text: Upon a notification of concerning factors which may be indicative that a notable cybersecurity incident has occurred, the Cyber Security Subcommittee (Cyber Security Subcommittee) consisting of the Chief Legal Officer, Chief People Officer & SVP of IT, Associate General Counsel, Head of Information Technology, and a member of the Financial Reporting team, meets to make an initial assessment. If the Cyber Security Subcommittee determines there is a reasonable likelihood a notable cybersecurity incident has occurred, then notice will promptly be given to certain members of the Company Executive Team including our President/Chief Executive Officer, Chief Financial Officer, Chief Legal Officer & Corporate Secretary, and Chief People Officer/SVP of IT.


text: Our team leverages over 25 years of experience in various IT leadership roles, including oversight of cyber security functions. Our SVP of IT, and her team, is responsible for the day-to-day management of the cybersecurity program.

companyName: EyePoint, Inc.

ticker: EYPT

secItem: Item 1C


text: The SVP of IT provides periodic briefings for our senior management team on cybersecurity matters, including the prevention, detection, mitigation, and remediation of cybersecurity incidents and cybersecurity threats.


text: While the Board of Directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, discussing with management, and overseeing the Company's cybersecurity and privacy risk exposures and policies. On a quarterly basis, the SVP of IT reports to the Audit Committee on information technology and cybersecurity matters, including key information technology risks. The SVP of IT also apprises the Audit Committee and full Board of Cyber Security Incidents consistent with our incident response program, promptly.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management ("ERM") process. As part of our ERM process, department leaders identify, assess, and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. Department leaders are asked to consider the severity and likelihood of certain risk factors, drawing upon their company knowledge and past business experience. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors." As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect.


text: In 2024, we were a SPAC with no business operations other than that following our Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. We assess and identify the possibility of risk from cybersecurity threats considering both our operations and the nature of our assets, which consist solely of the funds in our Trust account managed by a third-party Trustee and the funds in our operating bank account. To date, we have not experienced any cybersecurity attacks. In light of the nature of our operations in identifying and evaluating suitable acquisition transaction candidates, we believe that cybersecurity threats are not reasonably likely to materially affect these business operations. In addition, the procedures in place with third parties that maintain our assets are such that it also should not be reasonably likely for cybersecurity threats to materially affect our financial condition. But we recognize that a penetration of our systems or a third party's systems could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations.

companyName: GigCapital7 Corp.

ticker: GIG


text: We have not adopted any specific cybersecurity risk management program or formal processes for managing risks from cybersecurity threats. However, in our overall risk management processes, we employ various procedures designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats given our limited operations and assets. These include, but are not limited to, engaging a third-party information technology consultant who maintains and monitors our information technology network, internal reporting, monitoring and detection tools and anti-virus software. We also periodically assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities, including those that could arise from internal sources and external sources such as third-party service providers we do business with.


text: Our management is generally responsible for assessing and managing risks from any cybersecurity threats, including through the use of the third-party information technology consultant who reports to our management on actions that he is undertaking and the cybersecurity threats that he sees to our information technology network. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to the Audit Committee of our Board of Directors (which is the committee of the Board of Directors to which oversight of cybersecurity matters and management of cybersecurity incidents has been delegated by the Board of Directors) for further actions, including regarding the appropriate disclosure, mitigation, or other response or actions that the Audit Committee or the Board of Directors deems appropriate to take. In addition, our management reports to the Audit Committee on a regular basis on the potential for risks from cybersecurity threats.


text: The Company's cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats. The Company relies on the Investment Advisor to implement the cybersecurity program. The cyber risk management program involves risk assessments relating to the information systems of the Investment Advisor, incident response training and testing, implementation of security measures, and ongoing monitoring of systems and networks and assessment of the associated risks on an annual basis, including networks on which the Company relies on. The Investment Advisor actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. The Investment Advisor has engaged external experts, including consultants, to evaluate cybersecurity measures and risk management processes. The Company depends on and engages various third parties, including suppliers, vendors, and service providers. The compliance team of the Company and the Investment Advisor will conduct onboarding and ongoing due diligence of each third-party engaged by them, including identify and oversee risks from cybersecurity threats associated with their use of such entities.

companyName: FIDUS INVESTMENT Corp

ticker: FDUS


text: Board Oversight of Cybersecurity Risks The Board has the primary responsibility for overseeing and reviewing the guidelines and policies with respect to the Company's risk management, including risks associated with cybersecurity threats. Certain members of the Company's management will periodically report to the Board, on at least a quarterly basis, on cybersecurity matters, such as the overall state of the Company's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and material cybersecurity incidents.


text: Management's Role in Cybersecurity Risk Management The Company's management is responsible for assessing and managing material risks from cybersecurity threats, in consultations with cybersecurity consultants engaged by the Investment Advisor. The Company's management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, and/or information technology.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes has materially affected, or are reasonably likely to materially affect, the Company, including the Company's business strategy, operational results, and financial condition.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, as well as secure our networks, systems and data. Such processes include physical, procedural, and technical safeguards, employee training and incident simulations. We have the capacity to engage certain external parties, such as consultants, independent privacy assessors, computer security firms and risk management, peer companies, industry groups and governance experts, to enhance our cybersecurity oversight. We also consider the internal risk oversight programs of third-party service providers before engaging them to help protect us from any related vulnerabilities.

companyName: Solid Biosciences Inc.

ticker: SLDB


text: To help manage our material risks from cybersecurity threats and to help protect against, detect, and prepare to respond to cybersecurity incidents, we conduct periodic training for employees involved in our systems and processes that handle sensitive data. We also conduct on-boarding cybersecurity awareness assessments, cybersecurity training for all employees, and regular phishing email simulations for all employees. In addition, we use technology-based tools to help mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: The Audit Committee of our Board of Directors provides oversight of our cybersecurity risk and provides regular updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our Senior Director of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help us prepare our employees to address cybersecurity risks. Our Senior Director of Information Technology has over seventeen years of experience in information technology, eleven years of experience in information technology for life sciences companies, and a relevant bachelor's degree in information technology. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Cybersecurity Risk Management and Strategy. We recognize the critical role that cybersecurity plays in protecting our operations, customers, and digital assets. As part of our broader technology and information security risk management framework, our cybersecurity strategy is designed to safeguard the confidentiality, integrity and availability of our systems and data. We continuously assess, strengthen and refine our cybersecurity practices to adapt to an evolving threat landscape.

companyName: ENTRAVISION COMMUNICATIONS CORP

ticker: EVC


text: Our cybersecurity risk management program is built on a foundation of monitoring, proactive risk mitigation and adherence to industry best practices. Over the past year, we have implemented several key enhancements to further bolster our cybersecurity defenses. A security awareness training program has been introduced across our company to educate employees on cybersecurity threats and best practices. Additionally, we have expanded our asset management capabilities, improving visibility into our technology infrastructure and evaluating advanced solutions for more comprehensive oversight.


text: To protect against unauthorized access, our identity and access management framework continues to evolve, incorporating multi-factor authentication and single sign-on to enhance access security. In parallel, our vulnerability management program is actively managed to identify, assess, and remediate security risks before they can be exploited. To further secure our infrastructure, we have deployed an advanced endpoint security solution, ensuring that all company devices are protected against malware and other cyber threats.


text: A core component of our security framework is our threat detection and response capability. We have implemented an extended detection and response system that provides continuous monitoring, real-time threat detection and automated response mechanisms to mitigate cybersecurity risks. Our governance, risk and compliance initiatives have also advanced, with ongoing efforts to standardize security policies and align with regulatory and industry standards. Penetration testing is conducted to assess our security posture and identify potential vulnerabilities, ensuring that our defenses remain resilient against emerging threats.


text: Understanding the risks posed by external partners, we have strengthened our third-party risk management program. This initiative focuses on evaluating and monitoring the cybersecurity practices of our vendors, service providers, and business partners to mitigate potential supply chain risks. Additionally, our incident response plan has been enhanced to support swift detection, containment, and remediation of cybersecurity incidents, ensuring operational continuity and minimal disruption with the addition of an incident response retainer.


text: As of the date of this report, we have not identified any cybersecurity threats, including any past cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, financial condition, or results of operations. We continue to monitor cybersecurity risks closely and remain committed to taking proactive measures to address evolving threats.


text: Cybersecurity Governance. We have established a cybersecurity governance framework to ensure effective oversight, accountability, and strategic alignment across the organization. The Audit Committee of our Board of Directors oversees cybersecurity-related risks as part of its broader risk management responsibilities. The Audit Committee of the Board of Directors receives periodic reports from executive management and external cybersecurity advisors on our security initiatives, emerging threats and risk mitigation efforts.


text: Day-to-day management of our cybersecurity program is led by our Chief Information Security Officer, or CISO, who is responsible for overseeing information security policies, threat mitigation strategies, and compliance initiatives. The CISO provides periodic updates to management and the Audit Committee of the Board of Directors, ensuring that cybersecurity remains a key focus of our risk management framework. Our incident response protocols are structured to provide clear escalation pathways for cybersecurity incidents, ensuring that appropriate leadership is engaged in a timely manner to coordinate an effective response.


text: We also maintain stringent security requirements for third-party service providers, ensuring that vendors comply with our cybersecurity policies and controls. Our third-party risk management program includes due diligence assessments prior to engagement and ongoing security evaluations to mitigate external risks that could impact our operations.


text: As cybersecurity threats continue to evolve, we remain committed to strengthening our cybersecurity governance model, enhancing transparency and implementing best-in-class security measures. Our approach reflects a proactive commitment to protecting our digital infrastructure, ensuring business continuity and upholding the trust of our stakeholders.


text: Risk Management and Strategy We maintain a cybersecurity management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats and incidents. We review our program design on at least a quarterly basis and update as needed to address the risks and threats that our corporate security team has identified. Our team also benchmarks our program to industry recognized frameworks, including the International Organization for Standardization. The Audit Committee of the Board of Directors receives regular reports on cybersecurity risks and evaluates these risks as a part of their enterprise risk review.

companyName: National CineMedia, Inc.

ticker: NCMI


text: Our teams also rely on third-party diagnostic tools and periodic audits to ensure that our program is performing as designed and in-line with applicable standards. Our Chief Information Officer oversees a security committee made up of professionals on our corporate security and other information technology teams to review the results of these audits and recommend improvements. Prior to engaging a third party to provide services, our information technology team performs a risk assessment to determine the level of review of the vendor needed based on the nature of the services to be provided and type of information that may be shared. The resulting vendor review may include requiring the vendor to provide the results of external audits. We continue to monitor our vendors throughout their engagements with us to ensure they have complied with their contractual obligations, including service level agreements and other contractual standards.


text: We have also established an incident response plan to assess, identify and manage specific potential cybersecurity incidents. This plan requires the corporate security team to notify a response team. The response team assesses the risks of the identified potential incident and determines an appropriate response based on the risks identified. The response team then reports on the incident to senior management and, if necessary, a subset of our financial disclosure committee to determine if the cybersecurity incident should be reported in our public filings.


text: We face cybersecurity risks in connection with our business operations. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have experienced threats to our data and systems, including social engineering threats, denial of service attacks, malware and computer virus attacks. For more information about the cybersecurity risks we face, see Item 1A—Risk Factors.


text: Board Oversight—The Audit Committee of the Board of Directors oversees the Company's cybersecurity program. The cybersecurity team updates the Audit Committee on at least a quarterly basis to discuss the effectiveness of the Company's risk management program, potential and identified threats, remediation and mitigation plans, and other topics as requested by the Audit Committee. The Audit Committee regularly reports to the full Board of Directors and management reports on specific matters as requested by the Board of Directors.


text: Management's Role— The Company's Chief Information Officer is responsible for the Company's cybersecurity team and for reporting to the Audit Committee of the Board of Directors. The Company's corporate security team reports directly to the Chief Information Officer. Our Chief Information Officer has more than thirty years of experience managing communication networks, data centers, information technology teams, systems administration and cybersecurity in the media and advertising industry. Our corporate security team is similarly composed of seasoned professionals with significant experience in the field. The Chief Information Officer regularly informs the Company's senior management regarding the prevention, detection, mitigation and remediation of cybersecurity incidents and supervises such efforts. The corporate security team has a broad range of experience selecting, deploying and operating cybersecurity technologies initiatives and seeks to ensure that each team stays educated on emerging technologies and threats.


text: Risk Management and Strategy We regularly assess risks from information security threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our information security policies, processes, and practices. To protect our information systems from threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: Silvercrest Asset Management Group Inc.

ticker: SAMG


text: We recognize the importance of protecting information assets such as the personally identifiable information of our employees, and proprietary business information, and have adopted policies, management oversight, accountability structures and technology processes designed to safeguard this information. All our employees are required to attest annually to our information security policies and participate in regular security awareness training to protect their information and the Silvercrest data and systems to which they have access. These trainings also remind employees how to report any potential privacy or data security issues.


text: Our information security organization comprises internal and external resources designed to identify, protect, detect, mitigate, resolve, and recover from various threats and attacks by malicious actors. We leverage 24x7x365 monitoring tools and services to address the confidentiality, integrity, and availability of Silvercrest assets and data. Regular internal and third-party reviews are performed on our processes and technologies to validate the effectiveness of our privacy and data security controls and safeguards. We monitor industry best practices and developments in data privacy and security, including increased scrutiny of third-party service providers with access to sensitive Silvercrest data. We have implemented and maintain a written proprietary security incident response plan, with defined roles and responsibilities that address notification obligations and incident response procedures to follow in the event of a data security breach. We are dedicated to business continuity and resiliency, and have documented strategies, policies, and procedures in place to protect employee, business, and client data in the event of an emergency or natural disaster. Our information security risk management processes are integrated into our broader risk management program.


text: We work with third-party service providers that proactively assess our information security program and provide us with an industry view of the cyberthreat landscape, in addition to monitoring and supporting our control environment and breach notification and response processes.


text: As of the date of this Annual Report on Form 10-K, information security threats have not materially affected and we believe are not reasonably likely to materially affect Silvercrest, including our business strategy, results of operations, or financial condition. Refer to the risk factor captioned "Operational risks, including the threat of cyber-attacks, may disrupt our business, breach our clients' security, result in losses or limit our growth" in Part I, Item 1A. "Risk Factors" for more information regarding cybersecurity risks and potential related impacts on Silvercrest.


text: We have implemented and maintain a formal information security program, designed to develop, and maintain privacy and data security practices to protect Silvercrest assets and sensitive third-party information, including personal information. This program is governed by employees comprised of members of senior management, including our Chief Information Security Officer ("CISO"), who meet regularly and provide reports to the Board of Directors at least annually. The CISO oversees communications with the Board of Directors regarding material cybersecurity incidents and provides the Board with a summary of risks from current cybersecurity threats on a regular basis, as well as updates on management's information security program oversight and maintenance activities, and any material changes to Silvercrest's information security practices and procedures.


text: We take a risk-based approach to information security and have implemented policies throughout our operations that are designed to address threats and our response to actual or suspected incidents. In particular, the CISO is responsible for the ongoing identification and assessment of reasonably foreseeable cybersecurity threats and based on these assessments, evaluating and overseeing the implementation of safeguards for limiting such risks, including employee training and compliance, and detection and prevention mechanisms. If an information security incident occurs, Silvercrest will assemble an incident response team responsible for the identification, remediation, and post-incident review of such incident, engage outside advisors and notify third parties as appropriate and assess the materiality of the nature, scope and timing of a given incident and whether public disclosure is required.


text: The CISO is responsible for leading the assessment and management of cybersecurity risks. The CISO provides reports to the Board of Directors as part of the updates discussed above and regularly communicates with other members of senior management regarding information security risks.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We periodically assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: ALX ONCOLOGY HOLDINGS INC

ticker: ALXO


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel to manage our risk assessment and mitigation processes, including our Vice President of Operations (VPO), who serves as our acting Chief Information Security Officer (CISO), as well as external information technology consultants who help manage our information technology systems and our information security.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our information technology consultants. Employees at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage our information technology consultants, including dedicated on-site consultants as well as other third parties, in connection with our risk assessment processes. These partners assist us to help design, implement, monitor, and test our cybersecurity policies and procedures. We also require key third-party service providers to certify that they have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors, which is responsible for monitoring and assessing strategic risk exposure, has delegated primary oversight responsibility for cybersecurity to our audit committee.


text: Our VPO and acting CISO, who reports to our President, is responsible for the day-to-day management of our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above, with the assistance of and informed by our consultants. Our VPO and acting CISO, who has many years of senior management and operational oversight at emerging technology companies, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through the day-to-day management of our information technology consultants, which includes engaging with information provided by the consultants, automated monitoring and detection systems, and other tools and processes defined by our cybersecurity policies.


text: Our VPO and acting CISO provides periodic briefings to our executive officers regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our VPO and acting CISO also provides periodic briefings to the board of directors, including the audit committee, on cybersecurity risks and activities.


text: Risk management and strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: Managing Material Risks & Integrated Overall Risk Management We have implemented tools and strategies to promote a company-wide culture of cybersecurity risk management. This ensures that cybersecurity considerations are an integral part of our decision-making process. Our IT Department works closely with our leadership and key operating personnel to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Our information security function and our Vice President of Information Technology help identify, assess and manage the Company's cybersecurity threats and risks. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods in certain contexts, including, for example, manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threat actors, conducting scans of certain environments, evaluating certain threats reported to us, conducting threat and vulnerability assessments, using external intelligence feeds, and using third parties to conduct tabletop incident response exercises and other tests.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including, for example: incident detection and response, disaster recovery/business continuity policies, encryption of certain data, network security controls and data segmentation for certain systems, access controls, physical security, asset management and tracking, systems monitoring, annual mandated employee training, penetration testing, cybersecurity insurance, and dedicated cybersecurity staff.


text: Engage Third-parties on Risk Management Due to the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including but not limited to cybersecurity assessors, consultants, and auditors to evaluate and test our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, to help ensure our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaborations with these third-parties includes regular audits, threat assessments, 24-hour monitoring, and consultation on security enhancements.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we conduct thorough security assessments of all determined high-risk third-party providers as deemed necessary, before engagement to ensure compliance with industry cybersecurity standards and frameworks. This includes assessments performed by our Vice President of IT, who oversees the Company's cybersecurity function.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially affected or are reasonably likely to materially affect our operations or financial standing.


text: We have implemented standard operating procedures to define the channels by which cybersecurity threats are communicated to the Company's Board of Directors (the "Board"). This ensures that The Board has oversight and effective governance in managing risks associated with cybersecurity threats.


text: Board of Directors Oversight The Audit Committee of the Board (the "Audit Committee") is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including, risk management, and finance, equipping them to oversee cybersecurity risks effectively. The Audit Committee receives briefings on cybersecurity risks from the Vice President of IT or the Chief Legal Officer as described below in "Management's Role Managing Risk."


text: Management's Role Managing Risk The Vice President of IT, Chief Legal Officer ("CLO") and the Director of IT Infrastructure and Security, play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. The current Vice President of IT, who is responsible for assessment and management of cybersecurity risks, has over 20 years of experience in information and technology security, including senior roles at several companies in the pharmaceutical industry, and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Vice President of IT and the Director of IT Infrastructure and Security. Our IT Leadership team oversees our governance programs, tests our compliance with standards, remediates known risks, stays informed of significant developments in the cybersecurity domain, and leads our employee training program.


text: Monitor Cybersecurity Incidents The Vice President of IT is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. In cooperation with the Vice President of IT, the Director of IT Infrastructure and Security implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Vice President of IT is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors The Vice President of IT and the Director of IT Infrastructure and Security, in their respective capacity, inform the Chief Financial Officer (CFO) and Chief Legal Officer (CLO) of cybersecurity risks and incidents. Furthermore, significant cybersecurity matters, and strategic risk management decisions are required to be escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues. See Item 1A "Risk Factors" – "Risks Related to Business Operations and Industry."


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Atea Pharmaceuticals, Inc.

ticker: AVIR


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to monitor, assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operation and respective risk profiles.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors — Our business and operations may suffer in the event of information technology system failures, cyberattacks, or deficiencies, which could materially affect our results."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Audit Committee") oversight of cybersecurity risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. These reports include updates on our processes for preparing for, preventing and detecting cybersecurity incidents. Between such regular updates, the Audit Committee would be notified regarding any significant cybersecurity threat or incident, if applicable. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our information technology ("IT") team, which includes both our internal staff and retained consultants with IT and cybersecurity expertise, is led by our Vice President of IT who has more than 25 years of experience managing and securing technology infrastructure and is certified in cybersecurity by the Information System Security Certification Consortium. The IT team has responsibility for, among other things, developing and implementing practices, procedures and controls designed to identify, assess and manage cybersecurity programs and risks. The IT team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Our IT team is supplemented by a security committee, comprised of representatives from key functional areas of our business and includes both our CFO and our Sr. VP of Human Resources to whom the Vice President of IT reports.


text: We recognize the critical importance of maintaining the trust and confidence of patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: SYNLOGIC, INC.

ticker: SYBX


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program and work with a third party managed service provider to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We and our third-party partners employ a range of tools and services, including regular network and endpoint monitoring and protection, audits, vulnerability assessments, and penetration testing, to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance; Management" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Principal Executive Officer and Principal Financial Officer.


text: We also identify our cybersecurity threat risks by using the services of a managed services provider. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor as appropriate emerging data protection laws and industry literature and implement changes to our processes that are designed to comply with such laws if needed; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including redundant firewalls, intrusion prevention and detection systems, multi-factor authentication, encryption, anti-malware functionality and access controls; • provide annual and routine mandatory training utilizing Knowbe4 (leading security awareness training module) for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • conduct phishing email simulations for employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • utilize a managed services provider to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident Our incident response plan coordinates the activities we, in concert with our third party managed services provider, take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, including through vendor security questionnaires as appropriate.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, under the heading "Our internal computer systems, or those of our collaborators or other contractors or consultants, may fail or suffer cybersecurity incidents, which could result in a material disruption of our product development programs," which disclosures are incorporated by reference herein. In the last three fiscal years, we have not experienced any cybersecurity incidents which have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our audit committee to oversee risks from cybersecurity threats.


text: At least annually and on a periodic basis, our audit committee receives an update from management on our cybersecurity threat risk management and strategy processes and generally receives materials on our ability to mitigate current and emerging risks. Our processes require that our audit committee is designated to receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by the Company's Principal Executive Officer and Principal Financial Officer, along with the Company's managed services provider, which monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, the Company's Principal Executive Officer and Principal Financial Officer reports to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, on an annual basis.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: KINETA, INC./DE


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process, appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, among others: • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • undertake regular reviews of our consumer facing policies and statements related to cybersecurity; • proactively inform our customers of substantive changes related to customer data handling; • conduct annual customer data handling and use requirements training for all our employees; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; • conduct regular network monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K); • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and • conduct annual training with all employees on our security standards and requirements.


text: In the event of a cybersecurity incident, we will coordinate with our third-party cybersecurity advisor to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: As part of the above processes, we regularly engage with assessors, consultants, auditors, and other third parties, including by regularly having a third party review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.


text: Our internal processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. We determine an overall risk assessment of potential cybersecurity issues with our third-party suppliers. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. Additionally, if appropriate, we require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management.


text: Our audit committee is responsible for the oversight of risks from cybersecurity threats. At least annually, the audit committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the audit committee generally receives materials including a cybersecurity scorecard and other materials indicating current and emerging material cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and discusses such matters with certain members of management, which include our CFO and President. Members of the audit committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our President. Such individual completed a certificate program with Stanford University on Foundations of Information Security in the first quarter of 2024. In addition, he has over 20 years of executive responsibility for managing public company IT operations, including managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and deployment of internal training and company technology standards. This member of management is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: As discussed above, this member of management reports to the audit committee about cybersecurity threat risks, among other cybersecurity related matters.


text: Our cybersecurity program is designed to protect our information, and that of our customers, against cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems. Our cybersecurity risk management program, which is integrated into our overall enterprise risk management program, includes policies, processes and technologies to assess, identify and manage risks from cybersecurity threats and leverages the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Exodus Movement, Inc.

ticker: EXOD


text: Our Board, with assistance from its Audit Committee, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our Audit Committee receives reports on significant cybersecurity developments from the management team responsible for overseeing the Company's risk and cybersecurity management processes, including our Chief Compliance Officer and VP of Infrastructure & Security. We also have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to our Board in a timely manner.


text: At the management level, our VP of Infrastructure & Security leads the team responsible for implementing, monitoring and maintaining our cybersecurity risk management program across our business. He has extensive cybersecurity knowledge and skills gained from over 15 years of relevant work experience, including various leadership and management roles in information technology at the Company and elsewhere. He also has a Bachelor of Science in information systems.


text: Risk Management and Strategy Our cybersecurity program includes technical safeguards, including automated tools managed and monitored by our cybersecurity team. Additionally, we regularly conduct penetration and vulnerability testing and tabletop exercises, along with regular employee training on cybersecurity matters. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use.


text: While we have not identified any material cybersecurity threats or incidents in the last year that have had a material adverse effect on our business, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. For more information on our cybersecurity related risks, see "Item 1A. Risk Factors—Risks Related to Our Business – Any actual or perceived failure of the Exodus Platform to block malware or prevent failures or security breaches or other cybersecurity incidents could harm our reputation, cause the Exodus Platform to be perceived as insecure, underperforming or unreliable, impede our efforts to attract and retain users and otherwise negatively impact our business, results of operations and financial condition." of this report.


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature.

companyName: Nuvation Bio Inc.

ticker: NUVB


text: Our Audit Committee, together with our information security function and third-party service providers help identify, assess, and manage the Company's cybersecurity threats and risks. Additionally they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example using automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting internal and/or external audits, conducting threat assessments for internal and external threats, third party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and using external intelligence feeds.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: cybersecurity-related policies and procedures (including incident response plans and policies, a vulnerability management policy, disaster recovery/business continuity plans), incident detection and response, periodic risk assessments, implementation of security standards/certifications, encryption of data, network security and system monitoring controls (including technology solutions such as antivirus, firewalls and monitoring tools), awareness training for all employees, security measures, asset management, tracking and disposal, penetration testing, cybersecurity insurance coverage, and a dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) security management works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk, and (4) we have a cybersecurity incident response plan to identify, assess, respond to, and inform escalating levels of management based on the nature and severity of such incidents.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example Professional services firms, including legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers (including SIEM tools and 24/7 managed detection and response), penetration testing firms, and dark web monitoring services.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and contract research organizations. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for each vendor, a security questionnaire, review of the vendor's written security program, review of security assessments and other reports. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see the section titled "Risk Factors" in Item 1A of this Annual Report on Form 10-K, including the risk factor titled "—Our internal computer systems, or those used by our CROs or other contractors or consultants, may fail or experience security breaches or other unauthorized or improper access."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee of our board of directors is responsible for oversight of the Company's cybersecurity risk. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director Infrastructure, Operations and Cyber Security who has fifteen years of experience in the industry and oversees the Company's infrastructure, operations and cyber security, and our Vice President of Legal, who has expertise in legal, compliance and privacy matters.


text: Our Senior Director Infrastructure, Operations and Cyber Security is responsible for integrating cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, reviewing security assessments and other security-related reports, and retaining assessors, consultants, auditors, or third parties in connection with the company's cybersecurity program.


text: Our cybersecurity incident response processes and policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Senior Director Infrastructure, Operations and Cyber Security, who works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes and policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The board of directors and audit committee receive periodic reports concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The board of directors and audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: As discussed in this Annual Report on Form 10-K, the changes in our business and operations that will occur in connection with our review of strategic alternatives may impact our cybersecurity program in the future. As such, the following section describes the Company's cyber risk management and strategy, and governance related to cybersecurity risks, for the fiscal year that ended December 31, 2024. For more information regarding the changes to our business and operations and associated risks, please see (i) Item 1 – Business, (ii) Item 1A – Risk Factors, and (iii) Item 7 – Management's Discussion and Analysis of Financial Condition and Results of Operations in this Annual Report on Form 10-K.

companyName: Kalaris Therapeutics, Inc.

ticker: KLRS


text: Cyber Risk Management and Strategy We rely on information technology systems that we or our third-party providers operate to process, transmit and store electronic information in our day-to-day operations. To help protect against risks from cybersecurity threats to these systems, we have implemented cybersecurity processes in accordance with our risk profile and business that are designed to identify, assess, and manage cybersecurity risks.


text: We leveraged internal and external resources to support our cyber risk management efforts, including security monitoring tools, periodic penetration tests and vulnerability assessments. We have in the past also engaged the services of external information security service providers to help support our information technology environment, assist with security monitoring, and help us draft and implement information security policies.


text: As part of our cybersecurity risk management process, we take a risk-based approach to the evaluation of third-party vendors based on the criticality and size of the vendor. This process has included a review by our external partners, as appropriate.


text: To date, w e have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. As mentioned above, the changes in our business and operations may impact our cybersecurity program in the future. In addition, like other companies in our industry, we and our third-party vendors have, from time to time, experienced threats and security incidents relating to our third-party vendors' information systems and infrastructure. For more information, please see Item 1A - Risk Factors.


text: Governance Related to Cybersecurity Risks Our Vice President, Head of Information Technology meets periodically with representatives from our external Managed Services Provider ("MSP") to, as applicable, review aspects of the Company's cybersecurity processes or evaluate risks from cybersecurity threats. The individual who currently holds the title of Vice President, Head of Information Technology has over 20 years of experience in information security and cybersecurity risk management. Our Vice President, Head of Information Technology reports to the Chief Financial Officer.


text: We have established a process for management, including our Vice President, Head of Information Technology and Chief Financial Officer, to report to the Audit Committee on potential major cybersecurity risks, their potential impact on us, and the steps we take to manage them. The Audit Committee considers identified cybersecurity risks and the steps that the Company's management has taken to monitor and control such risks in connection with the Audit Committee's discussion of the Company's risk assessment and management guidelines, as appropriate. The Audit Committee has periodically reviewed and discussed the Company's cybersecurity risks, including the Company's information security and risk management programs, controls and procedures, as well as high-level review of the threat landscape facing the Company and the Company's strategy to mitigate cybersecurity risks and potential security incidents.


text: Our board of directors oversees management of our cybersecurity risks through the Audit Committee. As needed, the chairperson of the Audit Committee provides updates on the Company's cybersecurity risk program to the full board of directors.


text: We recognize the importance to our business and reputation of the continuous availability of our internal and client-facing information technology systems, as well as our ability to protect both the confidential information of our clients and our own intellectual property and business information. We are committed to protecting our client and business data and information technology assets and have implemented a cybersecurity program with policies, standards, processes and practices governing the protection and control of information during its lifecycle of creation, usage, transmission, storage and disposal.

companyName: FORRESTER RESEARCH, INC.

ticker: FORR


text: Cyber Risk Management and Strategy We have implemented and maintain a risk management program that includes processes for the identification, assessment, management and mitigation of cybersecurity risks. This program utilizes numerous technological and human security controls, processes, and procedures to address risks including, but not limited to, those identified by threat intelligence providers, internal stakeholders, and security management programs. Our cybersecurity program is generally aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework.


text: Our risk management program is documented in our written Information Security Policy. We periodically update our Information Security Policy, along with other policies and procedures, to adapt to evolving business conditions and threats.


text: Included in our Information Security Policy is a documented incident response plan to identify, assess, manage and mitigate cybersecurity incidents. As part of our risk management program, we maintain a technology management security team, led by our Information Security Officer (ISO). Among their responsibilities, our technology management security team is responsible for conducting due diligence on software, hardware or services vendors where access to systems or data of Forrester or our clients is contemplated. The security team assesses whether these vendors have appropriate privacy and security controls and whether there are adequate contractual protections in place. We also engage external security assessment vendors from time to time to conduct penetration testing and vulnerability assessments and to report findings to management.


text: All new Forrester employees and contractors receive a copy of the Information Security Policy and are required to undergo information security and privacy training both as part of their onboarding and on an annual basis. We currently also maintain cybersecurity insurance covering the company and its subsidiaries.


text: While to date we are not aware of having experienced any material cybersecurity threats or incidents, and we do not believe that risks from such threats or incidents are reasonably likely to materially affect us, our business strategy, results of operations or financial condition, there can be no guarantee that we will not experience a successful material threat or incident. Additional information on cybersecurity risks we face can be found in "Item 1A, Risk Factors" under the heading "We face risks from network disruptions or security breaches that could damage our reputation and harm our business and operating results."


text: Governance Related to Cybersecurity Risks Our board has final oversight responsibility over cybersecurity-related matters. Our Chief Technology Officer (CTO) leads the full board in interactive sessions dedicated to cybersecurity risks at least once a year. These sessions address a range of cybersecurity-related topics, such as recent developments in the threat environment, the status of ongoing information security program initiatives, and cybersecurity strategy. In addition, the audit committee assists the board in fulfilling its oversight responsibilities with respect to policies relating to risk assessment and management, including the management of risks arising from cybersecurity threats. The audit committee is responsible for reporting findings related to its review of these matters to the board.


text: With respect to management, our CTO, who reports directly to our chief executive officer, has over 12 years of experience with our company, including more than 6 years serving in technology-based leadership roles. Our VP, Infrastructure, Operations & Security, who reports directly to the CTO, serves as our ISO and has extensive cybersecurity experience gained from over 20 years serving in security-related roles for the Company. Our ISO, together with our technology management security team, is responsible for developing, maintaining and enhancing systems and processes necessary to protect confidential information from loss, theft, and unauthorized access or use. This team also monitors the systems and networks to detect unauthorized activity or access, responding to any such unauthorized attempts to mitigate loss or to ensure the cessation of all unauthorized access to data. If an incident is identified, this team reports such events to the CTO, who will then, as appropriate, advise the chief executive officer, chief legal officer and other management, as well as others, potentially including law enforcement or clients. We have also established a Risk Committee consisting of members of our finance, legal and technology management departments whose duties include assessing the materiality of any identified incidents to help ensure compliance with the SEC's cybersecurity incident disclosure rules.


text: Cybersecurity Risk Management and Strategy As an externally managed closed-end management investment company that has elected to be regulated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our executive officers under the oversight of our Board of Trustees. Our executive officers are senior professionals of Onex Credit and each of the Adviser and Administrator is a subsidiary of Onex Corp. As such, we are reliant on Onex Corp. for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Onex Corp. has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Onex Direct Lending BDC Fund


text: Onex Corp. has established a dedicated cybersecurity team which maintains a comprehensive firmwide cybersecurity program to protect its systems, operations and the information stored within. Onex Corp.'s Audit, Nominating and Corporate Governance Committee receives at minimum, quarterly cybersecurity updates from the Managing Director – Enterprise Technology, who leads Onex Corp.'s program and who works closely with senior management to develop and advance Onex's cybersecurity strategy.


text: As part of Onex Corp.'s ongoing cybersecurity operations, the cybersecurity team regularly conducts testing to identify vulnerabilities that could be exploited by attackers often using various automated tools as well as a managed service provider. The team examines and validates the cybersecurity program and cyber risk posture annually with third parties, measuring it against industry standards and established frameworks, such as the National Institute of Standards and Technology ("NIST"), Center for Internet Security and the International Organization for Standardization (ISO). Onex maintains a comprehensive Security Incident Response Policy, an Incident Response Plan, and Incident Response Playbooks to ensure that any non-routine events are properly investigated and escalated where necessary. On an annual basis, these plans, policies and processes are validated and practiced with senior executives and representatives from key areas of the firm through a cyber-incident tabletop simulation exercise. Onex Corp. engages with a Managed Security Services Provider (the "MSSP") who conducts vulnerability scanning and cyber threat intelligence on a weekly basis at minimum. Additionally, third-party cybersecurity consultants are engaged to perform penetration testing on a bi-annual basis. The findings are reviewed, prioritized and remediated in alignment with the recommendations from the external consultant. In addition to Onex Corp.'s cybersecurity team's internal exercises to test aspects of its cybersecurity program, Onex Corp. periodically engages independent third parties to assess the risks associated with its information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of enterprise information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of the cybersecurity systems and processes.


text: Onex Corp. maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to track cybersecurity risks at the firm, and integrates these processes into the firm's overall risk management practices described above. Onex Corp.'s cybersecurity management team periodically discusses and reviews cybersecurity risks and related mitigants at its Cybersecurity Excellence Quarterly Forum.


text: Onex Corp. employs a process designed to assess, typically prior to onboarding, the cybersecurity risks associated with the engagement of third-party vendors, including those of its externally managed companies such as us. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Onex Corp. may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Onex Corp. seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Onex Corp. also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data.


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Onex Corp. and its affiliates in managing these risks, see "Item 1A. Risk Factors— Risks Related to Our Business and Structure—We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Onex Corp. has a dedicated cybersecurity team, led by the Managing Director – Enterprise Technology Services, who works closely with senior management, including Onex Corp.'s Chief Financial Officer, to develop and advance the firm's cybersecurity strategy, which applies to us.


text: The Managing Director – Enterprise Technology and Manager, Cybersecurity has extensive experience in technology and cybersecurity, respectively. The cybersecurity team of Onex Corp. is responsible for all aspects of cyber security across Onex.


text: The Managing Director – Enterprise Technology has 18 years of IT experience across financial services, healthcare and manufacturing industries in Canada including as the VP Financial Crimes and Enterprise Risk Technology at CIBC that provided cybersecurity platforms and services to protect the bank. Reporting to the Managing Director – Enterprise Technology, is the Manager, Cybersecurity who has over 15 years of experience in cybersecurity including Incident Readiness and Response, Strategy, GRC, Vulnerability and Threat Management, Business Continuity, Disaster Recovery. The Manager, Cybersecurity holds the CISSP (Certified Information Systems Security Professional) designation, has a BSc in Business Information Systems, and a Cybersecurity Bootcamp Certification from the University of Toronto. Reporting to the Manager, Cybersecurity is an IT Security Analyst who has over 5 years of experience in cybersecurity, including Digital Forensics, Identity and Access Management, Third-Party Risk Management. The IT Security Analyst also has a BSc in Forensic Science, an MSc in Information Security and Digital Forensics, and is currently pursuing a PHD in Information Systems and Design.


text: Onex Corp. conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The cybersecurity team of Onex Corp. reviews the cybersecurity framework annually as well as on an event-driven basis as necessary. Onex Corp.'s cybersecurity team and Onex Corp.'s MSSP also review the scope of the cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Onex Corp.'s and its affiliates' information and systems.


text: Our Board is responsible for understanding the primary risks to our business. The Board is responsible for reviewing periodically our and the Adviser's information technology security controls and related compliance matters, with management. Onex Corp.'s cybersecurity team reports to the Board at least annually on cybersecurity matters, including risks facing us and the Adviser and, as applicable, certain incidents. In addition to such periodic reports, the Board or a committee thereof may receive updates from management as to our and the Adviser's cybersecurity risks and Onex Corp.'s cybersecurity program developments.


text: Impact of Cybersecurity Risks In 2024, we did not experience a material cybersecurity incident. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Risks Related to Our Business and Structure— We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information."


text: To prevent, detect and respond to information security threats, the Sponsor maintains a cyber risk management program. The program is supervised by an in-house dedicated Chief Information Security Officer ("CISO") with over 15 years of experience in financial services risk management, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Enterprise Risk Committee ("ERC"), which includes members of management of the Sponsor, receives regular reports from the CISO on, among other things, the Sponsor's cyber risks and threats, the status of projects to strengthen the Sponsor's information security systems, assessments of the Sponsor's security program and the emerging threat landscape.

companyName: Grayscale Ethereum Classic Trust (ETC)

ticker: ETCG


text: The CISO updates the ERC and the Board quarterly. These regular reports include the Sponsor's performance preparing for, preventing, detecting, responding to, and recovering from, cyber incidents. The CISO also promptly informs and updates the ERC and the Board about any information security incidents that may pose a material risk to the Sponsor. The Sponsor contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are reported to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally reported to the ERC and Board.


text: The Sponsor's Security Awareness Program includes training that reinforces the Sponsor's Information Security policies, standards, and practices, and the expectation that employees will comply with these policies. The Security Awareness Program engage s personnel through training on how to identify potential cybersecurity risks and protect the Sponsor's resources and information. This training is mandatory for all employees upon onboarding at the firm and again annually, and it is supplemented by firmwide training and testing initiatives, including periodic phishing tests.


text: The Sponsor administers a Third-Party Risk Management Program at the firm to identify, assess and oversee the risk associated with service providers and third parties involved in the supply chain. Third parties are risk-rated and must adhere to additional security diligence requirements administered with oversight from the CISO according to risk, including cybersecurity diligence questionnaires, evidence validation, SOC report reviews, and/or on-site assessments. Material changes to the program, new, or worsening security risks associated with third parties are reported to the ERC at least quarterly.


text: During the year ended December 31, 2024, we did not identify any cybersecurity threats at the Sponsor or the Trust that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.


companyName: Grayscale Zcash Trust (ZEC)

ticker: ZCSH


text: The Sponsor's Security Awareness Program includes training that reinforces the Sponsor's Information Security policies, standards, and practices, and the expectation that employees will comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Sponsor's resources and information. This training is mandatory for all employees upon onboarding at the firm and again annually, and it is supplemented by firmwide training and testing initiatives, including periodic phishing tests.


text: We recognize the critical importance of protecting our information technology ("IT") systems and the data of our employees, customers, patients, and partners. We have an enterprise-wide cybersecurity program designed to identify, detect, investigate, protect, and respond to cybersecurity risks.

companyName: Sight Sciences, Inc.

ticker: SGHT


text: The Nominating and Corporate Governance Committee of the Board of Directors oversees our cybersecurity programs and cybersecurity team, which are led by our Vice President of Information Technology. At least semi-annual reviews are presented by the Vice President of Information Technology to the Nominating and Corporate Governance Committee demonstrating the cybersecurity practices and controls, mitigation activities, current threat levels, emerging cybersecurity threats, training initiatives, breaches, and results from any penetration testing. In addition, cybersecurity risk management is part of the enterprise risk management program and is reviewed by the Audit Committee at least annually.


text: We have developed an information security policy ensuring that our cybersecurity objectives are established and compatible with our strategic direction. The goal of this policy is to protect our informational assets against reasonably foreseeable internal, external, and accidental threats. Identifying and assessing cybersecurity risk is integrated into our overall risk management processes. Cybersecurity risks related to our business, operations, privacy, and compliance are identified and managed through third party assessments, internal IT audits, governance, risk and compliance reviews.


text: Our policies and approach to cybersecurity include several key elements: • Continuous Monitoring and Defense: We work to protect our environments and products from threats through multi-layered defenses. We utilize data analytics to detect anomalies and search for cyber threats. Our Security Operations Center provides comprehensive, around the clock, cyber threat detection and response capabilities. • Third-Party Software Risk Assessment: W e complete security audits on all third-party platforms prior to selection. • Incident Response Plan: Our Incident Response Plan includes the investigation steps and notifications required on all actual and suspected information security incidences • Cybersecurity Training Programs: Our training program is multi-faceted and focused on awareness of new techniques that threat actors utilize both in the corporate environment, as well as their personal lives. Employees undergo regular training on information security best practices, including interactive training to confirm understanding and test employee skills. • Compliance Policy: Mandatory compliance with all cybersecurity programs, including applicable legislative and regulatory requirements. • Third-Party Cybersecurity Plan Assessment: We regularly engage with cybersecurity professionals in reviewing our cybersecurity plan.


text: To date, the Company is not aware of any cybersecurity threats, including any prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, as discussed under the heading, "Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or our customer's patients, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation" in Part I, Item 1A, "Risk Factors," the Company remains subject to evolving cybersecurity risks that could have adverse impacts.


text: Risk Management and Strategy We have established policies and processes designed to assess, identify, and manage material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. We monitor our environments to identify cybersecurity threats, as well as assess our environments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Atara Biotherapeutics, Inc.

ticker: ATRA


text: Following our monitoring, we adjust, implement and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Information Officer, who reports to our Chief Financial Officer and Chief Operating Officer, to manage any identified risks and mitigation process. As part of our overall cyber security framework, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our information technology (IT) department and management. Personnel at all levels and departments are made aware of our cybersecurity policies through ongoing training.


text: We engage third-party vendors in connection with our cybersecurity risk monitoring and processes. These service providers assist in our design and implementation of our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. We also maintain insurance coverage that is intended to address certain aspects of cybersecurity risks.


text: Notwithstanding any of these measures, our systems and networks remain potentially vulnerable to known or unknown cybersecurity attacks and other threats, any of which could have a material adverse effect on our consolidated results of operations, financial condition and cash flows. We have experienced, and will continue to experience, cyber incidents in the normal course of our business. As of the date of this report, we have not identified any risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on us will not occur in the future. For additional information on the risks we face from cybersecurity threats, please see the risk factor titled, "If our security measures are compromised, or our information technology systems or those of our vendors, and other relevant third parties fail or suffer security breaches, loss or leakage of data, and other disruptions, this could result in a material disruption of our services, compromise sensitive information related to our business, harm our reputation, trigger our breach notification obligations, prevent us from accessing critical information, and expose us to liability or other adverse effects to our business." in Item 1A. "Risk Factors."


text: The Audit Committee of the Board of Directors is responsible for the primary oversight of our information security programs, including relating to cybersecurity. The Audit Committee receives status updates on at least a semi-annual basis from our Chief Information Officer on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our security program, and our views of the emerging threat landscape. The Chair of the Audit Committee regularly reports to the Board on cybersecurity risks and other matters reviewed by the Audit Committee. In addition, all Board members have access to the materials for each Audit Committee meeting.