text: Our cybersecurity and compliance team regularly collects data on cybersecurity threats and risk areas, monitors our systems, and conducts testing to assess our processes and procedures and the threat landscape. Our VP, CIO and CISO receives regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation.


text: In the event of an incident, we intend to utilize our ICT and follow our detailed incident program and processes, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying relevant functional areas, as well as senior leadership and the Board, as appropriate.

companyName: Northwest Natural Holding Co

ticker: NWN

secItem: Item 1C


text: We recognize the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. We have an enterprise risk management framework that is designed to identify, measure, control, monitor and mitigate risks across various aspects of our business and operations, including, credit, interest rate, liquidity, operational, regulatory compliance, strategic, reputational, and legal risks. As we rely and continue to increase our reliance on technology and given the constant state of cyber threats, information security or cybersecurity is a significant component of our enterprise risk management framework. Our Chief Information Security Officer, a key member of our risk management organization, who has overall responsibility, accountability, and ownership for this cybersecurity component, reports directly to the Chief Risk Officer and periodically presents reports to the Risk Committee of our Board of Directors.

companyName: Amerant Bancorp Inc.

ticker: AMTB


text: We are actively engaged in identifying, managing, and mitigating cybersecurity risks with the objective of avoiding or minimizing the impact of malicious and non-malicious actions and threats aimed at penetrating, disrupting or misusing our systems and information. Protecting company data, non-public customer and employee data, and the systems that collect, process, and maintain this information is deemed critical. We have developed and implemented an enterprise-wide information security program, which is designed to protect the availability, integrity, and confidentiality of customer non-public information and company data, including the protection of the hardware and infrastructure used to store and transmit such information. Our Information Security Program is structured and aligned with the Federal Financial Institution Examination Council ("FFIEC") guidelines for information security, regulatory guidance, and other industry standards. To promote the continued effectiveness of our information security program, we periodically conduct risk assessments, complete audits and tests, participate in industry associations, and review information from threat intelligence feeds. In addition, our Chief Information Security Officer and members of his team and of our Information Technology team regularly collaborate with external parties, including regulatory agencies, other banks and industry groups to share cyberthreat information, trends and issues and identify best practices.


text: We leverage knowledge, people, processes, and technology to develop, implement, manage, and maintain cybersecurity controls. Our information security program employs several detective and defensive tools designed to monitor, alert, and block suspicious activity, as well as to identify, report and address any suspected threats. Our information security program is a continuous on-going periodically updated program that is supported by policies, procedures, standards and guidelines; an Enterprise-wide Vendor Management Program; a Technology Project Management Office (PMO) and an Enterprise-wide Business Continuity and Disaster Recovery Program. This integration is aimed at ensuring that program is embedded into the organization's lines of business, support functions and third-party vendor management program.


text: We have implemented controls that align information security standards with the nature of our operations and strategic direction. When possible, we implement layered control systems by deploying different controls at different points of business processes and throughout an IT system so that the strength of one control can compensate for weaknesses in or possible failure of another control. We have also developed an enterprise-wide vendor management and third-party risk management program designed to identify, assess, and manage information security, operational and technology risks associated with third-party vendors. Our Enterprise-wide Vendor Management Program is in alignment with the FFIEC Guidelines for Third Party Service Providers and is designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers. Our Information Security Program also continuously promotes cybersecurity awareness and culture across the organization, including regular education and training, that requires team members to complete training and certification on an annual basis and phishing simulations (attempts of attacks) monthly. New hires are also provided with information security awareness training during the orientation process. A customer security awareness and communication program has also been developed and implemented to keep customers abreast of security and fraud risks.


text: While we believe that our business, financial condition, or results of operations have not been materially adversely affected by any cybersecurity incidents, cybersecurity threats are common and pervasive and, we, as well as our customers, regulators, and service providers, have experienced and will likely continue to experience a significant increase in information security and cybersecurity threats and attacks, see "Our information systems are exposed to cybersecurity threats and may experience interruptions and security breaches that could adversely affect our business and reputation" in Item 1A. Risk Factors. We continuously assess the risks and changes in the cyber environment and update our information security program to reflect the results of risk assessments and the key controls necessary to safeguard customer information and ensure the proper disposal of customer information. The program is updated considering changes in technology, the sensitivity of our customer information, internal or external threats to information, and our own changing business environment which can include mergers and/or acquisitions, outsourcing arrangements, and changes in customer information systems which may have material impact on the program. We also leverage control testing of key controls, systems, and procedures of our information security program performed by internal and external auditors and external partners, that is periodically completed to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We have developed and maintain an incident response plan that provides a documented procedure to respond and address cybersecurity incidents, including timely notification to the Executive Management Committee and the Risk Committee of the Board of Directors. The incident response plan provides for the interaction and coordination of executive, strategic and tactical teams, depending on the severity level of the incident, aimed at facilitating coordination across multiple units and departments of the Company. Our incident response plan is tested at least annually.


text: The Information Security Department, under the leadership of the Chief Information Security Officer, has the responsibility for implementation and monitoring our information security program. The responsibilities of this department include cybersecurity risk assessments, vulnerability management, access reviews for systems and applications, incident response and management, gathering and sharing threat intelligence, monitoring of controls, and overall responsibility for the development of the information security program including relevant policies, procedures, standards and guidelines to enhance data security and mitigate risks. Members of this department include individuals with varying degrees of education and experience, in particular, our Chief Information Security Officer has over twenty years of experience in information technology and risk management, with emphasis on information security and cyber security risk management; throughout his career he has served in different positions including as Information Technology Auditor, Technology Risk Manager, Information Security Program Manager and, since September 2018 as our CISO. He has a bachelor's degree in computer systems analysis and has obtain several relevant certifications, including having completed the EC-Council's Certified Chief Information Security Officer Program and obtaining the Information Systems Auditor and Risk and Information Systems Control certifications from the Information Systems Audit and Control Association, ISACA. Several management committees, including our Executive Management Committee, manage our information security program and meet periodically to review and discuss information security matters. In general, summaries of key matters discussed are reported to the Risk Committee.


text: Our Board, through the Risk Committee, is actively engaged in the oversight of our information security program. The Risk Committee oversees our information security program, including management's actions to identify and evaluate, material cyber vulnerabilities, threats, and risks as well as the development and implementation of mitigating and remediating actions. Our Chief Information Security Officer presents quarterly reports to the Risk Committee regarding our information security program, including relevant information on key risk and performance indicators related to cybersecurity matters as well as significant cybersecurity and privacy events. In addition, our information security risk profile is presented to the Risk Committee on a semi-annual basis.


text: The Information Security Department, under the leadership of the Chief Information Security Officer, has the responsibility for implementation and monitoring our information security program. The responsibilities of this department include cybersecurity risk assessments, vulnerability management, access reviews for systems and applications, incident response and management, gathering and sharing threat intelligence, monitoring of controls, and overall responsibility for the development of the information security program including relevant policies, procedures, standards and guidelines to enhance data security and mitigate risks. Members of this department include individuals with varying degrees of education and experience, in particular, our Chief Information Security Officer has over twenty seven years of experience in information technology and risk management, with emphasis on information security and cyber security risk management; throughout his career he has served in different positions including as Information Technology Auditor, Technology Risk Manager, Information Security Program Manager and, since September 2018 as our CISO. He has a bachelor's degree in computer systems analysis and has obtained several relevant certifications, including having completed the EC-Council's Certified Chief Information Security Officer Program and obtaining the Information Systems Auditor and Risk and Information Systems Control certifications from the Information Systems Audit and Control Association, ISACA. Several management committees, including our Executive Management Committee, manage our information security program and meet periodically to review and discuss information security matters. In general, summaries of key matters discussed are reported to the Risk Committee.


text: Risk Management and Strategy The Company's cybersecurity objective is to protect Garrett against data privacy breaches, information theft, and external and insider cyber threats through the use of a combination of leading technologies, policies, and procedures. The Company has processes in place to identify, assess and monitor material risks from cybersecurity threats, which are part of the Company's overall enterprise risk management ("ERM") process and have been embedded in the Company's operating procedures, internal controls and information systems. To that end, we take a holistic approach to securing our data and business systems from attack, compromise or loss.

companyName: Garrett Motion Inc.

ticker: GTX


text: The Company has cybersecurity capability including a Security Operations Center ("SOC") that is managed by a dedicated Chief Information Security Officer ("CISO") whose team is responsible for leading the Company-wide cybersecurity strategy, policy, standards, architecture, and processes. The SOC provides visibility across all information technology assets and includes proactive cyber security threat detection technology to facilitate the identification of misconfigurations to mitigate threats and prevent data loss. As part of the Company's holistic approach to cybersecurity, we have implemented programs and technology associated with threat hunting, vulnerability scanning, and threat detection and response technology.


text: As part of its cybersecurity risk management, the Company delivers specific education to the organization on how to identify potential cybersecurity risks and protect the Company's resources and information. This training is mandatory for all employees globally on a regular basis and may be supplemented by various testing initiatives including periodic phishing tests.


text: The Company leverages third-party expertise for periodic effectiveness testing of its prevention, detection, and response capabilities. The Company also requires all third-party service providers to meet certain cybersecurity requirements, including risk assessment and monitoring activities. In addition, third-party service providers with access to the Company's network are also required to undertake cybersecurity training.


text: While Garrett focuses heavily on prevention and detection, response and recovery plans, service agreements and partner engagements are in place should there be a need for us to respond to a cybersecurity attack. The Company's response process includes identifying the incident; notifying the executive team, activating the crisis team, assessing the business risk and materiality of the incident; managing the recovery of operations; and performing a post-incident analysis. The Company maintains business continuity and disaster recovery plans. The Company also engages in cyber crisis response simulation to assess our incident response ability and effectiveness.


text: No cybersecurity incidents have occurred that materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition during the year ended December 31, 2023. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us in the future. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Role of Management The Company has a Cyber Risk Governance Council consisting of the Senior Vice President Chief Digital and Information Officer ("CDIO"), the CISO, the IT leadership team, and the legal and cybersecurity teams that focuses on cybersecurity and compliance risks. The Cyber Risk Governance Council meets monthly to review cybersecurity risks and related risk management methodologies. Cybersecurity risks are included in the Company's ERM as appropriate based on potential impact and vulnerability assessed according to certain set criteria and defined ERM materiality thresholds. Regular discussions over cybersecurity developments and risk mitigation approaches are held by the Cyber Risk Governance Council with the Chief Executive Officer and the senior leadership team.


text: Role of the Board The Board of Directors is responsible for overseeing overall risk management for the Company, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess, manage and mitigate risk. The Board has delegated responsibility for oversight of the Company's cybersecurity framework and risk management to the Audit Committee.


text: The CDIO and CISO provide reports to the Audit Committee at least semi-annually on the Company's cybersecurity program including the external threat environment, the Company's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment, and the results of evaluation of the Company's cybersecurity program by external experts. The Audit Committee, as well as the Board of Directors, is also promptly informed about any information security incidents that may pose significant risk to the Company.


text: The Company has cybersecurity capability, including a Security Operations Center ("SOC") that is managed by a dedicated Chief Information Security Officer ("CISO") whose team is responsible for leading the Company-wide cybersecurity strategy, policy, standards, architecture, and processes. The SOC provides visibility across all information technology assets and includes proactive cyber security threat detection technology to facilitate the identification of misconfigurations to mitigate threats and prevent data loss. As part of the Company's holistic approach to cybersecurity, we have implemented programs and technology associated with threat hunting, vulnerability scanning, and threat detection and response technology.


text: No cybersecurity incidents have occurred that materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition during the year ended December 31, 2024. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us in the future. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Role of Management The Company has a Cyber Risk Governance Council consisting of the Senior Vice President Chief Digital and Information Officer ("CDIO"), the CISO, the IT leadership team, and the legal and cybersecurity teams that focuses on cybersecurity and compliance risks. The Cyber Risk Governance Council meets monthly to review cybersecurity risks and related risk management methodologies. Cybersecurity risks are included in the Company's ERM as appropriate based on potential impact and vulnerability assessed according to certain set criteria and defined ERM materiality thresholds. Regular discussions over cybersecurity developments and risk mitigation approaches are held by the Cyber Risk Governance Council with the Chief Executive Officer and the senior leadership team. The CISO has over 27 years of experience in IT in various capacities with over 21 years in cybersecurity, reporting into the CDIO, who has over 20 years of IT related experience.


text: The CDIO and CISO provide reports to the Audit Committee at least semi-annually on the Company's cybersecurity program, including the external threat environment, the Company's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment, and the results of evaluation of the Company's cybersecurity program by external experts. The Audit Committee, as well as the Board of Directors, is also promptly informed about any information security incidents that may pose significant risk to the Company.


text: Cybersecurity Risk Management and Strategy As an externally managed closed-end management investment company that has elected to be treated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our executive officers under the oversight of our Board of Trustees. Our executive officers are senior Blackstone Credit & Insurance professionals and each of the Adviser and Administrator is a subsidiary of Blackstone. As such, we are reliant on Blackstone for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Blackstone has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Blackstone Secured Lending Fund

ticker: BXSL


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data entrusted to it, including by us and the Adviser, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, annual employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.


text: Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology and Center for Internet Security, as guidelines. Further, Blackstone engages in cyber incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Blackstone's Chief Security Officer (the "CSO") and members of Blackstone's senior management, Legal and Compliance, Technology and Innovations ("BXTI"), and Global Corporate Affairs participate in these exercises. Learnings from these tabletop exercises and any events Blackstone experiences are reviewed, discussed, and incorporated into its cybersecurity framework as appropriate. In addition to Blackstone's internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to analyze data on the interactions of users of Blackstone information technology resources, including Blackstone employees, and conduct penetration tests and scanning exercises to assess the performance of Blackstone's cybersecurity systems and processes.


text: Blackstone has a comprehensive Security Incident Response Plan (the "IRP") designed to inform the proper escalation (including, as appropriate, to our senior management) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a Security Incident Response Team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually by Blackstone's CSO and members of BXTI and Blackstone's Legal and Compliance.


text: Blackstone maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to track cybersecurity risks at the firm, and integrates these processes into the firm's overall risk management practices described above. Blackstone's CSO periodically discusses and reviews cybersecurity risks and related mitigants with its enterprise risk committee and incorporates relevant cybersecurity risk updates and metrics in the semi-annual enterprise-wide risk management report.


text: Blackstone has a process designed to assess, the cybersecurity risks associated with the engagement of third-party vendors, including those of companies externally managed by Blackstone such as us. This assessment is conducted on the basis of, among other factors, the types of services provided, and the extent and type of Blackstone data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Blackstone may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Blackstone also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data.


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Blackstone in managing these risks, see "Item 1A. Risk Factors – Risk Related to our Business – Cybersecurity and data protection risks could result in the loss of data, interruptions in our business, and damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations."


text: Cybersecurity Governance Blackstone has a dedicated cybersecurity team, led by Blackstone's CSO, who works closely with Blackstone senior management, including Blackstone's Chief Technology Officer ("CTO"), to develop and advance the firm's cybersecurity strategy, which applies to us and the Adviser.


text: Blackstone's CSO and CTO have extensive experience in cybersecurity and technology, respectively. Blackstone's CSO, Adam Fletcher, is a Senior Managing Director in BXTI and is responsible for all aspects of cyber and physical security across Blackstone. Prior to his appointment as CSO in 2017, Mr. Fletcher was Blackstone's Deputy CSO. Before joining Blackstone in 2014, Mr. Fletcher led the International Security organization for Equifax from 2012 to 2014. Mr. Fletcher received a BS in Operations Research and Industrial Engineering from Cornell University.


text: Blackstone's CTO, John Stecher is a Senior Managing Director and head of BXTI. Mr. Stecher is responsible for all aspects of technology across Blackstone. Mr. Stecher also advises Blackstone's investment teams and acts as a resource to Blackstone portfolio companies, and companies externally managed by Blackstone such as us, on technology-related matters. Before joining Blackstone in 2020, Mr. Stecher was a Managing Director and the Chief Technology Officer and Chief Innovation Officer at Barclays. He was also a member of the Barclays Technology Management Committee. Prior to joining Barclays in 2017, Mr. Stecher held a variety of senior management and engineering roles across Goldman Sachs' capital markets and technology divisions. Mr. Stecher received a BS in Computer Science from the University of Wisconsin – Madison and a MS in Computer Science from the University of Minnesota.


text: BXTI conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The CSO and CTO review Blackstone's cybersecurity framework annually as well as on an event-driven basis as necessary. The CSO and CTO also review the scope of Blackstone's cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Blackstone's information and systems.


text: Our Board of Trustees is responsible for understanding the primary risks to our business. The Board of Trustees is responsible for reviewing periodically our and the Adviser's information technology security controls and related compliance matters, with management. Blackstone's CSO, or designee, reports to the Board of Trustees, or a committee thereof, at least annually on cybersecurity matters, including risks facing us and the Adviser and, as applicable, certain incidents. In addition to such periodic reports, the Board of Trustees or a committee thereof may receive updates from management as to our and the Adviser's cybersecurity risks and Blackstone cybersecurity program developments.


text: Cybersecurity Risk Management and Strategy As an externally managed closed-end management investment company that has elected to be treated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our executive officers under the oversight of our Board. Our executive officers are senior Blackstone Credit & Insurance professionals and each of the Adviser and Administrator is a subsidiary of Blackstone. As such, we are reliant on Blackstone for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Blackstone has provided to us regarding its cybersecurity program that are relevant to us.


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data entrusted to it, including by us and the Adviser, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, new hire and annual employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.


text: Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology and Center for Internet Security, as guidelines. Further, Blackstone engages in cybersecurity incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cybersecurity incident response processes. Blackstone's Chief Security Officer (the "CSO") and members of Blackstone's senior management, Legal and Compliance, Technology and Innovations ("BXTI") and Global Corporate Affairs participate in these exercises. Learnings from these tabletop exercises and any events Blackstone experiences are reviewed, discussed, and incorporated into its cybersecurity incident response processes, as appropriate. In addition to Blackstone's internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to analyze data on the interactions of users of Blackstone information technology resources, including Blackstone employees, and conduct penetration tests and scanning exercises to assess the performance of Blackstone's cybersecurity systems and processes.


text: Blackstone has a comprehensive Security Incident Response Plan (the "IRP") designed to inform the proper escalation (including, as appropriate, to our senior management) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a Security Incident Response Team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually by members of BXTI and Blackstone's Legal and Compliance.


text: Blackstone maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to identify, track and treat cybersecurity risks at the firm, and integrates these processes into the firm's overall risk management practices described above. Blackstone's CSO periodically discusses and reviews cybersecurity risks and related mitigants with its enterprise risk committee and incorporates relevant cybersecurity risk updates and metrics in the semi-annual enterprise-wide risk management report.


text: Blackstone has a process designed to assess, the cybersecurity risks associated with the engagement of third-party vendors, including those of companies externally managed by Blackstone such as us. This assessment is conducted on the basis of, among other factors, the types of services provided, and the extent and type of Blackstone data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Blackstone may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing its requirements and industry best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Blackstone also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data.


text: Cybersecurity Governance Blackstone has a dedicated cybersecurity team, led by Blackstone's CSO, who works closely with Blackstone senior management, including Blackstone's Chief Technology Officer ("CTO"), to develop and advance the firm's cybersecurity program and strategy, which applies to us and the Adviser.


text: Blackstone's CSO and CTO have extensive experience in cybersecurity and technology, respectively. Blackstone's CSO is a Senior Managing Director in BXTI and is responsible for all aspects of cyber and physical security across Blackstone. He has over 25 years of information security, technology and engineering experience, including having previously led the international security organization at a large credit bureau.


text: Blackstone's CTO is a Senior Managing Director and the head of BXTI. The CTO has over 23 years of information security, technology and engineering experience, including having previously served as the Chief Technology and Chief Innovation Officer at a large financial institution. Blackstone's CTO is responsible for all aspects of technology across Blackstone, advises Blackstone's investment teams and acts as a resource to Blackstone portfolio companies, and companies externally managed by Blackstone such as us, on technology-related matters.


text: BXTI conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The CSO and CTO are responsible for the review of Blackstone's cybersecurity framework annually as well as on an event-driven basis as necessary. The CSO and CTO also review the scope of Blackstone's cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Blackstone's information and systems.


text: Our Board is responsible for understanding the primary risks to our business. The Board is responsible for reviewing periodically our and the Adviser's information technology security controls and related compliance matters, with management. Blackstone's CSO, or designee, reports to the Board, or a committee thereof, at least annually on cybersecurity matters, including risks facing us and the Adviser and, as applicable, certain incidents. In addition to such periodic reports, the Board or a committee thereof may receive updates from management as to our and the Adviser's cybersecurity risks and Blackstone cybersecurity program developments.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our customers and employees ("Information Systems and Data").

companyName: Arlo Technologies, Inc.

ticker: ARLO


text: Our Chief Information Officer, Vice President of Cybersecurity and Information Security, Engineering, Legal, Risk Management teams, together with our third-party service providers, help identify, assess and manage our cybersecurity threats and risks, including through the use of our cybersecurity risk assessment program. In doing so, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example automated and manual tools, third party threat assessments and intelligence feeds, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our and the industry's risk profile, evaluating reported threats, coordinating with law enforcement relating to threats, performing internal and external audits, conducting threat assessments for internal and external threats, conducting vulnerability assessments to identify vulnerabilities, and conducting red/blue team testing and tabletop incident response exercises jointly with external third parties.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan and policy, incident detection and response, vulnerability management policy, disaster recovery and business continuity plans, risk assessments, implementation of security standards and certifications, encryption of data, network security controls, access controls, physical security, asset management, tracking and disposal, systems monitoring, penetration testing, dedicated cybersecurity staff, vendor risk management program, and employee training. In addition, we maintain cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register; (2) our information security department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; and (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Board of Directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms (e.g., legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing and dark web monitoring services.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for each vendor, a security questionnaire, a review of the vendor's written security program, a review of security assessments and reports, audits, vulnerability scans related to the vendor, and security assessment calls with the vendor's security personnel. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1, Item 1A Risk Factors in this Annual Report on Form 10-K.


text: Our Cybersecurity and Privacy Committee, at the direction and on behalf of the Board of Directors, addresses our cybersecurity risk management as part of its general oversight function. Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including our Chief Information Officer and Senior Vice President, who has 35 years of Application/Systems experience and our Vice President of Cybersecurity, who has 20 years of Cyber/Network experience.


text: The Chief Information Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. The Chief Information Officer and the Director of Privacy are also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Additionally, the Cybersecurity and Privacy Committee reviews and has oversight over these functions.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Information Security department. Our Chief Information Officer and Vice President of Cybersecurity work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response vulnerability management processes include reporting to the Cybersecurity and Privacy Committee for certain cybersecurity incidents.


text: The Cybersecurity and Privacy Committee receives quarterly reports from the Chief Information Officer concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Cybersecurity and Privacy Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our customers and employees ("Information Systems and Data").


text: Our Chief Technology Officer, Vice President of Cybersecurity and Information Security, as well as Engineering, Legal, Risk Management teams, together with our third-party service providers, help identify, assess and manage our cybersecurity threats and risks, including through the use of our cybersecurity risk assessment program. In doing so, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, automated and manual tools, third party threat assessments and intelligence feeds, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our and the industry's risk profile, evaluating reported threats, performing internal and external audits, conducting assessments for internal and external threats, conducting assessments to identify vulnerabilities, and conducting red/blue team testing and tabletop incident response exercises jointly with external third parties.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, an incident response plan and policy, incident detection and response, vulnerability management policy, disaster recovery and business continuity plans, risk assessments, implementation of security standards and certifications, encryption of data, network security controls, access controls, physical security, asset management, tracking and disposal, systems monitoring, penetration testing, dedicated cybersecurity staff, vendor risk management program, and employee training. In addition, we maintain cybersecurity insurance.


text: We use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms (e.g., legal counsel), threat intelligence service providers, cybersecurity consultants, software providers, managed service providers, penetration testing, and dark web monitoring services.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for each vendor, a security questionnaire, a review of the vendor's written security program, a review of security assessments and reports, audits, security assessment calls with the vendor's security personnel, and the imposition of security-related contractual obligations on vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. For a description of the risks from cybersecurity threats that may materially affect us, see our risk factors under Part 1, Item 1A Risk Factors in this Annual Report on Form 10-K.


text: Our Cybersecurity and Privacy Committee, at the direction of and on behalf of the Board of Directors, addresses our cybersecurity risk management as part of its general oversight function. Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including our Chief Technology Officer, who has 30 years of Engineering/Technology/Security experience and our Vice President of Cybersecurity, who has 24 years of Technology/Infrastructure/Security experience and maintains the Certified Information Security Manager and Certified Information Systems Security Professional certifications.


text: The Chief Technology Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. The Chief Technology Officer and the Director of Privacy are also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Additionally, the Cybersecurity and Privacy Committee reviews and has oversight over these functions.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Information Security department. Our Chief Technology Officer and Vice President of Cybersecurity work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response vulnerability management processes include reporting to the Cybersecurity and Privacy Committee for certain cybersecurity incidents.


text: The Cybersecurity and Privacy Committee receives quarterly reports from the Chief Technology Officer concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Cybersecurity and Privacy Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk management and strategy We take a risk-based approach in implementing and maintaining various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our clinical trials, products in development, and proprietary technologies ("Information Systems and Data").

companyName: Allogene Therapeutics, Inc.

ticker: ALLO


text: Our information security function, supported by members of our IT and Legal departments and our third-party IT service providers, helps identify, assess and manage the Company's cybersecurity threats and risks. This team helps to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: automated tools, subscribing to reports and services that identify cybersecurity threats and analyzing such reports of threats and actors, conducting scans of our threat environment, evaluating threats reported to us, coordinating with law enforcement as appropriate about certain threats, having third parties conduct threat assessments, conducting vulnerability assessments, and working with third parties to conduct certain tests of our environment.


text: Depending on the environment and systems, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response procedures; an incident response policy; a vulnerability management policy; a disaster recovery plan; conducting risk assessments; encrypting certain of our data; maintaining network security controls, segmenting certain data; maintaining access and physical security controls; asset management, tracking, and disposal protocols; systems monitoring; a assessing vendor risk; employee training; penetration testing conducted by third parties; and maintaining cybersecurity insurance.


text: The cybersecurity risk management and mitigation measures we implement for certain of our Information Assets including for example (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management assessment processes; (2) the information security function works with senior management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk, (4) policies and procedures to manage how Information Systems and Data are collected, maintained and stored, (5) communicating with and training personnel on cybersecurity risks and trends.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional services firms, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, contract research organizations (CROs), contract development and manufacturing organizations (CDMOs) and supply chain resources. We assess vendors using a risk-based approach to manage cybersecurity risks associated with our use of certain of these providers. Through these practices, we may conduct risk assessments of vendors, provide and review security questionnaires, review vendors' written information security programs and security assessments, and impose contractual obligations related to information security on our vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our security measures, or those of our CROs, CDMOs, collaborators, contractors, consultants or other third parties upon whom we rely, are or were compromised or the security, confidentiality, integrity or availability of our information technology, software, services, networks, communications or data is compromised, limited or fails, we could experience a material adverse impact."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Members of the Audit Committee receive scheduled updates from senior management.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of IT Security and Executive Director/Head of IT. Our Director of IT Security has over 13 years of experience leading IT security and has certifications including CISSP and CCSP. Our Executive Director IT Data Management, Analytics and Integration has over 20 years of experience in IT, data engineering, and data analytics.


text: Our Director of IT Security is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall IT risk management strategy, communicating key priorities to relevant personnel, overseeing cybersecurity operations, and managing the cybersecurity technologies, processes, and projects. Our Executive Director of IT Data Management, Analytics and Integration is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and conducting regular reviews of security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Director of IT Security, Data Management, Analytics and Integration, and General Counsel. Director of IT Security, Data Management, Analytics and Integration, and General Counsel work with the Company's cross functional incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policies and procedures include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from Data Management, Analytics and Integration and General Counsel concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk management and strategy We take a risk-based approach in implementing and maintaining various information security processes designed to identify, assess and manage material risks from threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our clinical trials, products in development, and proprietary technologies ("Information Systems and Data").


text: The cybersecurity risk management and mitigation measures we implement for certain of our Information Assets including for example (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management assessment processes; (2) the information security function works with senior management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors on at least a quarterly basis, which evaluates our overall enterprise risk, (4) policies and procedures to manage how Information Systems and Data are collected, maintained and stored, (5) communicating with and training personnel on cybersecurity risks and trends.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional services firms, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms. We conduct penetration tests and audits of our Information Systems and Data environment with an external cybersecurity firm at least annually.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats. Members of the Audit Committee receive scheduled quarterly updates from senior management.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of IT Security and Vice President of IT. Our Director of IT Security has over 13 years of experience leading IT security and has certifications including CISSP and CCSP. Our Vice President IT has over 20 years of experience in IT, data engineering, and data analytics.


text: Our Vice President of IT Security is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall IT risk management strategy, communicating key priorities to relevant personnel, overseeing cybersecurity operations, and managing the cybersecurity technologies, processes, and projects. Our Vice President of IT is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and conducting regular reviews of security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Vice President of IT and General Counsel. The Vice President of IT and General Counsel work with the Company's cross functional incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policies and procedures include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: We have policies, procedures, and processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats as well as secure our networks and systems. Such processes include procedural and technical safeguards, response plans, regular vulnerability and penetration tests on our systems and product applications, incident simulations, and routine review of our policies and procedures to identify risks and improve our practices. Our security incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to assess the severity of, escalate, contain, investigate, and remediate incidents as well as to comply with applicable legal obligations. We maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, and other related breaches.

companyName: Replimune Group, Inc.

ticker: REPL


text: We engage certain external parties to enhance our cybersecurity processes and strategies. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, we evaluate the security and risk posture according to the perceived level of risk and in accordance with industry standard best practices.


text: Our audit committee of the Board of Directors provides direct oversight over cybersecurity risk and provides applicable updates to the Board of Directors regarding such oversight. Members of management responsible for data privacy, technology, and information security risks join our audit committee meetings from time to time to discuss these risks, risk management activities, incident response plans, best practices, the effectiveness of our security measures, and other related matters.


text: Our Chief Information Officer, who reports to our Chief Financial Officer, leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Specific cybersecurity related responsibilities include overseeing our processes and strategies for the detection, mitigation, and remediation of cybersecurity incidents. Our Chief Information Officer has extensive experience assessing and managing cybersecurity and risk programs having served in relevant positions of increasing responsibility for over 25 years at several private and public companies.


text: In an effort to deter and detect cyber threats, we provide all employees with routine response and prevention training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security, and educates employees on the importance of reporting all incidents promptly. We also use technology-based tools to mitigate cybersecurity threats and risks and to bolster our employee-based cybersecurity programs.


text: Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks.


text: We have policies, procedures, and processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall risk management program. Such policies, procedures, and processes are designed to help protect our information assets and operations from internal and external cyber threats as well as secure our networks and systems. Such processes include procedural and technical safeguards, response plans, regular vulnerability and penetration tests on our systems and product applications, incident simulations, and routine review of our policies and procedures to identify risks and improve our practices. Our security incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to assess the severity of, escalate, contain, investigate, and remediate incidents as well as to comply with applicable legal obligations. We maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, and other related breaches.


text: We engage certain external parties, including cybersecurity assessors, consultants and auditors, to enhance our cybersecurity processes and strategies. In addition, depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, we evaluate the security and risk posture with respect to our third party service providers according to the perceived level of risk and in accordance based on industry standard best practices.


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could materially affect us. See Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks.


text: Risk Management and Strategy IT plays a crucial role in all of our operations. To remain competitive, our hardware, software and related services must properly and efficiently interact with our suppliers' and customers' products, services and technology, record and process our financial transactions accurately, and obtain accurate and timely data and information to enable our analysis of trends and plans and the execution of our strategies. Accordingly, KLX maintains a cybersecurity risk program led by our internal IT department and strategic vendors designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. These processes are integrated into the Company's overall enterprise risk assessment. Our cybersecurity risk program references industry-standard frameworks and incorporates policies and practices designed to protect the privacy and security of our sensitive information.

companyName: KLX Energy Services Holdings, Inc.

ticker: KLXE


text: We perform technical assessments with feedback incorporated into our systems and procedures through continual upgrades intended to further improve our cybersecurity posture.


text: We continue to evaluate internal systems, processes, and controls to identify potential cybersecurity vulnerabilities and mitigate potential loss from cyber-attacks. We have implemented a monitoring and detection system to help identify cybersecurity incidents. All incidents are escalated to our cybersecurity committee, which includes Vice President of IT, Chief Financial Officer, Chief Compliance Officer/General Counsel and other senior management. We also require our employees to receive annual cybersecurity awareness training. We perform cybersecurity tabletop exercises and implement post-incident "lessons learned" to enhance our response. We provide our system users with access consistent with the principle of least privilege, which requires that such users be given no more access than necessary to complete their job functions. We have also implemented a multi-factor authentication process for employees accessing company information.


text: We engage third-party service providers in connection with our cybersecurity risk program, including assessors, consultants, and auditors. We recognize that third-party service providers introduce cybersecurity risks. In an effort to mitigate these risks, we include security and privacy addendums to our contracts where applicable.


text: Impacts from Cybersecurity Threats As of the date of this report, the Company and our service providers have been subject to certain cybersecurity incidents (including phishing attempts). We are not aware of any prior cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems could have significant consequences to the business. See "Risk Factors" in Item 1A of Part I for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Our Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to our audit committee oversight of cybersecurity and other information security risks. Our audit committee oversees management's activities related to our cybersecurity risk program. Our cybersecurity committee, which includes Vice President of IT, Chief Financial Officer, Chief Compliance Officer/General Counsel and other senior management, reports to the audit committee on a quarterly basis regarding information security and cybersecurity matters, including cybersecurity risks, or as needed.


text: Our Vice President of IT leads our IT department, which is responsible for assessing, identifying, and managing risks from cybersecurity threats. Our Vice President of IT reports to the Company's Chief Financial Officer, including with respect to emerging cybersecurity incidents. To facilitate effective oversight, our Vice President of IT holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks. Our VP of IT has over thirty years of IT background in a variety of industries, with experience developing security frameworks, training on cyber security best practices, and emergency response and remediation.


text: Our Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to our audit committee oversight of cybersecurity and other information security risks. Our audit committee oversees management's activities related to our cybersecurity risk program. Our cybersecurity committee, which includes Vice President of IT, Chief Financial Officer, Chief Compliance Officer/General Counsel and other senior management, reports to the audit committee on a quarterly basis regarding information security and cybersecurity matters, including cybersecurity risks, or as needed, and the audit committee reports to the Board.


text: Our IT department is made up of experienced professionals with an extensive background in information security, risk management and incident response. Our Vice President of IT leads our IT department, which is responsible for assessing, identifying, and managing risks from cybersecurity threats. Our Vice President of IT reports to the Company's Chief Financial Officer, including with respect to emerging cybersecurity incidents. To facilitate effective oversight, our Vice President of IT holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks.


text: Our Vice President of IT has over thirty years of IT background in a variety of industries, with experience developing security frameworks, training on cyber security best practices, and emergency response and remediation.


text: Our business relies on information technology (IT) systems to process, transmit and store electronic information, including customer, employee and company data. The secure processing, maintenance and transmission of this information, including information housed both within an internal IT system or with a third-party and cloud-based environments, is critical to our operations. Each of the systems utilized in our business operations is subject to continually evolving cybersecurity risks and threats that present a risk to the continuity of our business operations, potential financial losses and damage to our reputation, including a loss of public trust. For more information on potential risks related to cybersecurity threats and incidents, please see "Item 1A. Risk Factors – Breaches of our information technology systems or improper disclosure of confidential company or personal data, or a failure to comply with privacy laws, regulations and our contractual obligations concerning data privacy or the security of certain information, could have a material adverse effect on our reputation and operations."

companyName: Elanco Animal Health Inc

ticker: ELAN


text: Risk Management, Strategy and Governance Given the importance of the integrity and security of the information and data utilized in our day-to-day operations, our processes for assessing, identifying and managing material risks from cybersecurity threats is incorporated into our overall enterprise risk management framework. We evaluate cybersecurity risks on an ongoing basis, and both our executive management and Board of Directors have an overall responsibility for assessing and managing risks from cybersecurity threats. We have established an information security team which is structured into three areas, each with its own teams and leaders who report directly to our Chief Information Security Officer (CISO): 1) Governance, Risk and Compliance; 2) Architecture; and 3) Operations (Detect and Respond). Our information security team is responsible for the design and execution of our cybersecurity risk management and helps executive management and our Board of Directors stay informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity risks and incidents through various means, including but not limited to, briefings with internal security team members, threat intelligence obtained from public and private sources and alerts and reports produced by security tools deployed within our IT environment. Our current CISO has over 16 years of experience in various roles involving information technology governance and compliance, including cybersecurity, engineering and enterprise architecture, while our Chief Information Officer (CIO) has over 25 years of IT and cybersecurity experience. Our information security team includes professionals with relevant industry, educational and cybersecurity experience.


text: Governance, Risk and Compliance: Our approach to cybersecurity governance, risk and compliance is based on overarching guidelines, standards and best practices developed by the U.S. National Institute of Standards and Technology (NIST), a department of the U.S. Department of Commerce. Our information security governance oversees the process of coordinating the cybersecurity team(s) responsible for the mitigating of business risks posed by IT-related resources. Our governance framework of authority and accountability ensures prioritized initiatives have the required structure, sponsorship and funding to appropriately address the foreseen risks. Risk management includes an assessment of the risks posed to us by an IT solution, including cloud hosted and/or other third-party environments and systems. Our processes also address cybersecurity risks associated with our use of third-party service providers, including those in our supply chain or who have access to our client or employee data on our systems. In addition, cybersecurity considerations affect the selection and oversight of third-party service providers. We perform diligence on third parties, particularly those that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.


text: Our risk management process assesses both the probable frequency and probable magnitude of future loss based on a variety of potential risks and cyber events. The information security team also periodically engages third-party vendors to assist with our cyber threat detection and response actions, as well as to ensure our processes related to information security and defense against cybersecurity threats are appropriately designed and implemented to best prevent, detect and/or respond to a cyber threat or event.


text: Architecture: Our information security architecture is focused on designing IT-related solutions that are foundationally secure. Our information security architecture assumes that internal and external threats always exist, and that all networks are inherently hostile. Accordingly, all connections accessing business assets must first be authenticated and authorized. Where viable, IT services are individually secured and monitored at the source, following the principle of least privilege.


text: Operations (Detect and Respond): In the event of a cybersecurity incident, the Elanco Information Security Incident Response Plan (ISIRP) defines the roles, responsibilities, procedures and reporting processes required to respond effectively to cybersecurity incidents. Responses to information security incidents are led by two teams: 1) the Security Operations Center (SOC) team, which conducts the initial technical triage and analysis, and 2) a cross-functional team of leaders from the IT, Legal, Human Resources and Finance functions (the Cyber Lead team), which is engaged by the CISO on an as needed basis, based on incident severity. The Cyber Lead team is tasked with determining the severity of a cybersecurity incident and bringing together the proper resources to lead the corporate-wide response to such incidents, including engaging the Company's Disclosure Committee, in the event an incident may rise to a level deemed material to us. In the event an incident is escalated by the Cyber Lead team, the Disclosure Committee, led by our Chief Financial Officer and General Counsel, would evaluate all estimable quantitative and qualitative factors, to determine if a Current Report on Form 8-K would be required under Item 1.05, "Material Cybersecurity Incidents".


text: Management's Responsibilities Management is responsible for executing the Cybersecurity Risk Management, Strategy and Governance policies outlined above. This is done, in part, by both establishing systems, processes and controls to minimize the risk of a high severity cybersecurity incident as much as possible, as well as ensuring there is a formal process designed to identify, investigate and appropriately respond to potential cybersecurity incidents. As noted, we have established our ISIRP as a response tool in the event of a cybersecurity incident. The ISIRP documents the actionable steps the SOC team, information security leadership and cross-functional stakeholders and partners take when a cybersecurity incident is identified. The ISIRP covers the preparation, detection and analysis, containment, eradication, recovery and post-incident activities required to effectively respond to an incident.


text: Once a cybersecurity incident has been identified, the SOC team performs an initial investigation to determine if the incident is deemed high or low severity, based upon the business and operational impacts. Any incident deemed high severity would result in notification by the CISO to the Cyber Lead team to determine the appropriate actions to be taken. This determination would be made by the Cyber Lead team based on both qualitative and quantitative factors regarding the extent and magnitude of the incident. If the incident is then escalated to the Disclosure Committee and determined to be material, a disclosure via a Current Report on Form 8-K would be made within four business days of the incident being identified as such. Through December 31, 2023, there have been no cybersecurity incidents deemed to have had a material impact on our results of operations or financial condition. Our Board of Directors would also be notified of any high severity incidents that are determined to be material, concurrently with the notification to the Disclosure Committee, and would be kept apprised of actions taken in response to such incidents.


text: Our information security team is also responsible for cybersecurity awareness and education across the company, including our Board of Directors. Awareness empowers users, including our employees and contractors, to be mindful of cybersecurity in day-to-day situations. Our cybersecurity education practices help ensure specific users have the appropriate security skills and competencies to help prevent and/or detect and respond to a cyber threat. Formal training is delivered and measured throughout our organization on a routine, ongoing basis, and dedicated training is delivered to all new employees and contractors through our onboarding process. Targeted and company-wide communications, as well as simulated phishing campaigns and tabletop exercises are also routinely executed to promote ongoing awareness, preparation and education about cyber threats.


text: Board of Directors' Responsibilities Our Board of Directors actively oversees our cybersecurity management processes, including appropriate risk mitigation strategies, systems, processes and controls. Our CISO meets with the Audit Committee of the Board of Directors and separately with the full Board of Directors at least twice annually to discuss the status of policies and procedures related to information security. Discussions with the Audit Committee and the full Board of Directors focus on any notable incidents and incident responses, updates on known or perceived cyber threats and the information security team's recent actions taken in response to such incidents and threats. In addition, our Board of Directors and the Audit Committee also receive updates from the CISO and/or our CIO on an ad-hoc or as-requested basis. Any incidents or changes to our process of identifying and responding to potential cybersecurity incidents would be included within these materials. According to our ISIRP, our Board of Directors would also be notified of any high severity incidents deemed material, simultaneously with the notification to the Disclosure Committee, and would be kept apprised of actions taken in response to such incidents.


text: Our business relies on IT systems to process, transmit and store electronic information, including customer, employee and company data. The secure processing, maintenance and transmission of this information, including information housed both within an internal IT system or with a third-party and cloud-based environments, is critical to our operations. Each of the systems utilized in our business operations is subject to continually evolving cybersecurity risks and threats that present a risk to the continuity of our business operations, potential financial losses and damage to our reputation, including a loss of public trust.


text: Risk Management, Strategy and Governance Given the importance of the integrity and security of the information and data utilized in our day-to-day operations, our processes for assessing, identifying and managing material risks from cybersecurity threats is incorporated into our overall enterprise risk management framework. We evaluate cybersecurity risks on an ongoing basis, and both our executive management and Board of Directors have an overall responsibility for assessing and managing risks from cybersecurity threats. We have established an information security team which is structured into three areas, that all report directly to our Chief Information Security Officer (CISO): 1) Governance, Risk and Compliance; 2) Architecture; and 3) Operations (Detect and Respond). Our information security team is responsible for the design and execution of our cybersecurity risk management and helps executive management and our Board of Directors stay informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity risks and incidents through various means, including but not limited to, briefings with internal security team members, threat intelligence obtained from public and private sources and alerts and reports produced by security tools deployed within our IT environment. Our current CISO, who reports directly to our Chief Information Officer (CIO), has over 17 years of experience in various roles involving information technology governance and compliance, including cybersecurity, engineering and enterprise architecture, while our CIO has over 25 years of IT and cybersecurity experience. Our information security team includes professionals with relevant industry, educational and cybersecurity experience.


text: Operations (Detect and Respond): In the event of a cybersecurity incident, the Elanco Information Security Incident Response Plan (ISIRP) defines the roles, responsibilities, procedures and reporting processes required to respond effectively to cybersecurity incidents. Responses to information security incidents are led by two teams: 1) the Security Operations Center (SOC) team, which conducts the initial technical triage and analysis, and 2) a cross-functional team of leaders from the IT, Legal, Human Resources and Finance functions (the Cyber Lead team), which is engaged by the CISO on an as needed basis, based on incident severity. The Cyber Lead team is tasked with confirming the severity of a cybersecurity incident and bringing together the proper resources to lead the corporate-wide response to such incidents, including engaging the Company's Disclosure Committee, in the event an incident may rise to a level deemed material to us. In the event an incident is escalated by the Cyber Lead team, the Disclosure Committee, led by our Chief Financial Officer and General Counsel, would evaluate all estimable quantitative and qualitative factors, to determine if a Current Report on Form 8-K would be required under Item 1.05, "Material Cybersecurity Incidents."


text: For the year ended December 31, 2024, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For more information on potential risks related to cybersecurity threats and incidents, please see "Item 1A. Risk Factors – Breaches of our IT systems or improper disclosure of confidential company or personal data, or a failure to comply with privacy laws, regulations and our contractual obligations concerning data privacy or the security of certain information, could have a material adverse effect on our reputation and operations."


text: Once a cybersecurity incident has been identified, the SOC team performs an initial investigation to determine if the incident is deemed high or low severity, based upon the business and operational impacts. Any incident deemed high severity would result in notification by the CISO to the Cyber Lead team to determine the appropriate actions to be taken. This determination would be made by the Cyber Lead team based on both qualitative and quantitative factors regarding the extent and magnitude of the incident. If the incident is then escalated to the Disclosure Committee and determined to be material, a disclosure via a Current Report on Form 8-K would be made within four business days of the incident being identified as such. Our Board of Directors would also be notified of any high severity incidents that are determined to be material, concurrently with the notification to the Disclosure Committee, and would be kept apprised of actions taken in response to such incidents.


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program that is designed to identify, assess and manage material risks from cybersecurity threats and to protect the security, confidentiality, integrity, and availability of our critical systems and information. Our information security program is developed using industry standards and best practices as a guide, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The program includes penetration tests and periodic vulnerability scans, and evaluations by external service providers. The results of these evaluations are shared with senior management and the audit committee of the board of directors, where appropriate.

companyName: Rallybio Corp

ticker: RLYB


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management processes and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management processes to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, product candidates and our broader enterprise IT environment. • A team principally responsible for managing: (a) our cybersecurity risk assessment processes, (b) our security controls, and (c) our response to cybersecurity incidents. • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls as part of our operational security model. • Threat intelligence that informs our third party IT service provider and us about new vulnerabilities and risks that require timely intervention or remediation. • Cybersecurity awareness training of our employees, incident response personnel, and senior management. • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: resulted in a material effect on our business strategy, results of operations, or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents.


text: The audit committee of our board of directors has primary responsibility for oversight of our information security program. Our cyber security program is managed by our third party IT service provider together with internal personnel. Our service provider and internal personnel work together to assess the environment, potential threats and responses.


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, product candidates and our broader enterprise information technology ("IT") environment. • A team principally responsible for managing: (a) our cybersecurity risk assessment processes, (b) our security controls, and (c) our response to cybersecurity incidents. • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls as part of our operational security model. • Threat intelligence that informs our third party IT service provider and us about new vulnerabilities and risks that require timely intervention or remediation. • Cybersecurity awareness training of our employees, incident response personnel, and senior management. • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: Managing Material Risks & Integrated Overall Risk Management Arcosa has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. Arcosa's Chief Information Security Officer ("CIO") and Director of Information Security work closely with the IT department to continuously evaluate and address cybersecurity risks in alignment with business objectives, operational needs, and industry-accepted standards, such as the CIS Critical Security Controls and National Institute of Standards and Technology ("NIST") frameworks.

companyName: Arcosa, Inc.

ticker: ACA


text: The Company has processes and procedures in place to monitor the prevention, detection, mitigation, and remediation of cybersecurity risks. These include but are not limited to: • Maintaining a defined and practiced incident response plan; • Maintaining cyber insurance coverage; • Employing appropriate incident prevention and detection software, such as antivirus, anti-malware, firewall, endpoint detection, and identity and access management; • Maintaining a defined disaster recovery policy and employing backup/disaster recovery software, where appropriate; • Educating, training, and testing employees on information security practices and identification of potential cybersecurity risks and threats; • Ensuring familiarity and compliance with cybersecurity frameworks where appropriate; and • Reviewing and evaluating new developments in the cyber threat landscape.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, the Company engages with a range of external experts, including cybersecurity consultants, in evaluating, monitoring, and testing Arcosa's cyber management systems and related cyber risks. The Company's collaboration with these third parties includes audits, threat and vulnerability assessments, incident response plan testing, company-wide monitoring of cybersecurity risks, and consultation on security enhancements.


text: Managing Third Party Risk Arcosa recognizes the risks associated with the use of vendors, service providers, and other third parties that provide information system services, process information on its behalf, or have access to its information systems, and Arcosa has processes in place to oversee and manage these risks. In addition to the minimum security and control standards, these processes include other quality control measures, such as utilizing a third-party security scoring system to evaluate the security posture of current and potential parties. Arcosa also maintains ongoing monitoring to support continuous compliance with its cybersecurity standards.


text: Risks from Cybersecurity Incidents Arcosa has not been subject to cybersecurity incidents that have materially affected, or are reasonably likely to materially affect the Company, its operations, or financial standing.


text: Risk Management Personnel Arcosa's cybersecurity risk management program is overseen by management at multiple levels. The CIO and Director of Information Security play key roles in assessing, monitoring, and managing the Company's cybersecurity risks with support of dedicated information technology and security personnel. Both the CIO and Director of Information Security have been in their respective roles at Arcosa for 5 years. The CIO has over 40 years of leadership positions in the high tech and IT industries. He is experienced in detailed product and solution development as well as business process operations providing an understanding of how cybersecurity considerations intersect the business. The Director of Information Security and Compliance at Arcosa has more than 20 years of experience architecting, designing, and deploying security solutions based on industrial frameworks.


text: Monitor Cybersecurity Incidents The CIO and Director of Information Security are continually informed and updated about the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. They implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Board of Director Oversight The Audit Committee of the Company's Board of Directors is responsible for overseeing the Company's cyber risk. The CIO and other experts, as necessary provide the Audit Committee quarterly updates that encompass a broad range of topics, including but not limited to: • Current cybersecurity threat landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from unique cybersecurity events, including those of other companies; • Compliance status and efforts with regulatory requirements and industry standards; and • Benchmarked data on the performance of certain aspects of our cybersecurity program relative to our peers.