text: Cybersecurity Governance As detailed above, the CISO and the information security team regularly assess and manage cybersecurity risks. Voya's information security leadership team has extensive information technology and information security experience, and the full team comprises over 100 employees with over 150 certifications from leading information security certification organizations. The CISO, who oversees the organization supporting the day-to-day operations of our information security program, brings over 30 years of professional IT experience in financial services. Before assuming his current role, the CISO served as Voya's Chief Technology Officer, where he was responsible for our infrastructure, cloud, and business resiliency office. Additional management of cybersecurity risks is conducted by Voya's Technology and Operational Risk Committee ("TORC"), which has been delegated authority by Voya's Management Risk Committee to provide oversight of operational risk, including information and technology risk, as well as related legal, compliance and regulatory risks. Members of the TORC include senior management with relevant expertise in operations, technology, information security, legal, compliance, data privacy and operational risk management. The information security team participates in the TORC meetings to discuss cybersecurity risks and mitigation treatment. The TORC provides guidance and direction in assessing, addressing, mitigating and monitoring cybersecurity risks within Voya.


text: Voya's Board committees include the Risk Committee, which provides support to the Board in its oversight of information technology, including cybersecurity risk. To assist the Board in fulfilling its oversight function, the Risk Committee is responsible for overseeing cybersecurity risk and collaborates with the Audit Committee on the related disclosures. The Risk Committee receives regular updates from the CISO on cybersecurity-related matters and reports regularly to the full Board.

companyName: Voya Financial, Inc.

ticker: VOYA

secItem: Item 1C


text: Risk Management and Strategy We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Processes designed to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of the Company's overall risk assessment process. On a regular basis we implement into our operations these processes, technologies, and controls to assess, identify, and manage material risks. Specifically, we engage a third-party cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic penetration testing and tabletop exercises to inform our risk identification and assessment of material cybersecurity threats.

companyName: Independence Contract Drilling, Inc.


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: a. Monitor emerging data protection laws and implement changes as necessary; b. Conduct periodic customer data handling and use requirement training for our employees;


text: c. Utilize third-party systems and processes that continually monitor our systems to prevent, detect and remediate cyber security threats and events; d. Conduct annual cybersecurity management training for employees with access to our systems and processes that handle sensitive data;


text: e. Conduct regular phishing email simulations for employees; and f. Carry cybersecurity risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities that we and, as applicable, our third-party cybersecurity providers may take to prepare, respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: As part of the above processes, we have engaged with consultants to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: Our processes also include assessing cybersecurity threat risks associated with our use of third-party services providers in normal course of business use, including those in our supply chain or who have access to our customer and employee data or our systems. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.


text: We describe whether and how risks from identified cybersecurity threats have or are reasonably likely to materially affect our financial position, results of operations and cash flows, under the heading "Information technology failures and cybersecurity breaches could harm our business" included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risks. Periodically during each year, the Audit Committee receives an overview from our cybersecurity risk management team, comprised of our Chief Financial Officer, our Chief Accounting Officer and our Director of IT, of our cybersecurity threat risk management and strategy processes, including potential impact on the Company, the efforts of management to manage the risks that are identified and our disaster recovery preparations. Members of the Board of Directors engage in discussions with management on cybersecurity-related news events and discuss certain updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are led by our cybersecurity risk management team. Our Director of IT has over 30 years of experience in various roles involving managing information security, developing cybersecurity strategy, and implementing cybersecurity programs. The Director of IT is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity risk management and strategy processes, including our incident response plan.


text: Risk Management Strategy Our business is dependent upon our information technology ("IT") systems, devices and networks to collect, process and store the data necessary to conduct our business and record and report our business and financial information. We recognize the importance of developing, implementing, and maintaining effective cybersecurity measures to safeguard our IT systems and protect the confidentiality, integrity, and availability of our confidential and personal data, including with respect to our customers, suppliers, and employees, as well as our intellectual property. TECOGEN INC.

companyName: TECOGEN INC.

ticker: TGEN


text: We maintain a cybersecurity risk management program to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our cybersecurity risk management program incorporates various mechanisms to detect and monitor unusual network activity, as well as containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business and have processes to assess those issues for potential cybersecurity impact or risk.


text: We have integrated our cybersecurity risk management program into our broader enterprise risk management program. This integration is designed to make cybersecurity considerations an integral part of our decision-making processes at every level and we believe that this integration allows cybersecurity risks to be evaluated and addressed in alignment with our business objectives and operational needs. While we work to maintain our information security program and risk management efforts, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to our systems, networks, and data or those of our third-party providers.


text: We rely on suppliers that are also exposed to ransomware and other malicious attacks that can disrupt business operations. Although we take steps to secure confidential information that is provided to or accessible by third parties, such measures may not always be effective and losses or unauthorized access to, or releases of, confidential information occur. Such incidents and other malicious attacks could materially adversely affect our business, reputation, results of operations and financial condition.


text: We have experienced malicious attacks and other attempts to gain unauthorized access to our systems, including a ransomware attack on our computer network which occurred on April 28, 2023. Following remediation, our network returned to full operation on May 1, 2023.


text: We have engaged a third-party consultant in connection with our risk management and assessment processes. Our consultant assists us in the design and implementation of our cybersecurity policies and procedures, as well as the monitoring and testing of our safeguards. In the event of an incident, our incident response plan outlines the steps to be followed from incident detection to mitigation, recovery and notification, and involves notifying senior management, our legal department, and the board of directors and/or our audit committee, if appropriate, and mitigation and remediation steps by our third-party consultant.


text: Our board of directors has overall responsibility for informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure. Our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors has delegated to our audit committee its cybersecurity risk oversight processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our audit committee receives periodic reports from management regarding our cybersecurity risks and is notified of any significant cybersecurity threat or incident. The audit committee reports to the board of directors regarding its activities, including with respect to cybersecurity matters and the occurrence of any material cybersecurity incident, if appropriate.


text: We have engaged a third-party consultant to manage risks associated with network protection and workstation management. Our consultant performs an annual assessment of our cybersecurity risk policies and procedures.


text: Risk Management Strategy Our business is dependent upon our information technology ("IT") systems, devices and networks to collect, process and store the data necessary to conduct our business and record and report our business and financial information. We recognize the importance of developing, implementing, and maintaining effective cybersecurity measures to safeguard our IT systems and protect the confidentiality, integrity, and availability of our confidential and personal data, including with respect to our customers, suppliers, and employees, as well as our intellectual property.


text: We maintain a cybersecurity risk management program to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our cybersecurity risk management program incorporates various mechanisms to detect and monitor unusual network activity, as well as containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business and have processes to assess those issues for potential cybersecurity impact or risk. TECOGEN INC.


text: We have engaged a third-party consultant in connection with our risk management and assessment processes. Our consultant assists us in the design and implementation of our cybersecurity policies and procedures, as well as the monitoring and testing of our safeguards. In the event of a cybersecurity incident, our incident response plan outlines the steps to be followed from incident detection to mitigation, recovery and notification, and involves notifying senior management, our legal department, and the board of directors and/or our audit committee, if appropriate, and mitigation and remediation steps by our third-party consultant.


text: Our cybersecurity risk management and strategy processes are jointly led by our embedded software engineer and Chief Executive Officer, in conjunction with a third-party consultant we have engaged to assist with cybersecurity risks assessment and monitoring. Our embedded software engineer is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity risk management and strategy processes described above, including our incident response plan. Together with the General Counsel, Chief Executive Officer and outside consultant that comprise our cybersecurity management team, we collectively possess significant experience in evaluating, managing, and mitigating security and other risks, including cybersecurity risks. Our embedded software engineer possesses significant information systems experience.


text: We recognize the critical importance of maintaining the trust and confidence of customers, contractors, commercial partners, vendors, consultants and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: NexImmune, Inc.

ticker: NEXI


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our board of directors provides oversight of our cybersecurity risk management and strategy processes, which are led by our Vice President, Corporate Controller.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the NIST, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls; • conduct cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. As part of the above processes, we rely on internal resources rather than consultants, auditors or other third parties, to review our cybersecurity program.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our internal computer systems, or those used by our third-party research institution collaborators, CROs or other contractors or consultants, may fail or suffer security breaches," which disclosures are incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees.


text: Upon detection of a material cybersecurity threat, our board of directors receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our board of directors generally receives materials that include cybersecurity materials discussing current material cybersecurity threat risks, and describing our ability to mitigate those risks, and discusses such matters with our Chief Executive Officer. Our board of directors receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President, Corporate Controller and supported by consultants with experience in managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs as needed. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to our board of directors about material cybersecurity threat risks.


text: There continues to be a rise in electronic fraudulent activity, security breaches and cyber-attacks within the financial services industry, especially in the commercial banking sector where our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Although we are not aware that we have experienced any material misappropriation, loss or other unauthorized disclosure of confidential or personally identifiable information as a result of a cybersecurity breach or other act, we are regularly the target of attempted threats such as ransomware and denial-of-service attacks. In addition, our customers, vendors and other third-parties also face the same threats, and a cybersecurity incident impacting any of these parties could also impact our operations. For these reasons, cybersecurity is critical to supporting our business and protecting our customers.

companyName: HomeTrust Bancshares, Inc.

ticker: HTB


text: Our Chief Technology Officer is responsible for monitoring and coordinating the Company's Information Security Program, which is managed on a day-to-day basis by our Information Security Officer. This program has been designed to: • Ensure appropriate security of all information systems data, equipment and processes; • Ensure the security and confidentiality of nonpublic customer information; • Protect against any anticipated threats or hazards; and • Protect against unauthorized access to, or use of, such information.


text: Operationally, the information security team employs numerous security tools such as threat detection, alerting and monitoring, data loss prevention, vulnerability remediation, anti-malware and email security protections. Consistent with our Business Continuity and Security Incident Response Policies, the Company engages in annual disaster recovery and information security tabletop exercises to simulate threats and events, and engages third-parties on an annual basis to conduct and report on penetration testing exercises. We administer mandatory annual security awareness training, routine employee email phishing testing, and provide regular updates across the Company to highlight recent examples of risks as they are identified.


text: Our Board of Directors is responsible for overseeing the Company's cybersecurity strategies and setting the acceptable cybersecurity risk appetite as part of its oversight of the Company's risk management activities. The Board has designated the Executive and Risk Committee to oversee the Company's Enterprise Risk Management Program, which includes the framework for identifying, measuring, monitoring and controlling cybersecurity risk. Between updates provided by the Chief Technology Officer and Chief Risk Officer, who leads the Company's Enterprise Risk Management function, the Committee receives quarterly updates over assessed internal and external risks, cyber threats, industry trends in the cyber area, security operations and incident response, threat and vulnerability management activities, identity and access management controls, and the results of third-party audits and examinations. To ensure this focus is properly disseminated, the Enterprise Risk Management Program includes a Management Risk Committee, made up of executive officers, to ensure proper oversight of risk-related decision making and communication by executive management. In addition to internal monitoring procedures, the Company maintains a vendor risk management program that is designed to identify and manage risks, including cybersecurity risks, posed by our third-party vendors, particularly those with access to, or possession of, sensitive information. Vendor contract negotiations require the inclusion of data protection terms and responsibilities regarding information breach notifications and reporting. The program also includes due diligence and risk assessment procedures occurring prior to and during the life of these contractual relationships, to evaluate the vendor's management of data transmission, storage of information, encryption practices, vulnerability testing and general strength of the vendor's information security policy and practices. Additionally, the Company uses a continuous vendor monitoring solution to monitor third-party cyber risk, delivering risk-prioritized action plans customized to match the Company's risk appetite.


text: The Company's information security team has a defined escalation path for issues and events as outlined in our Security Incident Response Policy. Our Chief Technology Officer, along with teams from information security, IT infrastructure, IT support, and system analysts, will take the lead role in evaluating, escalating, investigating and remediating a potential cybersecurity event, including formulating the initial response and bringing in individuals from other departments as deemed appropriate. Any incident assessed as potentially being or becoming material is further escalated to the Operating Committee which includes all executive officers and may be elevated to the Board of Directors if the incident is deemed material or otherwise appropriate. Outside legal counsel and forensic analysts may also be engaged to assist in evaluating and remediating cybersecurity issues and events.


text: In spite of the Company's investments in systems and processes to address cyber risk, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material effect on the Company. For further discussion, see "Item 1A. Risk Factors – Risks Related to Cybersecurity, Data and Fraud."


text: Risk Management and Strategy Our cybersecurity risk management process is aligned with our enterprise risk management framework and policy. This allows us to assess, identify, and manage material risks arising from cybersecurity threats. As part of our integrated approach to risk management, and to help safeguard the confidentiality, integrity and availability of our data and systems, we maintain a comprehensive cybersecurity program that is comprised of administrative and technical controls, cybersecurity, technology and privacy policies and procedures, management oversight, accountability structures, and technology design processes (collectively, our "Cybersecurity Program").

companyName: Oportun Financial Corp

ticker: OPRT


text: We monitor our environment using tools designed to detect security events on an ongoing basis and we engage with third parties to audit our information security program and to perform regular penetration tests of our applications and infrastructure environments. In addition, our third-party risk management program oversees and identifies service provider risks through pre-onboarding security evaluations, ongoing monitoring, and conducting regular reassessments, with an emphasis on those service providers that have access to our systems or networks or that receive or store non-public information. Any risks identified by or to us through these activities are reported in an internal risk register and actively managed. We work to remain vigilant with respect to new and emerging risks utilizing these tools, and our security team continues to review and make strategic investments in our information security program in support of our efforts to keep our data and systems secure.


text: The Cybersecurity Program includes a cyber incident response plan that provides controls and procedures designed to enable swift response, remediation, and timely and accurate reporting of any material cybersecurity incident.


text: We also maintain an internally staffed cybersecurity operation center, which performs security monitoring and is directly responsible for our efforts to monitor, prevent, and detect cybersecurity incidents, as well as for appropriate and timely escalations concerning cybersecurity incidents that are discovered. Under our Cybersecurity Program, identified cybersecurity events and incidents are reported to our dedicated incident response team, which includes various members of our legal and compliance teams, cybersecurity team, relevant business teams, executive management, and, as warranted, our third-party security, audit, and consulting partners. Our program also retains an external third-party firm to activate as a supplement in the event of a significant security incident.


text: To promote organization-wide attention to cybersecurity issues, we conduct mandatory employee training on cybersecurity and provide ongoing cybersecurity education and awareness, such as mock phishing attacks, incident simulations, and cybersecurity awareness materials.


text: As delegated by our Board, the Audit and Risk Committee of the Board is responsible for oversight of our risk management process and framework which is designed to monitor and manage strategic and operational risks, including cybersecurity risk. Our senior management, including our Chief Information Security Officer (CISO), is responsible for oversight of our Cybersecurity Program, and maintains responsibility for the regular assessment and management of cybersecurity risks, including by direct work implementing the Cybersecurity Program and by supervising our cybersecurity team. Our Cybersecurity Program is further supported by our cybersecurity governance, risk and compliance team, which is led by our CISO, and is composed of experienced and skilled personnel who are responsible for our security assurance, risk and operational management. Our CISO has over 24 years of experience in cybersecurity, business leadership, investigations, compliance, and cyber-risk management, within the high-tech and financial services industries.


text: Our CISO provides the Audit and Risk Committee with no less than quarterly updates on the status of the Cybersecurity Program, information systems and any material security incidents, or more frequently if circumstances warrant, including on topics related to information security, data privacy and cyber risks and mitigation strategies.


text: Like most technology companies, we have suffered cybersecurity incidents in the past, and expect that we may face cybersecurity incidents in the future. As of the date of this report on Form 10-K, however, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For additional information about the cybersecurity risks that we face, please see the discussion in Item 1A. "Risk Factors" in this annual report on Form 10-K, including the risk factor entitled "Business, Financial and Operational Risks; Security breaches and incidents may harm our reputation, adversely affect our results of operations, and expose us to liability."


text: Risk Management and Strategy Our cybersecurity risk management process is aligned with our enterprise risk management framework and policy, which supports our efforts to identify, assess, and manage risks arising from cybersecurity threats. As part of our integrated approach to risk management, and to help safeguard the confidentiality, integrity and availability of our data and systems, we maintain a comprehensive cybersecurity program that is comprised of administrative and technical controls, cybersecurity, technology and privacy policies and procedures, management oversight, accountability structures, and technology design processes (collectively, our "Cybersecurity Program").


text: Our Cybersecurity Program includes a cyber incident response plan that provides controls and procedures designed to enable swift response, remediation, and timely and accurate reporting of any material cybersecurity incident.


text: As delegated by our Board, the Audit and Risk Committee of the Board is responsible for oversight of our risk management process and framework which is designed to monitor and manage strategic and operational risks, including cybersecurity risk. Our senior management, including our Chief Technology Officer, is responsible for the oversight of our information systems and Cybersecurity Program. Our Cybersecurity Program is supported by our cybersecurity governance, risk and compliance team, which is led by our Head of Cybersecurity, who reports to our Chief Technology Officer, and is composed of experienced and skilled personnel who are responsible for our security assurance, risk and operational management. Our Head of Cybersecurity maintains responsibility for the regular assessment and management of cybersecurity risks, including by direct work implementing the Cybersecurity Program and by supervising our cybersecurity team. Our Chief Technology Officer has over 20 years of experience in information technology and systems infrastructure and holds an advanced degree in computer engineering, and our Head of Cybersecurity has over 12 years of experience in cybersecurity, investigations, compliance, and cyber-risk management, within the high-tech and financial services industries.


text: Our Chief Technology Officer, Chief Legal Officer and Head of Cybersecurity provide the Audit and Risk Committee with no less than quarterly updates on the status of the Cybersecurity Program, information systems and any material security incidents, or more frequently if circumstances warrant, including on topics related to information security, data privacy and cyber risks and mitigation strategies.


text: Like most technology companies, we have suffered cybersecurity incidents in the past and expect that we may face cybersecurity incidents in the future. As of the date of this report on Form 10-K, however, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For additional information about the cybersecurity risks that we face, please see the discussion in Item 1A. "Risk Factors" in this annual report on Form 10-K, including the risk factor entitled "Business, Financial and Operational Risks; Security breaches and incidents may harm our reputation, adversely affect our results of operations, and expose us to liability."


text: Cybersecurity risk management is integrated into the Company's enterprise-wide risk management. Our Board has overall oversight responsibility for our risk management and management is responsible for identifying, considering, and assessing material risks to the Company.

companyName: NIOCORP DEVELOPMENTS LTD

ticker: NB


text: Our Chief Financial Officer is responsible for assessing and managing cybersecurity risks; however, as a smaller reporting company, we currently do not have a dedicated cybersecurity team. Our Chief Financial Officer reports to the Board regarding financial and operating risks, including cybersecurity risks. Our Chief Financial Officer has experience in managing public companies and assessing financial and operating risks.


text: cybersecurity risk management is designed to provide a framework for assessing, identifying, and managing material risks from cybersecurity threats and to respond to cybersecurity incidents, including material risks associated with the use of services provided by third-party service providers. We rely on the cybersecurity protections of many of our third-party service providers. Our primary third-party service providers utilize two-factor authentication as well as login and password protections with email verifications.


text: For the year ended June 30, 2024, the Company had no material cybersecurity incidents or cybersecurity threats that have materially affected or were reasonably likely to materially affect our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident.


text: presently do not have any substantial activities that require cybersecurity strategies; however the following will be adopted once we begin operations: recognize that cybersecurity risks pose a significant threat to the confidentiality, integrity and availability of our information systems, and to our ability to execute on our business strategy and protect stakeholder interests. Our approach to cybersecurity is anchored in formal policies, robust controls, ongoing risk assessment and clear governance structures.

companyName: ALEXANDER TECH CORP


text: sole director, who also serves as our Chief Executive Officer and Chief Financial Officer, has ultimate responsibility for cybersecurity oversight. This individual: Reviews our cybersecurity program and risk profile at least quarterly. Approves our cybersecurity policies, standards and incident response procedures; and Monitors management's implementation of recommended improvements.


text: cybersecurity program is designed to align with industry's best practices, including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). Key elements include: Regular risk assessments and vulnerability scans across our network and cloud environments. Formal policies covering access control, data protection, encryption, system configuration and change management. Tiered security controls (e.g., firewalls, endpoint protection, multi-factor authentication) to guard against unauthorized access.


text: Security awareness training for all personnel, with annual refreshers and real-time phishing simulations; and Third-party vendor assessments to ensure service providers meet our cybersecurity requirements. Response, Monitoring and Detection maintain a documented incident response plan detailing roles, responsibilities, communication protocols and escalation paths. We deployed continuous monitoring tools and log-management platforms to detect anomalous activity;


text: We conducted at least two tabletop exercises simulating a breach scenario and tested our response readiness; and We established notification procedures to comply with applicable laws and to inform affected stakeholders promptly in the event of an incident.


text: Risks and Outlook we have not experienced any material cybersecurity incidents during the fiscal year ended April 30, 2025, we acknowledge that evolving threats such as ransomware, social-engineering attacks and supply-chain vulnerabilities could materially disrupt our operations or expose sensitive information. We continue to: Invest in strengthening endpoint and network defenses;


text: Enhance logging, detection and response capabilities; and Revisit our risk assessments and incident response playbooks to address emerging threat vectors.


text: believe our cybersecurity governance, risk management processes and incident response program provide a strong foundation for managing risks, but no cybersecurity program can eliminate all risks entirely. We will continue to evolve our defenses in line with industry developments and regulatory expectations.


text: risk management is integrated into the Company's enterprise-wide risk management. Our Board has overall oversight responsibility for our risk management and management is responsible for identifying, considering, and assessing material risks to the Company.


text: cybersecurity risk management is designed to provide a framework for assessing, identifying, and managing material risks from cybersecurity threats and to respond to cybersecurity incidents, including material risks associated with the use of services provided by third-party service providers. We rely on the cybersecurity protections of many of our third-party service providers.


text: Our primary third-party service providers utilize two-factor authentication as well as login and password protections with email are in the process of evaluating our cybersecurity needs and developing appropriate measures to enhance our cybersecurity posture.


text: Our goal is to establish a cybersecurity framework that is commensurate with our size, complexity, and nature of our operations.


text: the year ended June 30, 2025, the Company had no material cybersecurity incidents or threats that have materially affected or were reasonably likely to materially affect our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident. As previously disclosed, on February 14, 2025, we became aware of unauthorized third-party access to our information systems, including portions of its email systems, that resulted in misdirected vendor payments. To date, the Cybersecurity Incident has not had a material impact on our business operations or financial condition.


text: Cybersecurity Risk Management Strategy We have implemented and invested in, and will continue to implement and invest in, controls, procedures and protections (including internal and external personnel) that are designed to protect our systems, identify and remediate on a regular basis vulnerabilities in our systems and related infrastructure and monitor and mitigate the risk of data loss and other cybersecurity threats. We have engaged third-party consultants to conduct penetration testing and risk assessments. Our cybersecurity program is informed by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and measured by the Maturity and Risk Assessment Ratings associated with the NIST Cybersecurity Framework and the Capability Maturity Model Integration.

companyName: Diamondback Energy, Inc.

ticker: FANG


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, train or otherwise assist with aspects of our security controls; • security tools deployed in the IT environment for protection against and monitoring for suspicious activity; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • cybersecurity tabletop exercises for members of our cybersecurity incident response team and legal department; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: Cybersecurity Governance Our cybersecurity governance program is led by the Vice President and Chief Information Officer, with support from the internal information technology department. The Vice President and Chief Information Officer has over 20 years of technological leadership experience in the oil and gas industry, providing oversight of all information technology disciplines, including cybersecurity, networking, infrastructure, applications, and data management and protection. The Vice President and Chief Information Officer and his team, which consists of individuals who hold designations as Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), CompTIASecurity+, and Department of Defense (DoD)-Cybersecurity General, are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. In addition, our cybersecurity incident response team is responsible for responding to cybersecurity incidents in accordance with our Computer Security Incident Response Plan. Progress and developments in our cybersecurity governance program are communicated to members of the executive team. The audit committee of the board of directors receives quarterly updates on the status of our cybersecurity governance program, including as related to new or developing initiatives and any security incidents that may occur. Board members receive presentations on cybersecurity topics from the Vice President and Chief Information Officer as part of the board's continuing education on topics that impact public companies. Further, our code of business conduct and ethics expects all employees to safeguard our electronic communications systems and related technologies from theft, fraud, unauthorized access, alteration or other damage and requires them to report any cyberattacks or incidents, improper access or theft to our Chief Legal and Administrative Officer and the Vice President and Chief Information Officer. Our cybersecurity governance program also includes processes to assess cybersecurity risks related to third-party vendors and suppliers.


text: Risks from cybersecurity threats have not materially affected, and are not currently anticipated to materially affect, our Company, including our business strategy, results of operations or financial condition. See, however, Item 1A. Risk Factors of this report for additional information regarding cybersecurity risks we face and their potential impact on our business strategy, results of operations and financial condition.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT and operational technology, or OT, environments; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, train or otherwise assist with aspects of our security controls; • security tools deployed in the IT and OT environments for protection against and monitoring for suspicious activity; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • cybersecurity tabletop exercises for members of our cybersecurity incident response team and legal department; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.


text: Cybersecurity Governance Our cybersecurity governance program is led by the Senior Vice President and Chief Information Officer, with support from the internal information technology department. The Senior Vice President and Chief Information Officer has over 20 years of technological leadership experience in the oil and gas industry, providing oversight of all information technology disciplines, including cybersecurity, networking, infrastructure, applications, and data management and protection. The Senior Vice President and Chief Information Officer and his team, which consists of individuals who hold designations as Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), CompTIASecurity+, and Department of Defense (DoD)-Cybersecurity General, are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. In addition, our cybersecurity incident response team is responsible for responding to cybersecurity incidents in accordance with our Computer Security Incident Response Plan. Progress and developments in our cybersecurity governance program are communicated to members of the executive team. Our management team takes steps to remain informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including third-party consultants engaged by us; and alerts and reports produced by security tools deployed in our IT and OT environments. While our board of directors is ultimately responsible for enterprise-wide risk oversight, the board's committees assist the board in fulfilling its oversight responsibilities in certain areas of risk. In particular, the board's audit committee is responsible, among other things, for risk management relating to legal and regulatory requirements, including cybersecurity, which plays an integral role in our risk management strategy and continues to be an area of increasing focus for our board, the audit committee and our management team.


text: The audit committee of the board of directors receives quarterly updates on the status of our cybersecurity governance program, including as related to new or developing initiatives and any security incidents that may occur. Board members receive presentations on cybersecurity topics from the Senior Vice President and Chief Information Officer as part of the board's continuing education on topics that impact public companies. Further, our code of business conduct and ethics expects all employees to safeguard our electronic communications systems and related technologies from theft, fraud, unauthorized access, alteration or other damage and requires them to report any cyberattacks or incidents, improper access or theft to our Chief Legal and Administrative Officer and the Senior Vice President and Chief Information Officer. Our cybersecurity governance program also includes processes to assess cybersecurity risks related to third-party service providers, suppliers and vendors. Our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments and conducting periodic reassessments during their engagement.


text: Risk Management and Strategy Our enterprise risk management program is designed to identify, measure, monitor and control significant risks across various aspects of the Company. Cybersecurity risk management processes are integrated into this program, given the increasing reliance on technology and potential of cyber threats. The cybersecurity risk management program contains eleven key elements: Information Security Policies, Strategic Planning, Risk Assessment, Audit and Examination, Business Continuity Planning, Incident Response Planning, Third-Party Due Diligence, Cyber Insurance Coverage, Employee Training and Testing, Patch and Vulnerability Management, and the Federal Financial Institutions Examination Council ("FFIEC") Cyber Assessment Tool ("CAT").

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: The Company is committed to protecting the information of clients, employees, and stakeholders from both conventional and cyber threats. This commitment is upheld through the implementation of our comprehensive Information Security Program ("ISP"), designed to ensure the confidentiality, integrity, and availability of critical information technology ("IT") systems and data.


text: The Information Security Governance Committee ("ISGC"), appointed by the Board, bears the responsibility for cybersecurity risk management and strategy. It aids the Board in fulfilling its oversight duties related to IT security, aligning with the Bank's business strategy, and adhering to regulatory requirements. The Virtual Chief Information Security Officer ("vCISO"), who is also appointed by the Board, oversees the ISP and coordinates the ISGC.


text: The ISGC's responsibilities encompass: • Review and approval of the ISP-related documents, including policies, strategies, plans and risk assessments; • Monitoring of control statuses and program gaps, including findings from audit reports and assessments; • Participation in program assessments, such as risk and business impact assessments; • Providing input on mitigation of current issues and threats; • Reporting, at least quarterly, to the Enterprise Risk Management Committee on ISGC activities and risk impacts on the Risk Appetite Statement. • Reporting, at least annually, to the Board on the status of the ISP, covering compliance, risk management, vendor management, audit and testing results, breaches and incidents, and recommended updates to the ISP.


text: The Company's approach to managing cybersecurity risks is shaped by insights from the FFIEC CAT, a tool designed for assessing and improving cybersecurity practices. This tool undergoes a thorough examination by an independent third-party on an annual basis to ensure an unbiased and comprehensive evaluation. In its most recent assessment in 2023, the FFIEC CAT identified that the Company is operating at an acceptable level of cyber maturity. This means the bank is effectively handling the inherent risks it faces in five critical areas: cyber risk management and oversight, collaboration on threat intelligence, implementation of cybersecurity controls, management of external dependencies, and resilience in handling cyber incidents.


text: To stay ahead of potential cybersecurity challenges, the Company has established a formal process. This process is activated whenever the FFIEC CAT or the ISGC identifies changes in inherent risks. In response, the Company proactively updates its cybersecurity objectives, policies, and tactical goals. This ensures that the Company's cybersecurity strategy remains responsive, continuously adapting to emerging threats and evolving industry standards.


text: Acknowledging the crucial role of third-party service providers, the Board-approved Vendor Management Policy, coupled with the ISP, guides the identification and management of risks posed by critical vendors. A third-party risk assessment, based on due diligence criteria and identified controls, is conducted regularly to assess inherent and residual risks. Contractual requirements ensure that providers maintain information security controls, providing reasonable assurance of data confidentiality, integrity, and availability. Third-party access is inventoried and monitored, with management reporting to the Board annually on the status and overall effectiveness of the Vendor Management Program.


text: Further, to enhance cybersecurity awareness, reduce vulnerability, and foster consideration of cybersecurity threats, our employees and the Board of Directors attend annual trainings. Specific role-based trainings are mandatory for certain employees, tailored to their duties.


text: In the ordinary course of business, we rely heavily on electronic communications and information systems to conduct our operations and to store sensitive data. We employ a layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. A variety of preventive and detective tools are used to monitor, block, and alert us to suspicious activity, including potential advanced persistent threats. Despite our defenses, the severity and sophistication of cyber-attacks are on the rise. Attackers adapt quickly to changes in defense measures. While we have not identified significant compromises, substantial data losses, or major financial setbacks from cybersecurity attacks so far, our systems, along with those of our clients and service providers, face constant threats. There is no guarantee that our cybersecurity risk management program will completely safeguard the confidentiality, integrity, and availability of our information systems and solutions. Cybersecurity risks are anticipated to stay elevated due to the evolving nature of threats and the increased use of online and mobile banking services. See "Risks Related to Cybersecurity, Data and Fraud" under "Item 1A. Risk Factors" in this Form 10-K for a further discussion of risks related to cybersecurity.


text: The Board of Directors is responsible for the development, implementation, and maintenance of the ISP. Specifically, the Board is oversees: • Continuous administration of the ISP; • Perform an annual review and approval of the ISP policies; • Assignment of critical roles, including the vCISO; and • Review of reports provided by the ISGC at least annually.


text: Adherence to the ISP is of utmost importance, and any exceptions to policy must be recommended by the ISGC, approved by the Enterprise Risk Management Committee, and reported to the Board at least annually.


text: As previously stated, the ISGC, appointed by the Board, bears the responsibility for cybersecurity risk management and strategy. The vCISO oversees the ISP and coordinate with the ISGC. The ISGC includes key personnel including the vCISO, Chief Operating Officer, Technology Services Director, Information Technology Manager, Internal Audit Manager, Compliance Manager, and Information Security Specialists. The ISGC members bring diverse qualifications, certifications, and extensive experience to the table. This collective expertise ensures a comprehensive and well-rounded approach to our information security initiatives.


text: Our vCISO has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management and is accountable for managing our enterprise information security department and developing and implementing our information security program. The responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, client, vendor and employee education and awareness, and business continuity and disaster recovery. The ISGC, as a whole, consists of information security professionals with varying degrees of professional education, certifications and experience. This blend of diverse qualifications, certifications, and experience within the ISGC ensures a comprehensive and flexible approach to information security, positioning the Company to address emerging threats and maintain a robust defense against potential risks.


text: Risk Management and Strategy Our enterprise risk management program is designed to identify, measure, monitor and control significant risks across various aspects of the Company. Cybersecurity risk management processes are integrated into this program, given the increasing reliance on technology and potential of cyber threats.


text: Our cybersecurity risk management program contains eleven key elements: Information Security Policies, Strategic Planning, Risk Assessment, Audit and Examination, Business Continuity Planning, Incident Response Planning, Third-Party Due Diligence, Cyber Insurance Coverage, Employee Training and Testing, Patch and Vulnerability Management, and the Federal Financial Institutions Examination Council ("FFIEC") Cyber Assessment Tool ("CAT").


text: The Information Security Steering Committee ("ISSC"), appointed by the Board, bears the responsibility for cybersecurity risk management and strategy. It aids the Board in fulfilling its oversight duties related to IT security, aligning with the Bank's business strategy, and adhering to regulatory requirements. The Virtual Chief Information Security Officer ("vCISO"), who is also appointed by the Board, oversees the ISP and coordinates the ISSC.


text: The ISSC's responsibilities encompass: • Review and approval of the ISP-related documents, including policies, strategies, plans and risk assessments; • Monitoring of control statuses and program gaps, including findings from audit reports and assessments; • Participation in program assessments, such as risk and business impact assessments; • Providing input on mitigation of current issues and threats; • Reporting, at least quarterly, to the Enterprise Risk Management Committee on ISSC activities and risk impacts on the Risk Appetite Statement. • Reporting, at least annually, to the Board on the status of the ISP, covering compliance, risk management, vendor management, audit and testing results, breaches and incidents, and recommended updates to the ISP.


text: The Company's approach to managing cybersecurity risks is shaped by insights from the FFIEC CAT, a tool designed for assessing and improving cybersecurity practices. This tool undergoes a thorough examination by an independent third-party on an annual basis to ensure an unbiased and comprehensive evaluation. In its most recent assessment in 2023, the FFIEC CAT identified that the Company is operating at an acceptable level of cyber maturity. This means the Company is effectively handling the inherent risks it faces in five critical areas: cyber risk management and oversight, collaboration on threat intelligence, implementation of cybersecurity controls, management of external dependencies, and resilience in handling cyber incidents.


text: To stay ahead of potential cybersecurity challenges, the Company has established a formal process. This process is activated whenever the FFIEC CAT or the ISSC identifies changes in inherent risks. In response, the Company proactively updates its cybersecurity objectives, policies, and tactical goals. This ensures that the Company's cybersecurity strategy remains responsive, continuously adapting to emerging threats and evolving industry standards.


text: The Board of Directors oversees cybersecurity risk management as part of its broader risk oversight responsibilities. The Board receives at least annual reports from the ISSC on cybersecurity risks, emerging threats, regulatory developments, and the effectiveness of our information security program. The Board also reviews and approves the ISP annually to ensure alignment with business strategy and regulatory requirements.


text: The ISSC, chaired by the vCISO, is responsible for implementing cybersecurity risk management policies and strategies. The vCISO, appointed by the Board, has extensive experience in information security, holding various professional certifications, including a Certified Information Systems Security Professional ("CISSP"). The ISSC also includes senior executives from risk, compliance, IT, and internal audit functions, ensuring a multidisciplinary approach to managing cybersecurity threats.


text: Adherence to the ISP is of utmost importance, and any exceptions to policy must be recommended by the ISSC, approved by the Enterprise Risk Management Committee, and reported to the Board at least annually.


text: The ISSC includes key personnel including the vCISO, Chief Operating Officer, Technology Services Director, Information Technology Manager, Internal Audit Manager, Compliance Manager, and Information Security Specialists. The ISSC members bring diverse qualifications, certifications, and extensive experience to the table. This collective expertise ensures a comprehensive and well-rounded approach to our information security initiatives.


text: Our vCISO has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management and is accountable for managing our enterprise information security department and developing and implementing our information security program. The responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, client, vendor and employee education and awareness, and business continuity and disaster recovery.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity policies and procedures, which are integrated into the Company's overall risk management framework. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: Empire State Realty Trust, Inc.

ticker: ESRT


text: We partner with third parties to implement and assess the effectiveness of our cybersecurity prevention and response systems and processes. We have a Managed Service Provider (MSP) and Managed Security Services Provider (MSSP) that provide 24 x 7 x 365 Network Operations Center and Security Operations Center (SOC) and works with our information technology (IT) team to employ a variety of monitoring technologies to detect and be alerted to potential cyber threats, as well as establish and implement procedures for the mitigation and remediation of any cybersecurity incidents. We conduct an annual penetration test, regular phishing tests, and annual cybersecurity training for our employees.


text: Additionally, the management team of the Company has developed a cyber incident response plan to deploy in the event of a cyber threat. This plan is reviewed and updated at least annually and tested from time to time through tabletop exercises involving management and other key personnel, and may also include participation from the Board and outside experts. As part of regular business continuity planning, department heads are required to consider key technology systems used by their respective teams and the impact to the Company and other stakeholders in the event that such systems become compromised or unavailable. Additionally, we monitor and identify cybersecurity risks posed by third-party vendors who provide software and/or hardware to the Company or otherwise have access to our Company systems and have a cyber review process that is part of vendor onboarding.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Refer to the risk factor captioned "Cyberattacks and any failure to comply with related laws could negatively impact us." in Part I, ITEM 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: Our Board of Directors oversees our risk management process, including with respect to cybersecurity risks, directly and through its committees. The Audit Committee of our Board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports on our enterprise risk profile on a quarterly basis. Our Chief Technology Officer (CTO) is responsible for leading the assessment and management of cybersecurity risks, oversees teams across the Company supporting our cybersecurity policies and procedures around prevention, detection, mitigation and remediation of cybersecurity incidents, and reports at least quarterly to the Audit Committee on cybersecurity strategy and risks. Our CTO has over 25 years of experience in cybersecurity and information technology, is the Chair of the Real Estate Board of Cyber Committee, a Board Member of the Real Estate Cyber Consortium and is a Board Member of the Global Cyber Consortium.


text: As an externally managed company, our day-to-day operations are managed by our advisor and our executive officers under the oversight of our board of directors. Our executive officers are senior professionals of our advisor, our advisor is a subsidiary of DWS, and DWS is majority owned by Deutsche Bank. Deutsche Bank and its affiliates are collectively referred as Deutsche Bank Group. DWS aligns its information security management system to the latest information security policies defined by Deutsche Bank. The DWS Information Security Framework is managed under Deutsche Bank's framework. As such, we are reliant on Deutsche Bank Group for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details of the cybersecurity program applicable to Deutsche Bank Group.

companyName: RREEF Property Trust, Inc.


text: Cybersecurity governance Responsibility for cybersecurity matters sits within the Chief Security Office, where it forms the first Line of Defense within Deutsche Bank's Three Lines of Defense model. The Chief Security Officer has delegated authority from the Deutsche Bank Management Board ("Management Board") and reports directly to the Chief Technology, Data, and Innovation Officer, who is a member of the Management Board.


text: Deutsche Bank's Chief Security Officer has served in various roles in information security for more than 20 years. This includes the role as global Chief Information Security Officer ("CISO") / Chief Security Officer ("CSO") for three different large European financial institutions and a partner position in a global strategy and consulting firm, leading security work for financial service clients. The Chief Security Officer is supported by information security role holders at various seniority levels to help ensure that security requirements are met from a regional, divisional, and technical perspective.


text: The Chief Security Office develops Deutsche Bank Group's security strategy and oversees its implementation and operationalization globally via the organizational set-up, governance, and implemented security policies. The security strategy is reviewed continually to address changes in the threat landscape, technology, the regulatory environment, the overall corporate and IT strategy, and other internal and external parameters.


text: The Chief Security Office maintains a comprehensive metrics and reporting framework, underpinned by an extensive data set allowing for global, regional, and divisional views. Security metrics and reporting provided to Deutsche Bank Group s governance forums at all seniority levels support appropriate security risk awareness and decision taking. The Management Board receives a comprehensive quarterly information security risk posture report, as well as ad hoc information if required. Furthermore, the Chief Security Officer provides regular updates on material topics relating to security to the Supervisory Board's Committee responsible for technology, data and innovation.


text: Information security risk is managed as an operational risk under the non-financial risk management framework of Deutsche Bank Group. The Chief Security Office, in its responsibility as the first line of defense, executes against the non-financial risk management framework and leverages its various instruments whereas the non-financial risk management as the second line of defense provides oversight, review, and challenge. Accordingly, part of the non-financial risk committee's remit is to oversee and govern Deutsche Bank Group's cybersecurity risk profile, remediation programs and risk tolerance. Should a cybersecurity incident occur, Deutsche Bank Group has an established protocol for communicating such incident to the divisions of Deutsche Bank Group that may be impacted, including chief security officers and division heads. Those personnel in turn will notify potentially affected groups further downstream as applicable, including down to us if any our or our stockholders' information may be at risk.


text: Deutsche Bank Group's security policy framework defines the core principles of security risk management and the fundamentals for security management. The complete framework is reviewed annually. The framework is governed centrally and applied globally across all product groups and business and infrastructure divisions. The framework includes a clear description of the risk tolerance related to information security. It also sets out the roles, responsibilities and accountabilities of key personnel identified to manage information security risk; the strategy and measures to cope with information security breaches, and related communication procedure.


text: Additionally, Deutsche Bank Group's Information Security Management System has been certified according to ISO 27001 for all information security domains defined in that standard since 2012. To maintain the ISO 27001 certification, Deutsche Bank Group performs a full recertification process every three years, with the latest taking place in 2021. In the years a full certification process does not take place, the Deutsche Bank Group performs a certification-follow-up, designed to ensure compliance between certification intervals. The latest certification follow-up was in 2023. The next full recertification will take place in September 2024.


text: Deutsche Bank Group employs a variety of mechanisms to self-identify areas for improvements and control enhancements. These include security testing, security problem management and lessons learned. The effectiveness of Deutsche Bank Group s overall information security program is evaluated on a regular basis by third-party organizations that compare Deutsche Bank Group's approach with industry benchmarks. Deutsche Bank Group s independent internal audit function frequently includes the assessment of security controls in its audit plan.


text: Identifying, assessing and managing cybersecurity threats We and Deutsche Bank Group operate in an environment with increasing levels of digitization and a continually evolving landscape related to cybersecurity threats. Due to the dynamics and complexity of the current environment, the Deutsche Bank Group is continuously monitoring the security threat landscape. Deutsche Bank Group vigilantly observes technological developments, the geopolitical landscape and economic impacts driving security risks and assesses their relevance for potential impacts to Deutsche Bank Group and the wider financial ecosystem.


text: Deutsche Bank Group has a variety of prevention methods and controls in place, such as threat intelligence, data leakage prevention, cyber hygiene, and encryption solutions. These also include placing a strong emphasis on detection, backed by a robust incident-response process. Deutsche Bank Group actively shares best practices and threat information with national and international security organizations, government authorities, and peer organizations. These relationships help to ensure that Deutsche Bank Group's security technology and procedures reflect current industry best practices and keep pace with the threat environment.


text: Deutsche Bank Group's security incident management covers cybersecurity events that may affect it and its subsidiaries, its clients, business partners, or employees. The related management and reporting processes performed with the involvement of compliance, legal and data privacy are designed to enable a quick and effective response to cyberattacks and information security threats. Further, if DWS is notified of an incident, then a communication protocol will be followed to notify affected or potentially affected parties internal and external to DWS, including notification to us if our data or our stockholders data is at risk.


text: The audit committee of our board of directors is responsible for overseeing the implementation of the cybersecurity policies and procedures applicable to us, and related reporting. This includes quarterly reporting to our audit committee as well as ad hoc incident reporting whereby if we are notified of an incident, whether reported to us by Deutsche Bank Group or any of our third-party vendors, we will assess it and advise the audit committee of our board of directors depending on the severity of the incident. The audit committee can, in its discretion and at our expense, retain special legal or other consultants to advise the audit committee or to assist in the conduct of any investigation, subject to our board of directors determination to allocate assets to pay for such investigation.


text: To address evolving security threats, Deutsche Bank Group continually reviews and enhances its information security controls into every layer of technology, including identity and access management, data, infrastructure, devices, and applications. This is complemented by organizational controls and security training and awareness. The purpose of this layered approach is to provide end-to-end protection, as well as multiple opportunities to detect, prevent, respond to, and recover from cyberthreats.


text: Security risks are assessed on a regular basis, at least annually, taking internal as well as external risk drivers and events dynamically into account. A thorough analysis of the external threat landscape, which leverages industry standard threat assessment frameworks, provides a foundation for the assessment of financial industry relevant risk scenarios. These are evaluated against Deutsche Bank Group's capabilities to cope with these risks. In case of emerging developments, additional risk reviews are conducted.


text: Reliance on third parties' products and services that support critical operations can affect the risk posture, because these can be the target of new and evolving cybersecurity attacks. This risk, along with expanded regulatory requirements, has necessitated an increased use of technology to better identify information security risks across third parties and where necessary, pro-actively perform outreach with them. Deutsche Bank Group has a third-party risk management process designed to identify, monitor, and mitigate risks arising from working with third parties, which includes oversight of third parties' operations related to the services provided. In addition, where appropriate, Deutsche Bank Group will seek to include in its contractual arrangements with certain third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices.


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Deutsche Bank Group in managing these risks, see "Part 1. Item 1A. Risk Factors – General Risk Factors – Cybersecurity risks and data protection could result in the loss of data, interruptions in our business, damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations" in this Annual Report on Form 10-K.


text: As an externally managed company, our day-to-day operations are managed by our advisor and our executive officers under the oversight of our board of directors. Our executive officers are senior professionals of our advisor, our advisor is a subsidiary of DWS, and DWS is majority owned by Deutsche Bank. Deutsche Bank and its affiliates are collectively referred as Deutsche Bank Group. DWS aligns its information security management system to the latest information security policies defined by Deutsche Bank. The DWS Information Security Framework is managed under Deutsche Bank's framework. As such, we are reliant on Deutsche Bank Group for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details of the cybersecurity program applicable to Deutsche Bank Group.


text: Cybersecurity governance Responsibility for cybersecurity matters sits within the Chief Security Office, where it forms the first Line of Defense within Deutsche Bank's Three Lines of Defense model. The Chief Security Officer ("CSO") has delegated authority from the Deutsche Bank Management Board ("Management Board") and reports directly to the Chief Technology, Data, and Innovation Officer, who is a member of the Management Board. The Management Board is accountable for the implementation of the information security framework, with oversight from the Deutsche Bank Supervisory Board. There are multiple mechanisms in place for the CSO to escalate security issues directly to the Management Board if required.


text: Deutsche Bank's Chief Security Officer has served in various roles in information security for more than 20 years. This includes the role as global Chief Information Security Officer ("CISO") / CSO for three different large European financial institutions and a partner position in a global strategy and consulting firm, leading security work for financial service clients. The Chief Security Officer is supported by information security role holders at various seniority levels to help ensure that security requirements are met from a regional, divisional, and technical perspective.


text: The Chief Security Office develops Deutsche Bank Group's security strategy and oversees its implementation and operationalization globally via the organizational set-up, governance, and implemented security policies. The security strategy, which is reviewed on a regular basis, incorporates developments in the threat landscape, technology, the regulatory environment, the overall corporate and IT strategy, and other internal and external parameters.


text: The Chief Security Office maintains a comprehensive metrics and reporting framework, underpinned by an extensive data set allowing for global, regional, and divisional views. Security metrics and reporting provided to Deutsche Bank Group s governance forums at all seniority levels support appropriate security risk awareness and decision taking. The Management Board receives a comprehensive quarterly information security risk posture report, as well as ad hoc information if required. Furthermore, the Chief Security Officer provides regular updates on material topics relating to security to the Supervisory Board's Committee responsible for technology, data and innovation.


text: Information security risk is managed as an operational risk under the non-financial risk management framework of Deutsche Bank Group. The Chief Security Office, in its responsibility as the first line of defense, executes against the non-financial risk management framework and leverages its various instruments whereas the non-financial risk management as the second line of defense provides oversight, review, and challenge. Accordingly, part of the non-financial risk committee's remit is to oversee and govern Deutsche Bank Group's cybersecurity risk profile, remediation programs and risk tolerance. Should a cybersecurity incident occur, Deutsche Bank Group has an established protocol for communicating such incident to the divisions of Deutsche Bank Group that may be impacted, including chief security officers and division heads. Those personnel in turn will notify potentially affected groups further downstream as applicable, including down to us if any our or our stockholders' information may be at risk.


text: Deutsche Bank Group's security policy framework defines the core principles of security risk management and the fundamentals for security management. The complete framework is reviewed annually. The framework is governed centrally and applied globally across all product groups and business and infrastructure divisions. The framework includes a clear description of the risk tolerance related to information security. It also sets out the roles, responsibilities and accountabilities of key personnel identified to manage information security risk; the strategy and measures to cope with information security breaches, and related communication procedure.


text: Additionally, Deutsche Bank Group's Information Security Management System has been certified according to ISO 27001 for all information security domains defined in that standard since 2012. To maintain the ISO 27001 certification, Deutsche Bank Group performs a full recertification process every three years, with the latest taking place in 2024. With the last recertification, Deutsche Bank upgraded its Information Security Management System to the 2022 version of ISO 27001. Furthermore, the Deutsche Bank Group performs an annual surveillance audit designed to ensure compliance between certification intervals.


text: Deutsche Bank Group employs a variety of mechanisms to self-identify areas for improvements and control enhancements. These include security testing, security problem management and lessons learned. The effectiveness of Deutsche Bank Group s overall information security program is evaluated on a regular basis by third-party organizations that compare Deutsche Bank Group's approach with industry benchmarks. Deutsche Bank Group s independent internal audit function is mandated to regularly assess security controls as part of its audit plan.


text: Identifying, assessing and managing cybersecurity threats We and Deutsche Bank Group operate in an environment with increasing levels of digitization and a constantly evolving landscape related to cybersecurity threats. Due to the dynamics and complexity of the current environment, the Deutsche Bank Group is continuously monitoring the security threat landscape. Deutsche Bank Group vigilantly observes technological developments, the geopolitical landscape and economic impacts driving security risks and assesses their relevance for potential impacts to Deutsche Bank Group and the wider financial ecosystem.


text: Deutsche Bank Group has a variety of prevention methods and controls in place, such as threat intelligence, network security, identity and access management, data leakage prevention, cyber hygiene, and encryption solutions. These also include placing a strong emphasis on detection, backed by a robust incident-response process. Deutsche Bank Group actively shares best practices and threat information with national and international security organizations, government authorities, and peer organizations. These relationships help to ensure that Deutsche Bank Group's security technology and procedures reflect current industry best practices and keep pace with the threat environment.


text: Deutsche Bank Group's security incident management covers cybersecurity events that may affect it and its subsidiaries, its clients, business partners, or employees. The related management and reporting processes performed with the involvement of compliance, legal and data privacy are designed to enable a quick and effective response to cyberattacks and information security threats. Further, if DWS is notified of an incident, then a communication protocol will be followed to notify affected or potentially affected parties internal and external to DWS, including notification to us if our data or our stockholders data is at risk.


text: The audit committee of our board of directors is responsible for overseeing the implementation of the cybersecurity policies and procedures applicable to us, and related reporting. This includes quarterly reporting to our audit committee as well as ad hoc incident reporting whereby if we are notified of an incident, whether reported to us by Deutsche Bank Group or any of our third-party vendors, we will assess it and advise the audit committee of our board of directors depending on the severity of the incident. The audit committee can, in its discretion and at our expense, retain special legal or other consultants to advise the audit committee or to assist in the conduct of any investigation, subject to our board of directors determination to allocate assets to pay for such investigation.


text: To address evolving security threats, Deutsche Bank Group continually reviews and enhances its information security controls into every layer of technology, including databases, infrastructure, devices, and applications. This is complemented by organizational controls and security training and awareness. The purpose of this layered approach is to strengthen end-to-end protection by utilizing multiple opportunities to detect, prevent, respond to, and recover from cyberthreats.


text: Security risks are assessed on a regular basis, at least annually, taking internal as well as external risk drivers and events dynamically into account. A thorough analysis of the external threat landscape, which leverages industry standard threat assessment frameworks, provides a foundation for the assessment of financial industry relevant risk scenarios. These are evaluated against Deutsche Bank Group's capabilities to cope with these risks. In case of emerging developments, additional risk reviews are conducted.


text: Reliance on third parties' products and services that support critical operations can affect the risk posture, because these can be the target of new and evolving cybersecurity attacks. This risk, along with expanded regulatory requirements, has necessitated an increased use of technology to better identify information security risks across third parties and where necessary, pro-actively perform outreach with them. Deutsche Bank Group has a third-party risk management process designed to identify, monitor, and mitigate risks arising from working with third parties, which includes oversight of third parties' operations related to the services provided. In addition, where appropriate, Deutsche Bank Group will seek to include in its contractual arrangements with certain third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices.


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Deutsche Bank Group in managing these risks, see "Part 1. Item 1A. Risk Factors – General Risk Factors – Cybersecurity risks and data protection could result in the loss of data, interruptions in our business, damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations" in this Annual Report on Form 10-K.


text: Safeguarding our critical networks and the information that platform users share with us is vital to our business. One key way that Uber addresses this need is through its cybersecurity risk management program ("Cybersecurity Program").

companyName: Uber Technologies, Inc

ticker: UBER


text: Uber's Chief Information Security Officer ("CISO") is responsible for the Cybersecurity Program, which is coordinated and primarily executed by the global organization of engineers focused on risk management using the NIST Framework (Identify, Protect, Detect, Respond, and Recover) and activities such as automation, secure development, and advanced analytics and monitoring. The CISO has served in such role since February 2021 and has more than 20+ years of engineering and/or cybersecurity experience, including previously as CISO and Deputy Chief Technology Officer at a Fortune 500 company.


text: The Cybersecurity Program is also supported by Uber's Chief Privacy Officer and Associate General Counsel, Privacy & Cybersecurity ("CPO"), who has served in that role since August 2018. The CPO has three decades of experience as a legal advisor to multinational corporations, including serving as Chief Privacy & Security Counsel for a Fortune 100 technology company prior to her role at Uber.


text: The Cybersecurity Program is supported by other members of Uber's senior management team as well, including the Chief Legal Officer, Head of Platform Engineering, and EU Data Protection Officer. Uber's Board of Directors oversees the Cybersecurity Program through regular updates.


text: This Cybersecurity Program is a critical component of Uber's enterprise risk management program, through which Uber reviews business, cybersecurity, information technology, privacy, legal, and geopolitical risks, among others. The Cybersecurity Program is designed to assess, identify, and manage risks from cybersecurity threats.


text: Key elements of this program include: • Oversight and Governance. Uber's Board oversees the Cybersecurity Program, and Uber's risk profile with respect to cybersecurity matters, through regular reports and reviews. These include presentations by the CISO to the Board and Audit Committee on an alternating quarterly basis, quarterly reports of certain cybersecurity incidents to the Board, and annual reports by the CPO to the Board.


text: The CISO also provides quarterly updates to Uber's senior management regarding cybersecurity risks, as well as interim updates during regular meetings with Uber's engineering, product and internal audit leadership. The CISO and CPO also jointly chair Uber's Privacy and Cybersecurity Council, which provides a venue for cross-functional insight and input into the Cybersecurity Program and our privacy program as they relate to Uber's business operations.


text: • Internally conducted environment and vulnerability assessments. These include semi-annual assessments performed by Uber's security engineering teams. The findings from these assessments are reported to Uber's senior management, including the CISO, and the Board or Audit Committee. In addition, our internal audit function periodically conducts additional reviews and assessments, which are reported to the Audit Committee. • Independent third-party audits and assessments by industry-leading firms. These include regular assessments of Uber's information systems, business systems and cybersecurity infrastructure; reviews to identify opportunities to strengthen Uber's cybersecurity posture; and cybersecurity audits for purposes of maintaining Uber's Payment Cards Industry (PCI), ISO 27001 and 27002, and SOC1 and SOC2 certifications. • Cyber incident management. This includes efforts by Uber's security engineering team, at the direction of the CISO, to review potential incidents identified by Uber's internal teams, Uber's third-party service providers or external researchers through Uber's Bug Bounty program; identify those which represent potential or actual threats to Uber's systems, data or users; investigate and mitigate the cause and impact of such incidents; and implement safeguards to help prevent recurrence. Uber's CPO and legal team support such efforts, including in connection with legal or disclosure obligations triggered in connection with any such incidents. • Third Party Risk Management. Uber performs due diligence regarding its third-party suppliers, service providers and business partners. This includes requiring submission of evidence demonstrating third parties' ability to meet Uber's cybersecurity and data handling requirements. In addition, Uber's third-party suppliers and service providers who process Uber personal data are contractually obligated to notify Uber if they experience certain incidents impacting Uber personal data.


text: For a discussion regarding risks from cybersecurity threats, see our risk factors, including the risk factors titled "—We have experienced, and may experience security or privacy breaches or other unauthorized or improper access to, use of, disclosure of, alteration of or destruction of our proprietary or confidential data, employee data, or platform user data, which could cause loss of revenue, harm to our brand, business disruption, and significant liabilities", "—Cyberattacks, including computer malware, ransomware, viruses, denial of service attacks, spamming, phishing and social engineering attacks could harm our reputation, business, and operating results", "—We currently are subject to a number of inquiries, investigations, and requests for information from the DOJ, other federal, state and local government agencies and other foreign government agencies, the adverse outcomes of which could harm our business" and "—We face risks related to our collection, use, transfer, disclosure, and other processing of data, which could result in investigations, inquiries, litigation, fines, legislative and regulatory action, and negative press about our privacy and data protection practices" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Safeguarding our critical networks and the information that platform users share with us is vital to our business. One key way that Uber addresses this need is through its cybersecurity program, which includes a cybersecurity risk management program.


text: Uber's Chief Information Security Officer ("CISO") is responsible for the cybersecurity program, which is coordinated and primarily executed by the global organization of engineers focused on risk management using the NIST Framework (Govern, Identify, Protect, Detect, Respond, and Recover) and activities such as automation, secure development, and advanced analytics and monitoring. The CISO has served in such role since February 2021 and has more than 20+ years of engineering and/or cybersecurity experience, including previously as CISO and Deputy Chief Technology Officer at a Fortune 500 company.