companyName: BLUE OWL CAPITAL INC.

ticker: OWL

secItem: Item 1C


text: Impact of Cybersecurity Risks In 2024, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Item 1A. Risk Factors—Risks Related to Our Operations—Cybersecurity risks and cyber data security incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and confidential information in our possession and damage to our business relationships." and "Item 1A. Risk Factors—Risks Related to Our Legal and Regulatory Environment—Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business and our products." Additionally, although we have insurance coverage for cybersecurity events, there can be no assurance that we will be able to maintain our insurance coverage or it will be enough to cover the cost associated with one or more cybersecurity events. See "Item 1A. Risk Factors—Risks Related to Our Legal and Regulatory Environment—We may not be able to maintain sufficient insurance to cover us for potential litigation or other risks."


text: We recognize the critical importance of maintaining the trust and confidence of patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. In general, we seek to address cybersecurity risks through a comprehensive approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: GRI Bio, Inc.

ticker: GRI


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. As discussed in more detail under "Cybersecurity Governance" below, our board of directors provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer.


text: To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls; and • provide training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers who have access to employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in Item 1A under the heading "We may be unable to adequately protect our information systems from cyberattacks, which could result in the disclosure of confidential or proprietary information, including personal data, damage our reputation, and subject us to significant financial and legal exposure," which disclosures are incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. Our board of directors is responsible for the oversight of risks from cybersecurity threats.


text: Upon detection of a cybersecurity threat, our board of directors receives an update from management of our cybersecurity threat risk management and strategy processes, as well as the steps management has taken to respond to such risks. Our board of directors also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, is managed by our Chief Financial Officer and supported by consultants with experience in managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs as needed. As discussed above, the Chief Financial Officer reports to our board of directors about material cybersecurity threat risks.


text: We recognize the critical importance of maintaining the trust and confidence of patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our Board is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. In general, we seek to address cybersecurity risks through a comprehensive approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. As discussed in more detail under "Cybersecurity Governance" below, our Board provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in Item 1A. under the heading "We may be unable to adequately protect our internal information systems, or those used by our CROs, clinical sites, or other contractors or consultants upon which we rely, from cyberattacks, compromises, cybersecurity incidents, or other disruptions, which could result in the compromise of sensitive or proprietary information, lead to operational or service interruption, harm our reputation, and subject us to litigation, fines and other significant financial and legal exposure, and other adverse consequences," which disclosures are incorporated by reference herein.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Board is responsible for the oversight of risks from cybersecurity threats.


text: Our Board receives periodic updates from management about our cybersecurity threat risk management and strategy processes. Additionally, upon detection of a cybersecurity threat, our Board receives an update from management of our cybersecurity threat risk management and strategy processes, as well as the steps management has taken to respond to such identified cybersecurity threat. Our Board also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, is managed by our Chief Financial Officer and supported by consultants with experience in managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs as needed. As discussed above, the Chief Financial Officer reports to our Board about material cybersecurity threat risks.


text: We recognize the critical importance of maintaining the trust and confidence of all our stakeholders. Our Board is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards, processes, and practices are fully integrated into our risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Velo3D, Inc.

ticker: VELO


text: Risk Management and Strategy As one of the critical elements of our overall risk management approach, our cybersecurity program is focused on the following key areas:


text: Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which receives, at a minimum, quarterly reports and presentations from our risk management function, our Vice President Information Technology (our "VP of IT") and other members of management. The Board and Audit Committee also receive prompt and timely information regarding material cybersecurity incidents as described below.


text: Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also executing controls and procedures that provide for the prompt escalation of certain material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such material incidents can be made by management in a timely manner.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans to address our response to cybersecurity incidents, and such plans are tested and reviewed on an as needed basis. Our cybersecurity program includes a dedicated security incident response team (the "SIRT") responsible for identifying, investigating, and mitigating cybersecurity threats. The SIRT follows a well-defined incident response process encompassing intake, investigation, mitigation, and recovery. This process leverages tools for threat detection and utilizes standardized protocols for containment, root cause analysis, and system restoration. By integrating security measures with a robust response process, we aim to minimize the impact of potential cyber incidents.


text: Incident Reporting and Communication: We have established protocols for reporting material cybersecurity incidents to management, stakeholders, and regulatory bodies as required. The Board is promptly informed and receives ongoing updates regarding material cybersecurity incidents as described below.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: We provide annual mandatory training for personnel regarding cybersecurity threats to equip our employees and contractors with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in an annual assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, focused on evaluating the effectiveness of our cybersecurity measures and planning.


text: Our Board, supported by the Audit Committee, oversees our risk management process. The Audit Committee receives, at a minimum, quarterly presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any material cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our VP of IT, in coordination with our executive management team, works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee basis and appropriate third-party contractors, the VP of IT, and our Head of Information Security, as well as the management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report threats and incidents to the Audit Committee, as needed.


text: Our VP of IT oversees information technology ("IT") strategy, operations, cybersecurity, compliance, and business applications. They are dedicated to accelerating and scaling our company by implementing innovative technology across the company. Additionally, they are an accomplished IT executive with over 20 years of leadership experience driving transformative change across diverse industries, including manufacturing, supply chain, and software as a service. The VP of IT is a skilled technical leader proficient in technology strategy, enterprise architecture, and program management.


text: Our Head of Information Security, Governance, Risk and Compliance is CISA certified and has over 20 years of leadership experience in IT audit and governance, risk and compliance ("GRC") at companies like Google, Cisco, Federal Reserve Bank, & Vodafone. They have substantial expertise in implementing SOX compliance, NIST compliance, COSO / COBIT framework, GDPR compliance, privacy compliance, regulatory compliance, internal IT audit, ITIL/ ITSM standards and risk assessment. Additionally, they have established our enterprise risk management program and leads our infosec steering committee. They have also been instrumental in automating GRC and continuous control monitoring to drive efficiency at our company.


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats in 2023 that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Risk Factors—Risks Related to Compliance Matters—Aspects of our business are subject to privacy, data use and data security regulations, which could increase our costs" and "—Risks Related to Our Business and Industry—We rely on our information technology systems to manage numerous aspects of our business and a disruption of these systems could adversely affect our business."


text: The Company's cybersecurity risk management program is integrated into our overall enterprise risk management process and is based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST Framework"). The program is comprised of a comprehensive set of policies and procedures designed to protect and identify threats to our Information Technology ("IT") systems and data, including those employed by our third-party service providers. Our dedicated cybersecurity team collaborates with business operations personnel as well as certain third parties, as applicable, to provide a comprehensive suite of cybersecurity services, encompassing network security, anti-malware solutions, email security measures, endpoint security, detection systems, application security, data safeguards, access management protocols, cybersecurity awareness initiatives, incident response strategies, threat intelligence, IT risk assessment and vulnerability management. We also maintain insurance coverage for cybersecurity incidents.

companyName: Dream Finders Homes, Inc.

ticker: DFH


text: The Company also engages third parties to perform periodic assessments of certain aspects of our cybersecurity measures, including vulnerability assessments and audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Nominating and Governance Committee and the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our Board of Directors has delegated oversight of cybersecurity risks to our Nominating and Governance Committee. Executive management, inclusive of our Vice President of IT ("VP of IT") in conjunction with our National Vice President of Finance ("NVP of Finance"), provides regular updates to the Nominating and Governance Committee including any updates to our program in response to new or changed cybersecurity risks, as well as ongoing metrics around the effectiveness of our existing cybersecurity strategies.


text: The VP of IT and the NVP of Finance work in coordination with the Cybersecurity Response Committee, which also includes our Chief Financial Officer ("CFO") and representatives from legal, internal audit and SEC reporting functions. In the event of a cyber incident, the Cybersecurity Response Committee utilizes a formal incident response plan based on the NIST Framework to assess and manage cybersecurity threats. The incident response plan encompasses the containment, eradication, recovery, and resolution processes for the incident, while also detailing the individuals and groups that need to be notified.


text: The VP of IT has served in various roles in information technology and information security for over 24 years, including serving as the Chief Information Security Officer of a healthcare company and a member of the cyber emergency response team at several companies. The VP of IT holds undergraduate and graduate degrees in computer science and has attained various professional certifications in cybersecurity. The NVP of Finance and the rest of the Cybersecurity Response Committee hold undergraduate and graduate degrees in their respective fields, and have over 50 years of collective experience managing enterprise risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats have not materially affected the Company, including our business strategy, results of operations or financial condition, to date. Risks relating to cybersecurity threats and potential impacts to our business strategy, results of operations or financial condition are discussed in "Risk Factors" herein.


text: The Company engages third parties to perform periodic assessments of certain aspects of our cybersecurity measures, including vulnerability assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Nominating and Governance Committee and the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The VP of IT and the NVP of Finance work in coordination with the Cybersecurity Response Committee, which also includes our Chief Financial Officer and representatives from legal, internal audit and SEC reporting functions. In the event of a cyber incident, the Cybersecurity Response Committee utilizes a formal incident response plan based on the NIST Framework to assess and manage cybersecurity threats. The incident response plan encompasses the containment, eradication, recovery, and resolution processes for the incident, while also detailing the individuals and groups that need to be notified.


text: The VP of IT has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Security Officer of a healthcare company and a member of the cyber emergency response team at several companies. The VP of IT holds undergraduate and graduate degrees in computer science and has attained various professional certifications in cybersecurity. The NVP of Finance and the rest of the Cybersecurity Response Committee hold undergraduate and graduate degrees in their respective fields, and have over 50 years of collective experience managing enterprise risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Management and Board Oversight Our Board of Directors oversees risk management for the Company, including through its approval of the investment policy and other policies of the Company and its oversight of the Adviser. For certain risks, our Board of Directors has delegated oversight responsibilities to committees of our Board of Directors. For example, the Nominating and Corporate Governance Committee assists our Board of Directors with assessing risks associated with conflicts of interest. Cybersecurity risk management is integrated into this broader risk management framework. Our Board of Directors has delegated to the Audit Committee oversight of management's programs and policies to identify, assess, manage, mitigate and monitor significant business risks of the Company, including privacy, information technology and cybersecurity risks.

companyName: Franklin BSP Capital Corp

ticker: FRBP


text: Information Technology and Cybersecurity Risks We have no employees and rely on the Adviser, a wholly-owned subsidiary of Franklin Templeton, to manage our day-to-day operations pursuant to the Advisory Agreement. Therefore, we rely heavily on Franklin Templeton's information systems and its program for defending against and responding to cybersecurity threats and incidents. Franklin Templeton maintains a robust cybersecurity defense program, including a dedicated cybersecurity team led by its Chief Security Officer ("CISO"). The CISO, who reports directly to the Franklin Templeton Executive Vice President and Chief Risk and Transformation Officer, has 28 years of experience in the information technology and cybersecurity field and has been at Franklin Templeton for 12 years. In addition, the CISO provides regular briefings for our Board of Directors and senior officers of the Company on cybersecurity matters, including on threats, events, and program enhancements. The Chief Compliance Officer of the Company also provides periodic updates to our Board of Directors and senior officers of the Company on cybersecurity threats and material risks from cybersecurity threats with respect to the Company.


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems the Adviser uses to provide services to us pursuant to the Advisory Agreement, Franklin Templeton's cybersecurity team utilizes a regularly updated cybersecurity incident response plan that was developed based on, and is periodically benchmarked to, applicable third-party cybersecurity standards and frameworks. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the response team is led by the CISO or their delegee. In addition, senior officers of the Company have implemented a Company policy that supplements the Franklin Templeton incident response plan with respect to cybersecurity incidents that have or may impact the Company, including by impacting the Adviser's ability to provide services to the Company pursuant to the Advisory Agreement. Pursuant to this policy, the Adviser and Franklin Templeton are required to notify and update the Company's senior officers and our Audit Committee with respect to certain matters related to cybersecurity incidents specified under the policy.


text: The Audit Committee oversees, on behalf of our Board of Directors, the Company's privacy, information technology and security and cybersecurity risk exposures, including (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation, (ii) the programs and steps implemented by management to monitor and mitigate any exposures, (iii) the Company's information governance and information security policies and programs, and (iv) major legislative and regulatory developments that could materially impact the Company's privacy, data security and cybersecurity risk exposure. On a quarterly basis, the CISO or their delegee report to our Board of Directors or Audit Committee on information technology and cybersecurity matters, including a detailed threat assessment relating to information technology risks.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats The Franklin Templeton cybersecurity program focuses on (1) preventing and preparing for cybersecurity incidents, (2) detecting and analyzing cybersecurity incidents, and (3) containing, eradicating, recovering from and reporting cybersecurity events. The Company has a policy that supplements the Franklin Templeton cybersecurity incident response plan and addresses reporting and disclosure considerations related to a cybersecurity incident.


text: Prevention and Preparation Franklin Templeton undertakes regular internal and external security audits and vulnerability assessments to reduce the risk of a cybersecurity incident and they implement business continuity, contingency and recovery plans to mitigate the impact of an incident. As part of these efforts, Franklin Templeton periodically engages consultants to conduct external reviews of its vulnerabilities, including penetration testing and compromise assessments. Franklin Templeton employs best practice identity and access management including broad adoption of multifactor authentication, geo-location blocking, behavior analytics and controls aligned to a zero trust model.


text: Franklin Templeton and the Adviser recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of their prevention efforts is employee training on their data privacy and cybersecurity procedures. For example, all new hires of Franklin Templeton and the Adviser receive mandatory privacy and information security training. In addition, current employees of the Adviser must complete mandatory annual cybersecurity and data trainings, which are supplemented by regular phishing and other cyber-related testing and trainings that the Adviser conducts throughout the year.


text: We recognize that third parties that provide information systems used by the Adviser to provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To mitigate third party risk, Franklin Templeton maintains a vendor code of conduct, which is designed to require third party vendors to comply with our requirements for maintenance of passwords, as well as other confidentiality, security, and privacy procedures. All third party vendors must complete a cyber incident reporting questionnaire to ensure timely notification of any potential cybersecurity breaches. Third-party IT vendors are also subject to additional diligence requirements.


text: As discussed above, to support its preparedness, Franklin Templeton has an incident response plan that it regularly updates. In addition, Franklin Templeton performs regularly scheduled tabletop exercises and periodic drills at least once a year to test its incident response procedures, identify improvement opportunities and exercise team preparedness. Franklin Templeton also maintains cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt its network or networks of its vendors, in all cases up to specified limits and subject to certain exclusions.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by the Franklin Templeton cyber defense team, notifications from employees, borrowers or service providers, and notifications from third party information technology system providers. Franklin Templeton also has a comprehensive threat intelligence program that performs proactive analyses leveraging internal, government and third party provided intelligence to identify and mitigate risks to the firm. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to the Franklin Templeton incident response plan follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event (e.g., ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the Franklin Templeton incident response team is initially focused on containing the cybersecurity incident as quickly as possible consistent with the procedures in the incident response plan. Containment procedures may include off-lining systems, including by disconnecting network cable, utilizing network-management tools to isolate the host, altering the DNS entry of impact hosts, and coordinating with service providers.


text: Once a cybersecurity incident is contained the focus shifts to remediation. Eradication and recovery activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions, validation of files or data that may have been affected, and increased network monitoring or logging to identify recurring attacks.


text: Franklin Templeton has relationships with a number of third party service providers to assist with cybersecurity containment and remediation efforts, including a forensic investigation firm, a ransomware recovery vendor, a communications firm, and various law firms.


text: Following the conclusion of an incident, the Franklin Templeton incident response team will generally reassess the effectiveness of the cybersecurity program and incident response plan, make adjustments as appropriate and report to our senior management and Audit Committee on these matters.


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. We and our Adviser routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachments to emails, phishing attempts, extortion or other scams; however, we have been able to prevent or sufficiently mitigate harm from such risks. Although the Adviser and Franklin Templeton, on our behalf, make efforts to maintain the security and integrity of the information technology systems the Adviser uses on our behalf, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them are subject to the risk of a security incident or disruption, and there can be no assurances regarding our security efforts and measures or those of our third party providers. See "Item 1A–Risk Factors– Our business could suffer in the event our Adviser or any other party that provides us with services essential to our operations experiences system failures or cyber-incidents or a deficiency in cybersecurity."


text: Information Technology and Cybersecurity Risks We have no employees and rely on the Adviser, a wholly-owned subsidiary of Franklin Templeton, to manage our day-to-day operations pursuant to the Amended and Restated Investment Advisory Agreement. Therefore, we rely heavily on Franklin Templeton's information systems and its program for defending against and responding to cybersecurity threats and incidents. Franklin Templeton maintains a robust cybersecurity defense program, including a dedicated cybersecurity team led by its Chief Security Officer ("CISO"). The CISO, who reports directly to the Franklin Templeton Executive Vice President and Chief Risk and Transformation Officer, has 30 years of experience in the information technology and cybersecurity field and has been at Franklin Templeton for 13 years. In addition, the CISO provides regular briefings for our Board of Directors and senior officers of the Company on cybersecurity matters, including on threats, events, and program enhancements. The Chief Compliance Officer of the Company also provides periodic updates to our Board of Directors and senior officers of the Company on cybersecurity threats and material risks from cybersecurity threats with respect to the Company.


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems the Adviser uses to provide services to us pursuant to the Amended and Restated Investment Advisory Agreement, Franklin Templeton's cybersecurity team utilizes a regularly updated cybersecurity incident response plan that was developed based on, and is periodically benchmarked to, applicable third-party cybersecurity standards and frameworks. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the response team is led by the CISO or their delegee. In addition, senior officers of the Company have implemented a Company policy that supplements the Franklin Templeton incident response plan with respect to cybersecurity incidents that have or may impact the Company, including by impacting the Adviser's ability to provide services to the Company pursuant to the Amended and Restated Investment Advisory Agreement. Pursuant to this policy, the Adviser and Franklin Templeton are required to notify and update the Company's senior officers and our Audit Committee with respect to certain matters related to cybersecurity incidents specified under the policy.


text: We recognize that third parties that provide information systems used by the Adviser to provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To mitigate third party risk, Franklin Templeton requires third party vendors to comply with our confidentiality, security, and privacy requirements. All third party vendors must complete a cyber incident reporting questionnaire to ensure timely notification of any potential cybersecurity breaches. Third-party vendors are also subject to additional diligence requirements.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by the Franklin Templeton cyber defense team, notifications from employees, borrowers or service providers, and notifications from third party information technology system providers. Franklin Templeton also has a comprehensive threat intelligence program that performs proactive analyses leveraging internal, government and third party provided intelligence to identify and mitigate risks to the firm. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to the Franklin Templeton incident response plan follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event and assessing the severity of the event and sensitivity of any compromised data.


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the Franklin Templeton incident response team is initially focused on containing the cybersecurity incident as quickly as possible consistent with the procedures in the incident response plan.


text: Franklin Templeton has relationships with a number of third party service providers to assist with cybersecurity containment and remediation efforts.


text: Cybersecurity Risks As of December 31, 2024, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. We and our Adviser routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachments to emails, phishing attempts, extortion or other scams; however, we have been able to prevent or sufficiently mitigate harm from such risks. Although the Adviser and Franklin Templeton, on our behalf, make efforts to maintain the security and integrity of the information technology systems the Adviser uses on our behalf, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them are subject to the risk of a security incident or disruption, and there can be no assurances regarding our security efforts and measures or those of our third party providers. See "Item 1A.–Risk Factors– Our business could suffer in the event our Adviser or any other party that provides us with services essential to our operations experiences system failures or cyber-incidents or a deficiency in cybersecurity."


text: Risk management and strategy The Company and the broader financial services industry face an increasingly complex and evolving threat environment.

companyName: SL Investment Corp.


text: Morgan Stanley has made and continues to make substantial investments in cybersecurity and fraud prevention technology, and employ experienced talent to lead its Cybersecurity and Information Security organizations and program under the oversight of Morgan Stanley's Board of Directors (the "MS Board") and the Operations and Technology Committee of the MS Board ("BOTC").


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify, and manage risks arising from the cybersecurity threats confronting the Firm ("Cybersecurity Program"). Morgan Stanley's Cybersecurity Program helps protect the Firm's clients, customers, employees, property, products, services, and reputation by seeking to preserve the confidentiality, integrity, and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems, including as applicable to the Company and its stockholders. Morgan Stanley continually adjusts its Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.


text: The Adviser and the Administrator manage the Company's day-to-day operations, and the Company uses the Cybersecurity Program to assess, identify and manage material cybersecurity risks affecting the Company and its operations. The Company's business is dependent on the communications and information systems of Morgan Stanley, including but not limited to the Cybersecurity Program, and other third-party service providers.


text: Processes for assessing, identifying, and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and stockholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley forensics team, which develops and implements technologies designed to help detect these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Where a potential threat is identified in Morgan Stanley's environment or which impacts the Company, Morgan Stanley's incident response team evaluates the potential impact to the Firm and, as relevant, the Company, and coordinates remediation where required. These groups, as well as Morgan Stanley's Operational Risk Department, review external cybersecurity incidents that may be relevant to the Firm and the Company, and the outcomes of these incidents further inform the design of the Cybersecurity Program. In addition, Morgan Stanley maintains a robust global training program on cybersecurity risks and requirements and conducts regular training exercises for its employees and consultants, including those personnel relied upon by the Company.


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to the Firm or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity program to identify the impact of their services on the cybersecurity risks to the Firm or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or a Firm audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, certain elements of the Cybersecurity Program are subject to an audit by an independent consultant, as well as an assessment by a separate, independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley and Company Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Risk, is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company. Those processes are periodically tested through tabletop exercises.


text: The Chief Compliance Officer ("CCO") of the Company is responsible for overseeing the Company's risk management function and generally and relies on the CIO, CISO, and Head of Operational Risk to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of Operational Risk has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies. The Company's CCO has worked in the financial services industry for 19 years and has covered business developments from a compliance perspective for over 10 years, during which time the Company's CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of Operational Risk report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our Board.


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO, the CISO, and the Head of Operational Risk, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2023, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations.

companyName: Carriage House Event Center, Inc.


text: Cybersecurity Governance Our Board of Directors oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Management reports to our Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: One of the key functions of our Board of Directors is informed oversight of our various processes for managing risk. An overall review of risk is inherent in our Board of Directors ongoing consideration of our long-term strategies, transactions and other matters presented to and discussed by the Board of Directors. This includes a discussion of the likelihood and potential magnitude of various risks.


text: The Cooperative's Board of Directors recognizes the significance that cybersecurity has on our business, particularly the security of our member data, and is responsible for overseeing risks to the Cooperative from cybersecurity threat actors. Our operations rely party providers. These systems collect, process, transmit and retain information that may require both mandatory and voluntary data protection regimens.

companyName: Golden Growers Cooperative

ticker: GGROU


text: Our cybersecurity practices are designed to provide reasonable information security given the nature of our organization and our third-party relationships. We rely on the representations third-party relationships introduce additional cybersecurity risks. To address these third-party risks, we have established strict criteria for supplier selection and conduct security risk assessments to mitigate potential impacts on our business.


text: The Cooperative's Board of Directors contracts with a Managed Security Service Provider. Our Managed Security Service Provider services include: (i) managed IT services, consisting system monitoring and reporting; and (ii) cyber security services, consisting of firewall management, intrusion detection and prevention, malware and virus protection, security audits and vulnerability assessments, security incident response, and employee awareness training. In addition, our Managed Security Service Provider conducts risk assessments and provides recommendations to the Executive Vice President and the Board of Directors, provides threat containment and mitigation services, assists the Cooperative with cybersecurity compliance, and would coordinate with insurance carriers and law enforcement in the event of a cybersecurity incident.


text: The Cooperative's Board of Directors believes a strong cybersecurity strategy is vital to protect our business operations, sustain our control environment and honor our data protection obligations. The Board has delegated to its Finance & Audit Committee the responsibility for monitoring the effectiveness of the Cooperative's internal cybersecurity practices. The Executive Vice President manages the Cooperative's cybersecurity-related risks, communicates with suppliers and other third party providers regarding cybersecurity threats, incidents, plans and responses, and reports to the Finance & Audit Committee and/or the entire Board regarding such cybersecurity threats, incidents, plans and responses on at least a semi-annual basis, and more often as needed.


text: 2024, the Cooperative did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Cooperative, including its business strategy, results of operations, or financial condition.


text: The Company does not have any processes for identifying and managing material risks from cybersecurity threats. The Company considers that at the current stages of its development and information systems there are no risks of cybersecurity incidents that have materially affected and are reasonably likely to materially affect the company, including its business strategy, results of operations, or financial condition.

companyName: NIKA PHARMACEUTICALS, INC

ticker: NIKA


text: Because the Company is not reasonably likely to be materially affected by cybersecurity threats at the current stages of its development, there are no particular director's oversight of risks from cybersecurity threats and management does not have an active role in assessing and managing the Company's material risks from cybersecurity threats.


text: Risk Management and Strategy Overview As cybersecurity threats rapidly evolve in sophistication and become more prevalent, especially with the increasing use of artificial intelligence technology, we have implemented a cybersecurity risk management program as part of our oversight, evaluation and mitigation of enterprise-level risks. We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. Our cybersecurity risk management program leverages a combination of processes, technologies and personnel with expertise in cybersecurity to comply with applicable regulations and detect and respond to cyber-attacks, data breaches, security incidents, and compromises of personal information, as well as to regularly and promptly inform management and our Board of Directors of any significant cybersecurity risks and developments.

companyName: TriSalus Life Sciences, Inc.

ticker: TLSI


text: Our company currently does not have a Chief Information Security Officer ("CISO") due to our size; our Director of Operations ("DO"), with assistance from our third-party information technology ("IT") support firm, leads the Company's effort in establishing cybersecurity strategies and structures and helps identify, assess, and manage the Company's cybersecurity threats and risk. Our DO regularly meets with our third-party IT support firm to discuss cybersecurity threats and risk. This team helps identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods and tools, for example, phishing and social engineering tests.


text: We have worked, and expect to continue to work, with third-party service providers, as appropriate, to assess, identify and manage cybersecurity risks. As such, our DO meets with the senior management from our IT support firm regularly to discuss work requests and issues raised that may need to be added to the network for security. We also conduct periodic and on-demand assessments of our cybersecurity risk management program with expert service providers to ensure it remains current, given the changing risk environment. The DO regularly updates cybersecurity matters to the executive management team.


text: We use third-party service providers to perform a variety of critical functions throughout our business, such as hosting providers, application providers, contract research organizations and contract manufacturing organizations. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our DO. Our DO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant employees and personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our DO, with the appropriate members of management, will work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.


text: Cybersecurity risks are overseen by the Board of Directors and the Audit Committee. The Audit Committee is central to the Board of Directors' oversight of cybersecurity risks and bears the primary responsibility for overseeing cybersecurity risk. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major cybersecurity initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.


text: Our DO provides comprehensive updates to the Audit Committee quarterly and the full Board of Directors at least annually. These briefings have included a range of topics, such as: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; • Metrics demonstrating company and industry-standard prevention of common threats; and • Regulatory changes impacting cybersecurity requirements and strategy.


text: The Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and is actively engaged in our cybersecurity risk management strategy.


text: As of the date of this report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: Risk Management and Strategy Overview As cybersecurity threats rapidly evolve in sophistication and become more prevalent, especially with the increasing use of artificial intelligence technology, we have implemented a cybersecurity risk management program as part of our oversight, evaluation and mitigation of enterprise-level risks. We recognize the importance of developing, implementing, and maintaining cybersecurity measures that are designed to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. Our cybersecurity risk management program leverages a combination of processes, technologies and personnel with expertise in cybersecurity in an effort to comply with applicable regulations and detect and respond to cyber-attacks, data breaches, security incidents, and compromises of personal information, as well as to inform management and our Board of Directors of any significant cybersecurity risks and developments.


text: Our Senior Director of Operations ("DO"), with assistance from our third-party information technology ("IT") support firm, leads the Company's effort in establishing cybersecurity strategies and structures that help to identify, assess, and manage the Company's cybersecurity threats and risk. Our DO working knowledge of end-user best practices and regularly meets with our third-party IT support firm to discuss potential cybersecurity threats and risk. This team helps identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods and tools, for example, phishing and social engineering tests. Based on these meetings, our DO identifies additional end-user education and company security needs, which are supported through our IT support firm or other third-party IT experts.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our DO, with the appropriate members of management, will work with the Company's incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Audit Committee of the Board of Directors ("Audit Committee") for certain cybersecurity incidents.


text: Cybersecurity risks are overseen by the Audit Committee. The Audit Committee is central to the Board of Directors' oversight of cybersecurity risks and bears the primary responsibility for overseeing cybersecurity risk. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major cybersecurity initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.


text: Our DO provides comprehensive updates to the Audit Committee and the full Board of Directors at least annually. These briefings have included a range of topics, such as: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; • Metrics demonstrating company and industry-standard prevention of common threats; and • Regulatory changes impacting cybersecurity requirements and strategy.


text: The Board of Directors is aware of the importance of managing risks associated with cybersecurity threats and is actively engaged in our cybersecurity risk management strategy.


text: We are committed to safeguarding our customers and the sensitive information shared in the application of software and services provided. Our cybersecurity program, risk management and governance reflect our dedication to not only meeting industry standards but exceeding them.

companyName: Certara, Inc.

ticker: CERT


text: Risk Management and Strategy We recognize that cybersecurity risks pose a significant threat to our business, customers, and stakeholders, and we have implemented a comprehensive security and privacy program to address these risks. We embed security considerations into every aspect of our operations, and our focus encompasses a proactive approach that involves continuous monitoring to swiftly detect and respond to emerging threats to ensure that our customers' information remains secure in the face of evolving cybersecurity challenges. With a foundation grounded in industry best practices, including NIST 800-53, ISO 27001, CIS Top 20, OWASP Top 10, and Security by Design, we prioritize the identification and assessment of risks to create a protective shield around our customers' data.


text: This foundation guides our processes for assessing, identifying, and managing risks related to cybersecurity threats and incidents, as well as ensuring compliance with legal and contractual obligations. Our risk management processes are integrated into our overall business strategy and operations. We use various methods and tools to identify and assess cybersecurity risks across all assets in our technical landscape, such as vulnerability scanning, penetration testing, threat intelligence, risk assessments, and audits from customers. We also use third-party assessors and service providers, consultants, and auditors, to support our risk management processes and to provide independent validation and verification of our security posture. We have established processes to oversee and identify risks associated with our use of third-party assessors and service providers, such as due diligence, contractual obligations, monitoring and vendor evaluation and qualification.


text: We maintain robust cybersecurity incident response procedures, which includes escalating incidents to the appropriate level of management, mitigation, remediation and the assessment of materiality of cybersecurity incidents, or a series of related incidents, that may materially affect or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. We also disclose information regarding our security and privacy program and practices on our website and in our public-facing notices.


text: Furthermore, we conduct annual cybersecurity awareness training for our employees in order to provide them with the knowledge necessary to navigate the digital landscape securely. We understand that cybersecurity is not a static concept but a dynamic discipline, and our security and privacy program reflects this by incorporating internal and third-party audits, penetration testing, active vulnerability scanning and a continuous improvement mindset.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents, or a series of related incidents, that have had or are reasonably likely to have a material impact on the Company's business strategy, results of operations or financial condition. For more information on our cybersecurity related risks, see Part 1, Item 1A. Risk Factors entitled "Risks Related to Intellectual Property, Information Technology and Data Privacy" included elsewhere in this Annual Report on Form 10-K.


text: We have established a corporate governance structure that provides oversight and guidance for our security and privacy program. The Board of Directors (the "Board") is ultimately responsible for the oversight of the Company's security and privacy program. The Audit Committee, which supports the Board in the oversight of the program, is focused on cybersecurity and data privacy risk, including incident response planning, timely identification and assessment of incidents, incident recovery and business continuity considerations.


text: We have defined roles and responsibilities for the management of cybersecurity risks, including specific executive-level and management-level positions or committees. Our security and privacy program is overseen by our Security and Privacy Program Office ("SPPO"), which is composed of corporate leadership from legal and IT. The SPPO is accountable to the VP of Information Technology, who is the accountable executive for the program. Our function and business unit executive leadership, acting in support of the SPPO and the Board, is responsible for ensuring organizational compliance with data protection regulations and controls across the organization. Our VP of Information Technology and Director, Compliance Standards & Data Privacy ("DCSDP"), are responsible for the design, implementation, and monitoring of the security and privacy policies, standards, procedures, and controls that govern our information systems and data processing activities. Our VP of Information Technology, has 30 years of experience in IT infrastructure, cybersecurity operations, and site reliability engineering for a wide range of software and service organizations, with the last 15 years focused on SaaS software businesses with access to sensitive customer data. The DCSDP also has 30 years in IT with the last 12 focused on compliance and data privacy issues for Certara.


text: The VP of Information Technology and DCSDP also have a reporting responsibility to the General Counsel, and the Board via the Audit Committee. They coordinate the response and remediation of cybersecurity incidents and data breaches and report on the status and effectiveness of the security and privacy program to the SPPO, the Board, the Audit Committee, and other stakeholders on a quarterly basis, or more frequently as needed.


text: We have established processes to ensure that management is informed about and monitors cybersecurity incident prevention, detection, mitigation, and remediation. These processes include regular reporting, escalation, and communication protocols, as well as periodic reviews and audits of the security and privacy program.


text: We are committed to safeguarding our customers' information that is shared with us in the application of the software and services we contractually provide to them. Our information systems, including our cybersecurity program, risk management systems and processes and governance, reflect our dedication to meeting industry cybersecurity standards.


text: Risk Management and Strategy We have implemented a comprehensive cybersecurity and data privacy program as part of our risk management processes to assess, identify and manage risks posed to our business by cybersecurity threats. We embed cybersecurity considerations into every material aspect of our operations, and our focus encompasses a proactive approach that involves continuous monitoring to swiftly detect and respond to cybersecurity threats. Our cybersecurity risk management processes are grounded in industry best practices, including NIST 800-53, ISO 27001, CIS Top 18, OWASP Top 10, and Security by Design and are intended to prevent adverse effects on the confidentiality, integrity and availability of our information systems and information residing therein.


text: Our cybersecurity processes have been integrated into our risk management processes in order for us to assess, identify, and manage risks related to cybersecurity threats and ensure compliance with our legal and contractual obligations, which require us to safeguard the confidential and sensitive information provided to us by our customers. For example, we use various methods and tools to identify and assess cybersecurity threats across all assets in our technical landscape, such as vulnerability scanning, penetration testing, threat intelligence, risk assessments, and audits from customers. We regularly engage third-party assessors, service providers, consultants, and auditors to support and review our risk management processes and to provide independent validation and verification of our security posture. We have established processes to oversee and identify risks from cybersecurity threats associated with our use of third-party assessors and service providers, such as due diligence, contractual language, monitoring and periodic vendor evaluation and qualification.


text: We maintain robust cybersecurity threat procedures, which includes escalating threats to the appropriate level of risk management, mitigation, remediation and the assessment of materiality of cybersecurity threats, or a series of related incidents, that may materially affect or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. We disclose information regarding our cybersecurity and privacy program and practices on our website and in our public-facing notices.


text: As of December 31, 2024, we were not aware of any cybersecurity threats that have materially affected, or are reasonably likely to affect, the Company, including its business strategy, results of operations or financial condition. As discussed more fully under Part 1, Item 1A. Risk Factors, the sophistication of cyber threats continues to increase, and the preventative actions the Company takes to reduce the risk of cyber incidents and protect its systems and information may be insufficient. No matter how well designed or implemented the Company's cybersecurity controls are, it will not be able to anticipate all security breaches, and it may not be able to implement effective preventive measures against cybersecurity breaches in a timely manner. See Part 1,


text: Item 1A. Risk Factors entitled "Risks Related to Intellectual Property, Information Technology and Data Privacy" included elsewhere in this Annual Report on Form 10-K.


text: We have established a corporate governance structure that provides oversight and guidance for our cybersecurity and data privacy program. Our Board of Directors (the "Board") is responsible for the oversight of our cybersecurity and privacy program and risks from cybersecurity threats. Our Board's Audit Committee, which supports the Board in its oversight of our cybersecurity and data privacy program, is focused on cybersecurity and data privacy risk, including incident response planning, and timely identification and assessment of cybersecurity threats, cybersecurity incident recovery and business continuity considerations.


text: We have defined roles and responsibilities for our assessment and management of risks related to cybersecurity threats, including specific executive-level and management-level positions or committees. Our cybersecurity and privacy program is overseen by our Security and Privacy Program Office ("SPPO"), which is composed of corporate leadership from legal and information technology ("IT"). The SPPO reports to our Head of Information Technology, who is the accountable executive for our cybersecurity program. Our function and business unit executive leadership, acting in support of our SPPO, is responsible for ensuring organizational compliance with data protection safeguard regulations and related risk controls across our organization. Our Head of Information Technology and our Director, Compliance Standards & Data Privacy ("DCSDP"), are responsible for the design, implementation, and monitoring of the cybersecurity and data privacy policies, standards, procedures, and controls that govern our information systems and data processing activities. Our Head of Information Technology has more than 30 years of experience in IT infrastructure, cybersecurity operations, and site reliability engineering for a wide range of software and service organizations, with the last 16 years focused on SaaS software businesses with access to sensitive customer data. The DCSDP also has over 30 years in IT with the last 13 focused on compliance and data privacy issues for Certara.


text: Our Head of Information Technology and DCSDP report to our General Counsel, as well as to our Board through its Audit Committee. The IT Security team and DCSDP coordinate the response and remediation of cybersecurity incidents and data breaches and report on the status and effectiveness of the security and privacy program to the SPPO, the Board and the Audit Committee on a quarterly basis, or more frequently as needed.


text: We have established processes to ensure that management is informed about and monitors cybersecurity threat prevention, detection, mitigation, and, if necessary, cybersecurity incident remediation. These processes include regular reporting, escalation, and communication protocols, as well as periodic reviews and audits of our cybersecurity and data privacy program.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Playtika Holding Corp.

ticker: PLTK


text: We use the NIST Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements.


text: Our cybersecurity risk management program comprises one component of our overall enterprise risk management program which is organized by discipline areas. Our cybersecurity risk management program shares common reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • integration with software development procedures and processes throughout the lifecycles of our products. • a team comprised of IT security, IT engineering and IT compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems and designated security champions throughout the Company's departments; • a cybersecurity incident response plan and Security Operations Center (SOC) to respond to cybersecurity incidents; • a third-party risk management process for service providers.


text: There can be no assurance that our cybersecurity risk management program, including our controls, procedures and processes, will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems, product and network. See "Risk Factors – Our success depends on the security and integrity of the games we offer, and security breaches or other disruptions could compromise our information or the information of our players and expose us to liability, which would cause our business and reputation to suffer."


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – If we sustain cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm and other negative consequences."


text: Cybersecurity Governance Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees management's design, implementation and enforcement of our cybersecurity risk management program.


text: Our Chief Information Security Officer periodically reports to the Board and leads the Company's overall cybersecurity function. The Audit Committee receives regular reports from our CISO on our cybersecurity risks, including briefings on our cyber risk management program and any cybersecurity incidents. Board members also receive periodic presentations on cybersecurity topics from our CISO or our Chief Technology Officer.


text: Our CISO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment.


text: Our CISO is responsible for assessing and managing our material risks from cybersecurity threats. Our CISO has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CISO has significant experience in managing and leading IT and cybersecurity teams. Prior to joining the Company, he served as the chief technology officer and cofounder of a company specializing in cybersecurity services and software. Our CISO reports directly to our CTO who has over twenty years of experience in technology and IT including roles at large global companies.


text: During the reporting period, we did not experience any cybersecurity incident that has materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – If we sustain cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm and other negative consequences."


text: Cybersecurity Risk Management and Strategy Cybersecurity risk management is a key component of our overarching risk management strategy. Given the susceptibility of our industry to cyber threats and attacks, we regularly encounter attempted attacks of varying types. Both the financial and personal data in our systems, coupled with the dynamic nature of our products and services, make us a potential target. We operate internationally with employees, contractors, vendors, developers, partners, and third parties, which complicates our risk exposures.

companyName: Hippo Holdings Inc.

ticker: HIPO


text: Our information security program encompasses policies and controls aimed at mitigating cybersecurity risks. However, we acknowledge the presence of both known and unknown risks, alongside vulnerabilities within our security program. Continuous improvement efforts are integral to enhancing our information security program and overall risk management endeavors.


text: We employ a risk management framework aligned with relevant laws, regulations, and industry standards to manage cybersecurity risks across our products and services, infrastructure, and organization. Our internal risk assessment processes incorporate various factors, including tracking threat intelligence and identified first- and third-party vulnerabilities, evaluating evolving regulatory requirements, and analyzing internally observed cybersecurity threats and incidents. We regularly conduct an internal risk assessment to evaluate the effectiveness of the security of our systems and of our processes, identify areas for remediation, and explore opportunities for enhancement, such as cloud and endpoint security enhancements, application programming interface (API) security, and contractor access management. We utilize third-party security experts and consultants on an annual basis to assess and improve our cybersecurity risk management tools and processes and to benchmark against industry standards.


text: Additionally, we maintain a privacy risk management program to evaluate risks associated with the collection, usage, sharing, and storage of customer data. An independent third-party assesses our privacy risk management program, to evaluate efficacy and to benchmark against industry standards.


text: On an annual basis we obtain an independent assessment and evaluation of the operation of our cybersecurity and privacy programs, as well as the supporting control frameworks. The findings of these independent assessments facilitate our risk-based decision-making, prioritization of cybersecurity countermeasures, and risk mitigation strategies. Our risk mitigation strategies encompass an array of technical and operational measures, complemented by annual cybersecurity and privacy training for all employees.


text: Additionally, we have specific policies and practices governing third-party security risks, including our third-party risk management (TPRM) program. Under this program, we gather information from relevant third parties to assess potential risks associated with their security controls.


text: Cybersecurity Governance Our board of directors oversees our strategic and business risk management, with cybersecurity risk management oversight delegated to the Audit, Risk, and Compliance Committee (the "Committee"). The Committee also oversees risks related to privacy and data use and monitors our compliance with our privacy program. Management is responsible for the ongoing identification, assessment, and management of material cybersecurity risks, along with the implementation of processes for monitoring potential cybersecurity risk exposures, deploying appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to the Committee and to the board of directors.


text: Tal Hornstein, our Chief Information Security Officer (CISO), leads our cybersecurity program and oversees teams supporting security functions across the company. Mr. Hornstein holds a CISSP certification from ISC2 and has over 20 years of experience in multiple cybersecurity and technology-related roles. He joined Hippo in late 2021 and has been instrumental in designing and executing our entire cybersecurity stack.


text: Our cybersecurity team monitors prevention, detection, mitigation, and remediation of cybersecurity incidents through technical and operational measures, regularly reporting to the CISO. As a key member of the senior management team, the CISO provides updates to the Committee on the company's cybersecurity program, including risks, incidents, and mitigation strategies.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report, we have not identified any cybersecurity threats materially affecting, or reasonably likely to materially affect, our business strategy, results of operations, or financial situation. However, despite our efforts, we recognize the impossibility of eliminating all cybersecurity risks or guaranteeing the absence of undetected cybersecurity incidents. For additional information about these risks, refer to Part I, Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: Our information security program encompasses policies and controls aimed at mitigating cybersecurity risks, including an incident response plan that includes procedures for assessing and responding to cybersecurity incidents. However, we acknowledge the presence of both known and unknown risks, alongside vulnerabilities within our security program. Continuous improvement efforts are integral to enhancing our information security program and overall risk management endeavors.


text: We employ a risk management framework aligned with relevant laws, regulations, and industry standards to manage cybersecurity risks across our products and services, infrastructure, and organization. Our internal risk assessment processes incorporate various factors, including tracking threat intelligence and identified first- and third-party vulnerabilities, evaluating evolving regulatory requirements, and analyzing internally observed cybersecurity threats and incidents. We regularly conduct an internal risk assessment to evaluate the effectiveness of the security of our systems and of our processes, identify areas for remediation, and explore opportunities for enhancement, such as cloud and endpoint security enhancements, application programming interface ("API") security, and contractor access management. We utilize third-party security experts and consultants on an annual basis to assess and improve our cybersecurity risk management tools and processes and to benchmark against industry standards.


text: Additionally, we have specific policies and practices governing third-party security risks, including our third-party risk management ("TPRM") program. Under this program, we gather information from relevant third parties to assess potential risks associated with their security controls.


text: Tal Hornstein, our Chief Information Officer and Chief Information Security Officer ("CISO"), leads our cybersecurity program and oversees teams supporting security functions across the company. Mr. Hornstein holds a CISSP certification from ISC2 and has over 20 years of experience in multiple cybersecurity and technology-related roles. He joined Hippo in late 2021 and has been instrumental in designing and executing our entire cybersecurity stack.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report, we have not identified any cybersecurity threats materially affecting, or reasonably likely to materially affect, our business strategy, results of operations, or financial situation. However, despite our efforts, we recognize the impossibility of eliminating all cybersecurity risks or guaranteeing the absence of undetected cybersecurity incidents that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information about these risks, refer to Part I, Item 1A, "Risk Factors," in this Annual Report on Form 10-K.