text: Morgan Stanley and Company Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Risk, is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company. Those processes are periodically tested through tabletop exercises.


text: The Chief Compliance Officer ("CCO") of the Company is responsible for overseeing the Company's risk management function and generally and relies on the CIO, CISO, and Head of Operational Risk to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of Operational Risk has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies. The Company's CCO has worked in the financial services industry for 19 years and has covered business developments from a compliance perspective for over 10 years, during which time the Company's CCO has gained expertise in assessing and managing risk applicable to the Company.

companyName: North Haven Private Income Fund LLC

secItem: Item 1C


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of Operational Risk report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our Board.


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO, the CISO, and the Head of Operational Risk, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2023, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Risk management and strategy The Company and the broader financial services industry face an increasingly complex and evolving threat environment.


text: Morgan Stanley has made and continues to make substantial investments in cybersecurity and fraud prevention technology, and employ experienced talent to lead its Cybersecurity and Information Security organizations and program under the oversight of Morgan Stanley's Board of Directors (the "MS Board") and the Operations and Technology Committee of the MS Board ("BOTC").


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify, and manage risks arising from the cybersecurity threats confronting the Firm ("Cybersecurity Program"). Morgan Stanley's Cybersecurity Program helps protect the Firm's clients, customers, employees, property, products, services, and reputation by seeking to preserve the confidentiality, integrity, and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems, including as applicable to the Company and its unitholders. Morgan Stanley continually adjusts its Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.


text: The Adviser and the Administrator manage the Company's day-to-day operations, and the Company uses the Cybersecurity Program to assess, identify and manage material cybersecurity risks affecting the Company and its operations. The Company's business is dependent on the communications and information systems of Morgan Stanley, including but not limited to the Cybersecurity Program, and other third-party service providers.


text: Processes for assessing, identifying, and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and unitholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley cyber threat detection team, which develops and implements strategies designed to defend against these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Morgan Stanley's vulnerability management team, as well as Morgan Stanley's Non-Financial Risk function ("NFR") review external cybersecurity incidents that may be relevant to the Firm and the Company, to further inform the design of the Cybersecurity Program. To assess the efficacy of Morgan Stanley's controls and defenses designed to mitigate cybersecurity risk, it utilizes internal and external testing, including penetration testing and red team engagements. The results of these assessments are used to strengthen the Cybersecurity Program. Additionally, Morgan Stanley maintains a global training program covering cybersecurity risks and requirements, including heightened security training to specialized employees, and conducts regular phishing email simulations for its employees and consultants as preventative measures.


text: When a threat is identified in Morgan Stanley's environment, its incident response team follows an incident response plan to evaluate the impact to the Firm and coordinate appropriate remediation. If warranted, the cybersecurity incident will be reported to applicable regulators, authorities, impacted clients or counterparties, as appropriate. The Firm's cybersecurity incident response and remediation processes, including assessing materiality and reporting requirements, are reviewed through tabletop exercises.


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to the Firm or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity program to identify the impact of their services on the cybersecurity risks to the Firm or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or a Firm audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's minimum cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, key elements of the Cybersecurity Program are subject to review by an independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley and Company Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Cyber, Technology, and Information Security Non-Financial Risk ("Head of NFR CTIS"), is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company.


text: The Chief Compliance Officer ("CCO") of the Company is responsible for overseeing the Company's risk management function and generally relies on the CIO, CISO, and Head of NFR CTIS to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of NFR CTIS has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies. The Company's CCO has worked in the financial services industry for 19 years and has covered business developments from a compliance perspective for over 10 years, during which time the Company's CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of NFR CTIS report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our Board.


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO, CISO, and Operational Risk functions, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Material cybersecurity risks are addressed by Morgan Stanley management-level ERM committees with escalation to the BOTC and Board, as appropriate. The BOTC has primary responsibility for assisting the Morgan Stanley board in its oversight of significant operational risk exposures of the Firm and its business units, including IT, information security, fraud, third-party oversight, business disruption and resilience, and cybersecurity risks (including review of cybersecurity risks against established risk management methodologies) and the steps management has taken to monitor and control such exposures.


text: In accordance with its charter, the BOTC receives quarterly reports from (i) Technology, including the CIO or the CISO; (ii) Operations; and (iii) NFR. Such reporting includes updates on Morgan Stanley's Cybersecurity Program, risks from cybersecurity threats, our programs to address and mitigate the risks associated with the evolving cybersecurity threat environment, and NFR's assessment of cybersecurity risks. Senior officers in Technology and NFR also provide an annual report to the BOTC on the status of Morgan Stanley's broader information security program in compliance with the Gramm-Leach-Bliley Act, which includes a discussion of risks arising from cybersecurity threats. At least annually, senior management representatives in Technology and NFR discuss the status of the Cybersecurity Program and key cybersecurity risks with the Morgan Stanley board and, in accordance with such board's Corporate Governance Policies, all board members are invited to attend BOTC meetings and have access to meeting materials. The BOTC, which meets at least quarterly, also reviews and approves significant policies related to cybersecurity, receives an annual independent assessment of key aspects of Morgan Stanley's Cybersecurity Program from an independent third party and holds joint meetings with the BAC and BRC, as necessary and appropriate. The chair of the BOTC regularly discusses cybersecurity developments with senior Morgan Stanley management and reports to the Morgan Stanley board on cybersecurity risks and threats and other related matters.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2024, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Risk management and strategy Nextracker places emphasis on addressing cybersecurity threats and effectively managing associated risks. Our cybersecurity program is designed to identify, assess, and proactively manage material risks.

companyName: Nextpower Inc.

ticker: NXT


text: Our approach to cybersecurity is not a one-time effort but an ongoing process. We engage in monitoring, risk assessments, and robust security measures designed to ensure the confidentiality, integrity, and availability of our information systems, including critical computer networks, hosted services, communication systems, hardware, and software and to protect critical data, including our employees' and customers' data, intellectual property, confidential and proprietary data, and strategic competitive information. We address cybersecurity challenges and enhance our overall risk management efforts by adopting and working to integrate recognized best practices, standards, and controls such as the CIS 18 Critical Security Controls and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).


text: Our cybersecurity program includes some key aspects such as (i) a Cybersecurity Leader who oversees our day-to-day program and who is a long-standing member of both the ISC2 and ISACA organizations, which specialize in cybersecurity and governance, (ii) a cybersecurity council comprised of a cross-section of management with oversight over our program, (iii) incident response, and (iv) ongoing security awareness training.


text: At Nextracker, we maintain a practical approach to cybersecurity. Our cybersecurity risk management program (an integral part of our overall Enterprise Risk Management Program) is designed to incorporate established best practices and industry standards, drawing guidance from both CIS 18 and NIST CSF. Within our program, we conduct internal and external security-based activities, including reviews and assessments of our third-party service providers and vendors. 1.Information Security Assessments: We collaborate with internal and external partners to evaluate our security. 2.Vulnerability Scanning and Penetration Testing: Engaging third-party service providers to assess external and internal vulnerabilities and potential threats. 3.Cyber Risk Register Reviews: Regularly review our internal risk register to stay vigilant against potential and identified risks. 4.Risk Prioritization: We prioritize and address risks through our dedicated cybersecurity risk management program and the cybersecurity council.


text: We monitor the threat environment for potential risks, employing various methods, including automated detection tools, environment scans, and investigations of potential threats and reports. We also use threat intelligence feeds and vulnerability databases to monitor our systems, and have incident response processes designed to ensure swift action.


text: As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably expected to materially affect our business. However, we acknowledge the evolving nature of cybersecurity threats and remain committed to enhancing our protective measures as needed. For more detailed information about our company's specific cybersecurity risks, please refer to the risk factor titled "Cybersecurity or other data security incidents could harm our business, expose us to liability and cause reputational damage" in Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: Our Board of Directors has oversight responsibility for our overall enterprise risk management, and has delegated cybersecurity risk management oversight to the Audit Committee of our Board of Directors. The Audit Committee of our Board of Directors is responsible for reviewing internal risk assessments with respect to cybersecurity, including assessments of the overall threat landscape and related strategies and investments.


text: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Cybersecurity Leader. Our Cybersecurity Leader reports regularly to the cybersecurity council, management and the Audit Committee concerning our significant cybersecurity threats and risks, the processes we have implemented to address them, and various reports, summaries, or presentations on cybersecurity threats, risks, and mitigation. The Audit Committee also reports to our Board of Directors on cybersecurity matters as needed.


text: We believe that cybersecurity is fundamental to how we operate and as such we focus on defining and managing our cybersecurity risk. With the ever-changing cybersecurity landscape and continual emergence of new threats, our Board of Directors, Audit Committee and senior management team ensure that significant resources are devoted to cybersecurity risk management and the technologies, processes and people that support it. We have an Enterprise Risk Management Committee, comprising senior leaders from key functions, and a Cybersecurity Risk Committee which utilize the National Institute of Standards and Technology ("NIST") framework to ensure that these risks are clearly and effectively categorized and treated.

companyName: GXO Logistics, Inc.

ticker: GXO


text: We utilize comprehensive and widespread information sources and services (including third-party threat intelligence) to understand the threat landscape faced by the Company and design our protective controls accordingly using a defense-in-depth approach. The layers of these defenses are aligned to the NIST framework; Identify, Protect, Detect, Respond and Recover. The Enterprise Risk Management Committee and Cybersecurity Risk Management Committee meet regularly to consider any change to risk levels and ensure that the Company's cybersecurity controls remain commensurate to those risk levels.


text: The Company's Chief Information Security Officer ("CISO") is responsible for developing and implementing our cybersecurity program and reporting on related matters to our Board of Directors. The CISO has over a decade of experience leading cybersecurity functions and over two decades in cybersecurity. The CISO leads a global team of highly trained experts covering all major cybersecurity functions including Technical Engineering and Architecture, Governance Risk and Compliance, Security Operations and Incident Response, Threat and Vulnerability Management and Security Awareness. The technologies, policies and processes associated with these functions are tested by third parties at least annually to ensure continued effectiveness and identify any opportunities for improvement. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors and intellectual property.


text: A full suite of cybersecurity policies exists and is applicable to all employees globally. These policies are reviewed annually and approved by relevant senior leaders. All Company employees are required to complete cybersecurity training annually, with quarterly "refreshers" throughout the year.


text: We invest in our cybersecurity defenses and have implemented multiple layers of protection against all known critical threats. We have high levels of compliance to protective controls on our technical estate, robust perimeter defenses, industry-leading filtering and analysis of web and email traffic, widespread multi-factor authentication, continuous training of our employees through educational material or simulation (e.g., phishing) and 24/7 monitoring of the IT estate. We have our own "red team" that is always searching our own environment for signs of vulnerability and have a well-defined Cyber Incident Response Plan ("CIRP") that is performed as a table-top exercise at least annually. A range of dashboards has been designed for use by the cybersecurity management team to monitor the day-to-day performance of the cybersecurity defenses and immediately remediate any sign of concern.


text: All third-party vendors utilized by GXO undergo a cybersecurity assessment at the time of engagement. This assessment scrutinizes the third party's cybersecurity maturity to ascertain the level of risk the third party may present to the systems and data of GXO and its customers.


text: Our Audit Committee and our Board of Directors actively participate in discussions with management and among themselves regarding cybersecurity risks. In addition, our Board receives regular cybersecurity reports, which include a review of key performance and risk indicators, test results and related remediation and recent threats and how the Company is managing those threats.


text: Despite the continuous risk faced by the Company, we have suffered no incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, nor have we had any widespread intrusion or incident. Notwithstanding the exhaustive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations and financial condition. While GXO maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: We believe that cybersecurity is fundamental to how we operate and as such we place significant focus on defining and managing our cybersecurity risk. With the ever-changing cybersecurity landscape and continual emergence of new threats, our Board of Directors, Audit Committee and senior management team ensure that significant resources are devoted to cybersecurity risk management and the technologies, processes and people that support it. We have an Enterprise Risk Management Committee, comprising senior leaders from key functions, and a Cybersecurity Risk Committee which utilize the National Institute of Standards and Technology ("NIST") framework to ensure that these risks are clearly and effectively categorized and treated.


text: We utilize comprehensive and widespread information sources and services (including third-party threat intelligence) to understand the threat landscape faced by the Company and design our protective controls accordingly using a defense-in-depth approach. The layers of these defenses are aligned to the NIST framework; Govern, Identify, Protect, Detect, Respond and Recover. The Enterprise Risk Management Committee and Cybersecurity Risk Management Committee meet regularly to consider any change to risk levels and ensure that the Company's cybersecurity controls remain commensurate to those risk levels. These controls and their performance are constantly evaluated and evolved to ensure that the Company remains well protected against any new threats.


text: The Company's Chief Information Security Officer ("CISO") is responsible for developing and implementing our cybersecurity program and reporting on related matters to our Board of Directors. The CISO has over two decades of cyber security experience in a variety of industries including banking, aerospace, manufacturing and defense. A decade of this experience has been in senior leadership roles. The CISO leads a global team of highly trained experts covering all major cybersecurity functions including Technical Engineering and Architecture, Governance Risk and Compliance, Security Operations and Incident Response, Threat and Vulnerability Management and Security Awareness. The technologies, policies and processes associated with these functions are tested by third parties at least annually to ensure continued effectiveness and identify any opportunities for improvement. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors and intellectual property.


text: A full suite of cybersecurity policies exists and is applicable to all employees globally. These policies are reviewed annually and approved by relevant senior leaders. All Company employees are required to complete cybersecurity training annually, with quarterly "refreshers" throughout the year. An advanced phishing simulation program exists at the Company and all employees are tested at least monthly on their ability to identify phishing emails.


text: We invest in our cybersecurity defenses and have implemented multiple layers of protection against all known critical threats. We have high levels of compliance to protective controls on our technical estate, robust perimeter defenses, industry-leading filtering and analysis of web and email traffic, widespread multi-factor authentication, continuous training of our employees through educational material or simulation (e.g., phishing) and 24/7 monitoring of the IT estate. We have a robust and up-to-date Cyber Incident Response Plan ("CIRP") that is performed as a table-top exercise at least annually. A range of dashboards has been designed for use by the cybersecurity management team to monitor the day-to-day performance of the cybersecurity defenses and immediately remediate any sign of concern.


text: All third-party vendors utilized by GXO undergo a cybersecurity assessment at the time of engagement. This assessment scrutinizes the third party's cybersecurity maturity to ascertain the level of risk the third party may present to the systems and data of GXO and its customers. Additionally, these vendors' security maturity is constantly monitored via a third-party service.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: EverCommerce Inc.

ticker: EVCM


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for certain service providers, suppliers, and vendors that have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our board of directors (the "Board") considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on relevant cybersecurity topics from our Senior Vice President of Security Operations and internal security staff.


text: Our management team, including our Senior Vice President of Security Operations and the Security Operations team, is responsible for assessing and managing our material risks from cybersecurity threats. The Security Operations team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants and contractors. Our Security Operations team includes members with a variety and depth of experience in cybersecurity matters, with more than 80 years of combined cybersecurity experience amongst the team members and the Senior Vice President of Security Operations with more than 30 years of information technology and cybersecurity experience throughout his career. The Senior Vice President of Security Operations holds Certified Information Systems Security Professional and Certified Identity and Access Manager certifications, while the penetration testing team leader holds Offensive Security Certified Professional and Certified Red Team Operator certifications and the additional Security Operations team members hold a Security + certification.


text: Our Security Operations team, in coordination with our legal and compliance teams, supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Our Security Operations team meets monthly with key executives and management to provide updates regarding the Company's cybersecurity efforts. For more information, see the section titled "Risk Factor— Unauthorized disclosure, destruction or modification of data, disruption of our software or services or cyber breaches could expose us to liability, protracted and costly litigation and damage our reputation."


text: Our management team, including our Chief Information Security Officer (CISO)/Senior Vice President of Information Technology and Security (SVP), is responsible for assessing and managing, and mitigating cyber risk and security threats. The Security team has primary responsibility for our overall cybersecurity risk management program and supervises both internal cybersecurity personnel and external cybersecurity consultants and contractors. The Security team members have diverse experience in security strategy, architecture, and operations. Additionally, the CISO/SVP has more than 30 years' experience leading transformative security and technology. The CISO/SVP has earned the following certifications: Certified Information Systems Manager, Department of Homeland Security, Certified Incident Command, Certified Technical Emergency Response Training, Certified Incident Response, and the penetration testing team leader holds Offensive Security Certified Professional and Certified Red Team Operator certifications and the additional Security Operations team members hold a Security + certification.


text: Cyber Risk Management and Strategy We have adopted cybersecurity risk management processes that are informed by and incorporate elements of recognized industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework, and that are designed to identify, assess, and mitigate critical risks from cybersecurity threats.

companyName: Senti Biosciences, Inc.

ticker: SNTI


text: To support our cybersecurity risk management processes, we leverage a third-party Information Security Coordinator who provides ongoing support for the protection of our information technology infrastructure and also engage with other third-party providers and cybersecurity consultants as appropriate, including engagement of third parties to assist with managed detection and response. Additionally, our cybersecurity risk management strategy is informed by a recent risk assessment conducted by a third-party cybersecurity consultant.


text: We have an employee security awareness training program, required upon onboarding and on an annual basis thereafter, that is designed to raise awareness of cybersecurity threats across functions as well as to encourage consideration of cybersecurity risks across our Company. As part of this employee training program, we periodically conduct phishing simulations designed to raise employee awareness of such risks.


text: We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, such as software-as-a-service providers whose products are used to store our data, including through review of System and Organization Controls (SOC) reports prior to onboarding.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems and infrastructure. For more information, please see Item 1A - Risk Factors.


text: Governance Related to Cybersecurity Risks Our Information Security Coordinator is responsible for the establishment and maintenance of our cybersecurity risk management processes, including the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who is currently in this role has approximately 20 years of experience in information security. Our Information Security Coordinator reports to, and meets periodically with, our Director of Operations to discuss and review our information security and cybersecurity risk management processes.


text: Our board of directors has delegated oversight of the Company's enterprise risk management processes, including those related to cybersecurity risks, to the audit committee of the board of directors. We have implemented a process for our Information Security Coordinator, as appropriate, to provide periodic updates to the audit committee on the status of our cybersecurity program.


text: Cybersecurity Risk Management and Strategy We have adopted cybersecurity risk management processes that are informed by and incorporate elements of recognized industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework, and that are designed to identify, assess, and mitigate critical risks from cybersecurity threats.


text: To support our cybersecurity risk management processes, we leverage a third-party information security firm ("Information Security Coordinator") who provides ongoing support for the protection of our information technology infrastructure and also engage with other third-party providers and cybersecurity consultants as appropriate, including engagement of third parties to assist with managed detection and response. Additionally, our cybersecurity risk management strategy is informed by a risk assessment conducted by a third-party cybersecurity consultant.


text: We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, such as software-as-a-service providers whose products are used to store our data, including through review of System and Organization Controls ("SOC") reports prior to onboarding.


text: Governance Related to Cybersecurity Risks Our Information Security Coordinator is responsible for the maintenance of our cybersecurity risk management processes, including the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who is currently in this role has approximately 20 years of experience in information security. Our Information Security Coordinator meets periodically with our Director of Operations, to discuss and review our information security and cybersecurity risk management processes.


text: Our board of directors has delegated oversight of the Company's enterprise risk management processes, including those related to cybersecurity risks, to the Audit Committee of the Board of Directors. We have implemented a process for our Information Security Coordinator, as appropriate, to provide periodic updates to the Audit Committee on the status of our cybersecurity program.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. We design and assess our program based on the National Institute of Standards ("NIST"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Bridge Investment Group Holdings Inc.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. Management regularly reports on our cybersecurity risks to the Audit Committee. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as incidents with lesser impact potential.


text: The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Technology Officer, internal security staff or external experts as part of the board of directors' continuing education on topics that impact public companies.


text: Our management team, including our Chief Operating Officer, Chief Financial Officer, Chief Compliance Officer, Chief Technology Officer and Head of Risk Management, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Technology Officer, Scott Cardenas, is responsible for all aspects of technology across the Company and has extensive experience in cybersecurity and technology, including 15 years of experience managing technology organizations. Before joining the Company in 2018, Mr. Cardenas was chief technology officer for Kiewit Corporation and chief technology officer for the City and County of Denver before being promoted to chief information officer. Mr. Cardenas received a B.S. in Computer Information Systems and Management from Metropolitan State University of Denver and a M.B.A. from the University of Denver. As Chief Technology Officer, Mr. Cardenas is a member of the Company's Risk Management Committee, a cross-functional committee that governs and oversees our cybersecurity risk management program, among other responsibilities and includes the Chief Operating Officer, Chief Financial Officer, General Counsel, Chief Compliance Officer, Chief Technology Officer, and Head of Risk Management and Director of Internal Audit.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Risk Management and Strategy We employ a risk management strategy for the assessment, identification and management of material risks stemming from cybersecurity threats. Our methodologies involve a systematic evaluation of potential threats, vulnerabilities, and their potential impacts on our organization's operations, data, and systems. Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, and our IT environment; • The use of external service providers to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees and senior management through the use of third-party providers for regular mandatory trainings; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • We design and assess our program using the National Institute Cybersecurity Framework ("NIST CSF") as a set of guiding principles.

companyName: NewLake Capital Partners, Inc.

ticker: NLCP


text: Our third-party service providers are primarily responsible for the security of their own information technology environments and in certain instances we rely significantly on third-party service providers to supply and store our sensitive data in a secure manner. All of these third parties face potential risks relating to cybersecurity similar to ours which could disrupt their businesses and therefore adversely impact us. While we provide guidance and specific requirements in some cases, we do not directly control any of these parties' information technology security operations, or the amount of investment they place in guarding against cybersecurity threats. Accordingly, we are subject to any flaw or breaches to their information technology systems, or those which they operate for us, which could have a material adverse effect on our financial condition or results of operations.


text: We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – The occurrence of cyber incidents or cyberattacks could disrupt our operations, result in the loss of confidential information and/or damage our business relationships and reputation.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. The Committee receives periodic reports from management on our potential cybersecurity risks and threats and receives presentations on cybersecurity topics. In addition, management works collaboratively with our third-party provider to test our systems security processes and prevent, monitor, detect, mediate and remediate cybersecurity threats and incidents, and will report such threats and incidents to the Audit Committee when appropriate. The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity.


text: As of the date of this Annual Report on Form 10-K, we have not identified of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Risk Management and Strategy We employ a risk management strategy for the assessment, identification and management of material risks stemming from cybersecurity threats. Our methodologies involve a systematic evaluation of potential threats, vulnerabilities, and their potential impacts on our organization's operations, data, and systems. Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, and our IT environment; • The use of third-party service providers to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees and senior management through the use of third-party providers for regular mandatory trainings; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • We design and assess our program using the National Institute Cybersecurity Framework ("NIST CSF") as a set of guiding principles.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. The Committee receives periodic reports from management on our potential cybersecurity risks and threats and receives presentations on cybersecurity topics. In addition, management oversees and identifies such risks from cybersecurity threats associated with our use of third-party service providers and works collaboratively with our third-party providers to test our systems security processes and prevent, monitor, detect, mediate and remediate cybersecurity threats and incidents, and will report such threats and incidents to the Audit Committee when appropriate. The Committee reports to the full board of directors regarding its activities, including those related to cybersecurity.


text: Our Chief Executive Officer, Anthony Coniglio, leads our cybersecurity risk assessment and management processes. Mr. Coniglio is an experienced risk management professional. Mr. Coniglio has served as our Chief Executive Officer, President and Chief Investment Officer, overseeing risk management activities. Previously, Mr. Coniglio was the Chief Executive Officer of Primary Capital Mortgage Company ("PCM"), a residential mortgage company, where he was responsible for overseeing information technology, including cybersecurity, for the highly regulated business. Mr. Coniglio currently serves on the board of St. Mary's Hospital for Children, as chair of the IT & cybersecurity committee and chair of the audit committee.


text: Mr. Coniglio oversees the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents. Since 2021, we have retained a third-party information technology provider to develop and maintain our information technology infrastructure, cloud network, and assist in the development of cybersecurity and information technology policies. Our third-party provider is MSPAlliance Cyber Verified, which has been examined by an independent third-party public accounting firm and has successfully met the applicable 10 control objectives and underlying controls and requirements.


text: Management plays a key role in incorporating cybersecurity risk considerations into our boarder risk management framework and ensuring that essential priorities are communicated to the appropriate personnel. Management is responsible for approving cybersecurity processes, reviewing cybersecurity assessments and other cybersecurity-related matters, and responding to cybersecurity incidents, including but not limited to reporting cybersecurity incidents to the audit committee as described above. Our management team also evaluates the potential impact of cybersecurity incidents. If any such incidents should occur, management's evaluation considers factors such as the nature. scope and materiality of the incident, and its effects on the Company's operations.


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a process for overseeing and managing cybersecurity and related risks, which is supported by both management and our Board.

companyName: KORE Group Holdings, Inc.

ticker: KORE


text: Our cybersecurity functions are led by our Chief Technology Officer ("CTO"), who reports to our Chief Executive Officer. Our Senior Director - Global Security ("SDGS"), under the direction of the CTO, is responsible for overseeing our cybersecurity management program and the protection and defense of our networks and systems. The SDGS manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance.


text: Our Board is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in its role of risk oversight. The full Board receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually from the CTO. The audit committee of the Board (the "Audit Committee") specifically assists the Board in its oversight of risks related to cybersecurity. To help ensure effective oversight, the Audit Committee receives an update on cybersecurity from the CTO on an as-needed basis.


text: Internal Audit Program – We operate an internal audit program. On an annual basis, our internal audit team conducts an overall business risk assessment, which includes an evaluation of cybersecurity risks. Included in this evaluation is a report on our cybersecurity posture and related matters that is presented to the leaders of the relevant business teams, who are responsible for prioritizing and addressing the risks identified.


text: Internal training and awareness – We provide training to our employees to help identify, avoid, and mitigate the risk from cybersecurity threats. Our employees are required to complete required cybersecurity awareness training upon hiring and also participate annually in required cybersecurity awareness training, unless on a leave of absence.


text: Vendor risk management program – We have implemented processes to identify and manage risks from cybersecurity threats associated with our use of third-party service providers. Our vendor risk management program establishes governance, processes and tools for managing various risks related to third-party service providers, including information security and supplier-related risks. As a condition of working with KORE, suppliers who access sensitive business or customer information are expected to meet certain information security requirements.


text: As of December 31, 2023, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We are committed to investing in cybersecurity and to enhancing our internal controls and processes, which are designed to help protect our systems and information. For more information regarding the risks we face from cybersecurity threats, please see Part I, Item 1A, — "Risk Factors".


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a program for overseeing and managing cybersecurity and related risks, which is supported by both management and our Board.


text: Our cybersecurity functions are led by our Chief Operating Officer ("COO"), who reports to our Chief Executive Officer. Our COO's relevant experience in cybersecurity includes previous experience, such as having previously served as Chief Executive Officer of a company that provides geospatial intelligence software and as Chief Technology Officer at a global cloud-based enterprise software company. Our Vice President - IT Security & Compliance ("VPITSC"), under the direction of the COO, is responsible for overseeing our cybersecurity management program and the protection and defense of our networks and systems. The VPITSC's relevant experience in cybersecurity includes over twelve years of extensive experience at the Company in cybersecurity, in various progressive roles. The VPITSC manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance.


text: Our Board is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in its role of risk oversight. The full Board receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually from the COO.


text: Risk Assessment and Management – We comply with the international standard ISO 27001, an Information Security Management System (ISMS), which helps safeguard the confidentiality, integrity, and availability of information through a structured risk management process. This approach assures stakeholders that cybersecurity risks are effectively managed. To support this commitment, we conduct regular risk assessments to identify, evaluate, and mitigate potential threats.


text: Internal training and awareness – We provide training to our employees to help identify, avoid, and mitigate the risk from cybersecurity threats. Our employees are required to complete mandatory cybersecurity awareness training upon hiring and also participate annually in required cybersecurity awareness training, unless on a leave of absence.


text: Technical Security Controls – We employ layered security controls, including Managed Endpoint Detection and Response, firewalls, intrusion detection systems, encryption technologies, and a Security Operations Center that is operated 24 hours a day, seven days a week.


text: Vendor risk management program – We have implemented processes to oversee, identify and manage risks from cybersecurity threats associated with our use of third-party service providers. Our vendor risk management program establishes governance, processes and tools for managing various risks related to third-party service providers, including information security and supplier-related risks. As a condition of working with KORE, suppliers who access sensitive business or customer information are expected to meet certain information security requirements.


text: Incident Response – We have put in place a formal incident response plan to address and mitigate potential security breaches in a timely and effective manner. Communication protocols have been established to notify relevant stakeholders, including regulators and customers, as required. Our incident response team conducts regular simulations and exercises to ensure readiness and effectiveness.


text: As of December 31, 2024, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We are committed to investing in cybersecurity and to enhancing our internal controls and processes, which are designed to help protect our systems and information. For more information regarding the risks we face from cybersecurity threats, please see Part I, Item 1A, — "Risk Factors".


text: Risk Management and Strategy We have established processes and policies for assessing, identifying, and managing material risks arising from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on, or conducted through, our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Blend Labs, Inc.

ticker: BLND


text: We conduct annual risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. We also utilize threat modeling to evaluate changes to our applications or environments for new threats or risks, and our cybersecurity team monitors the threat landscape regularly using security industry sources and certain threat intelligence information. Blend conducts daily vulnerability assessments, prioritizes remediation, and engages in routine system and application patching as well as other proactive measures, where deemed appropriate, to mitigate reasonably foreseeable risks.


text: Blend maintains an incident response plan that is designed to contain and resolve any suspected security incident identified by the Company. This plan is tested at least annually. Our security operations team triages issues and invokes the incident response plan when necessary. This plan includes provisions for notifications of internal and external parties, including Blend leadership and the Audit Committee as required.


text: Following these risk assessments, or when we otherwise identify cybersecurity risks through the processes described in this "Risk Management and Strategy" section, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks and reasonably address any identified gaps in existing safeguards. We devote significant resources and designate high-level personnel, including our Information Security Officer, who reports to our Head of Finance and Administration, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our human resources and information technology functional groups. Personnel at all levels and departments are made aware of our cybersecurity policies through training. Specific training is required for users of higher-risk systems or individuals associated with specific security processes such as incident response.


text: Our cybersecurity program includes processes for identifying and managing risks from third parties and is integrated into our overall risk management framework. Our program defines key risk objectives and if cybersecurity risk exceeds defined thresholds, risks are documented and escalated into the enterprise risk program and Blend's internal audit team. We require all third-party service providers with access to our systems or processing sensitive data on our behalf to align with our cybersecurity objectives and adhere to industry best practices via contractual obligations that are entered into in connection with as a mandated review prior to engaging such service providers. We re-evaluate each such service provider at least annually and when the role or purpose of a service provider changes, and have processes to require service providers maintaining sensitive data on our behalf to delete such data at the time of termination of the contract.


text: We engage assessors or other third-party service providers in connection with our risk assessment and cybersecurity assessment or audit processes. These service providers assist us to evaluate risks and identify where our current security program may be improved. We consult with these service providers as required to verify mitigation approaches, to compare Blend's security posture against industry peers, and to provide overall feedback for the security program. Additionally, we utilize outside service providers, as well as a bug bounty program, to penetration test our network infrastructure and applications and provide prioritized security vulnerability findings reports that we include as part of our risk assessment processes. Some Blend customers also perform annual security testing on Blend's infrastructure and applications.


text: Like other technology companies, we have experienced cybersecurity incidents in the past. We have not, however, been materially impacted by any previous cybersecurity incidents. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K,including the risk factors entitled "Risks Related to Our Business and Operations: A cyberattack, security breach, or incident affecting us or the third parties we rely on or partner with could expose us or our customers and consumers to a risk of loss or misuse of confidential information and have an adverse effect on our reputation, brand, business, financial condition, and results of operations."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function through the Audit Committee.


text: Our Information Security Officer and our cybersecurity team (which consists of our security policy manager, security operations manager, and red team lead) are primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Information Security Officer has over 20 years of expertise within the cybersecurity field, and manages an experienced team with expertise in relevant security practices such as penetration testing, security operations, policy, etc.


text: Our Information Security Officer and our cybersecurity team oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Information Security Officer and our cybersecurity team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents include monitoring of network, system and application logs, review of vulnerability scans and penetration test results, review of industry sources for vulnerability and threat indicators, and use of third-party service providers for audit or assessment purposes. In the event of a significant cybersecurity incident that is identified by the Company, Blend leadership and the Audit Committee is informed by the Information Security Officer or our manager of security operations to support swift and informed decision-making.


text: Our Information Security Officer provides quarterly briefings to the Audit Committee regarding our cybersecurity risks and activities, including our progress on mitigating threats identified by external cybersecurity risk audits, any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like, in each case as applicable. Our Audit Committee provides regular updates to the board of directors on such reports.


text: Blend maintains an incident response plan that is designed to contain and address any suspected security incident identified by the Company. This plan is tested at least annually. Our security operations team triages issues and invokes the incident response plan when deemed necessary. This plan includes provisions for notifications of internal and external parties, including Blend leadership and the Audit Committee as required.


text: Our cybersecurity program includes processes for identifying and managing risks from third parties and is integrated into our overall risk management framework. Our program defines key risk objectives and if cybersecurity risk exceeds defined thresholds, such risks are documented and escalated into the enterprise risk program and Blend's internal audit team. We contractually obligate third-party service providers with access to our systems or processing sensitive data on our behalf to align with our cybersecurity objectives and adhere to industry best practices. We re-evaluate each such service provider at least annually and when the role or purpose of a service provider changes, and have processes to require service providers maintaining sensitive data on our behalf to delete such data upon contract termination.


text: We engage assessors or other third-party service providers in connection with our risk assessment and cybersecurity assessment or audit processes. These service providers assist us to evaluate risks and identify where our current security program may be improved. We consult with these service providers as required to verify mitigation approaches, to compare Blend's security posture against industry peers, and to provide overall feedback for the security program. Additionally, we utilize outside service providers, as well as a bug bounty program, to penetration test our network infrastructure and applications and provide prioritized security vulnerability findings reports. Some Blend customers also perform annual security testing on Blend's infrastructure and applications.


text: Our Information Security Officer and our cybersecurity team (which consists of our security policy manager, security operations manager, and red team lead) are primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Information Security Officer has over 20 years of expertise within the cybersecurity field, and manages an experienced team with expertise in relevant security practices such as penetration testing, security operations, and policy.


text: Our Information Security Officer and our cybersecurity team oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Information Security Officer and our cybersecurity team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents include monitoring of network, system and application logs, review of vulnerability scans and penetration test results, review of industry sources for vulnerability and threat indicators, and use of third-party service providers for audit or assessment purposes. In the event of a significant cybersecurity incident that is identified by the Company, Blend leadership and the Audit Committee are informed by the Information Security Officer or our manager of security operations to support swift and informed decision-making.


text: CLEAR's information security program is managed by a dedicated Chief Information Security Officer ("CISO"), whose team is responsible for leading the Company's Enterprise Risk Management Program ("ERM Program"), which includes cybersecurity strategy, policy, standards, architecture, and processes. Our current CISO, together with his team, continues to implement, monitor, and maintain our cybersecurity program while we search for his successor. Cybersecurity risks are identified, discussed and assessed regularly as part of CLEAR's ERM Program. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We utilize a range of external experts, such as cybersecurity assessors, consultants and auditors, in evaluating and testing our cybersecurity systems. In addition, the Company has established the CLEAR Security Advisory Board, which provides guidance and advice on security risk and privacy to our Board and our CISO.

companyName: Clear Secure, Inc.

ticker: YOU


text: The Audit Committee of the Board predominantly oversees risk, including data security and oversight of cybersecurity risks, providing regular updates to the Board. The CISO provides periodic reports to our Board and Audit Committee, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. In addition, the top 10 cybersecurity risks identified as part of the ERM Program are identified to our Audit Committee on a quarterly basis.


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: CLEAR's information security program is managed by a dedicated Chief Security Officer ("CSO"), who has over 27 years of experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as relevant academic degrees, formal military training, and industry certifications. Our CSO's team is responsible for leading the Company's Enterprise Risk Management Program ("ERM Program"), which integrates our cybersecurity strategy, policy, standards, architecture and processes, and through which we regularly discuss and assess identified cybersecurity risks. Our CSO attends ERM Program meetings where cybersecurity (and other) risks are identified. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds, utilize a range of external experts, such as cybersecurity assessors, consultants and auditors, in evaluating and testing our cybersecurity systems. Further, CLEAR recognizes the importance of managing cybersecurity risks associated with third-party relationships as part of its broader risk management framework, as we are an organization that relies on a variety of third-party vendors, service providers, and business partners, and are aware that these relationships present potential risks to the security and integrity of our information systems. To mitigate these risks, the company works closely with vendors using our risk framework to identify, assess, and monitor potential cybersecurity threats that arise from relationships with external entities. Our approach includes conducting due diligence, enforcing contractual cybersecurity requirements, and implementing third-party cybersecurity best practices designed to align with CLEAR's risk management objectives.


text: In addition, the Company has established the CLEAR Security Advisory Board, which provides guidance and advice on security risk and privacy to our Board and our CSO. The CSAB is currently comprised of three external members with a range of executive national and international expertise in areas such as aviation and transportation security, physical security operations, cyber security, and privacy and data security. The CSAB meets in-person, together with management of the Company, at least annually, in addition to quarterly meetings by phone. The CSAB reports annually to our Board or our Audit Committee, and is an available resource to both management and members of the Board at any time.


text: The full Board provides oversight of the cybersecurity program while the Audit Committee of the Board predominantly oversees risk, including data security and oversight of cybersecurity risks, providing regular updates to the full Board. The CSO is actively engaged in discussions with the Board regarding the identification, assessment, and mitigation of cybersecurity risks to ensure that appropriate resources are dedicated to managing such risks and addressing any potential adverse effects, and provides periodic reports to our Board and Audit Committee, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: Although CLEAR has not experienced any material cybersecurity breaches during the reporting period, we acknowledge that cyber incidents, if they were to occur, could have a material adverse effect on our financial results.


text: The Company is exposed to cybersecurity threats and incidents that can range from uncoordinated individual attempts to gain unauthorized access to information systems to sophisticated and targeted measures known as advanced persistent threats, directed at the Company or its third party service providers. Our customers, strategic relationships and regulators expect us to maintain a suitable cybersecurity posture to identify, protect, detect, respond and recover from incidents that may impact the confidentiality, integrity and availability of sensitive information we possess. We evaluate the risks of data theft (including theft of sensitive, proprietary and other data categories, in addition to personal data), harm to customer or third party relationships and litigation or regulatory investigation or actions that could materially adversely affect our financial condition, results of operations and reputation. Cybersecurity risk is assessed and managed primarily through our operations, risk management, and audit teams and is overseen by our Board of Directors.

companyName: Finwise Bancorp

ticker: FINW


text: The Bank's Information Security Officer (or ISO), who reports to our Chief Compliance & Risk Officer, is directly responsible for assessing and managing cybersecurity risks pursuant to the Company's Information Security Program, which is approved by our Board of Directors periodically. The current ISO has more than 5 years of cybersecurity experience and holds multiple industry certifications.


text: The ISO provides our Board of Directors with periodic reports regarding the Company's cybersecurity condition, key activities and recommendations for improvement of the Information Security Program. The ISO coordinates any incident responses with members of the Company's executive management, regulators and third parties. The ISO also reports any matter relating to cybersecurity incident responses and control deficiencies to our Board of Directors and its Audit Committee, respectively.


text: The cybersecurity department of the Bank's Information Technology (or IT) department is responsible for the day-to-day operations of our cybersecurity controls and defenses. The department is managed by the Bank's Director of Information Systems and Security, who reports to the Bank's Chief Technology Officer. The current Director of Information Systems and Security has more than 24 years of technology and cybersecurity experience. Our Chief Technology Officer periodically reports information about the Company's cybersecurity risks and operational developments to our Board of Directors.


text: The IT department provides the ISO with access to its operations and alerts regarding cybersecurity events. Events that could become cybersecurity incidents are reviewed and evaluated by the ISO in consultation with the IT department. Documented escalation procedures are tested regularly as part of tabletop exercises and other activities and include notification to executive management during qualifying cybersecurity incidents. The IT department shares responsibility with the ISO for identifying and prioritizing improvements to the Company's cybersecurity capabilities and resources.


text: The Bank's IT Steering Committee, comprising the ISO and members of the Company's executive management and IT department, generally meets on a monthly basis to review developments regarding the Company's cybersecurity risks, defenses and remediation activities. Minutes of the meetings of the IT Steering Committee are regularly reviewed by our Board of Directors.


text: We perform periodic risk assessments of the Company's information systems based on regulatory guidance issued by the Federal Financial Institutions Examination Council (FFIEC) and state and federal regulators, including the FDIC and the UDFI. We use multiple real-time and interval-based monitoring and reporting mechanisms to detect and respond to cybersecurity incidents. We also engage multiple independent third parties or cyber experts to detect and defend against cybersecurity threats and to assess information security programs and practices including penetration testing. Additionally, we participate in various cybersecurity industry forums and have access to law enforcement analyses regarding current threats.


text: The ISO, along with the Bank's Third-Party Oversight Committee, evaluates cybersecurity risks and information systems of third parties whose information systems support important Company operations or with whom the Company has significant business relationships at onboarding, on an ongoing basis and upon termination of the business relationship. Such evaluations may include reviews of reports or performing assessments of a third party's information systems pursuant to established cybersecurity frameworks such as International Organization for Standardization (ISO) ISO 27001 or Cybersecurity Framework (CSF) published by the US National Institute of Standards and Technology, as well as reviews of reports issued by a third party's auditors developed under the attestation standards issued by the American Institute of Certified Public Accountants (AICPA). When appropriate, the Company may include additional risk mitigation measures in its onboarding requirements for third parties to address any identified risk factors, such as minimum required information security performance agreements to enable cybersecurity threats and incidents to be managed within applicable industry or regulatory standards, disclosure obligations requiring reporting to the Company of the occurrence and mitigation of cybersecurity threats and incidents, and requirements to maintain adequate levels of cybersecurity insurance coverage.


text: When a cybersecurity incident occurs, whether detected internally or from a third party, we evaluate the incident for criticality and potential materiality and disclosure. We consider various factors in assessing the materiality of a cybersecurity incident, including the potential for misappropriation, destruction, corruption or unavailability of critical data and confidential or proprietary information (our own or that of third parties) and business operation disruption, and may consult with external advisors, experts or legal counsel in connection with our assessment. We have escalation procedures to notify members of our executive management, Board of Directors and regulators in a timely manner based on the criticality and materiality of any cybersecurity incident.


text: While we have experienced, and expect to continue to experience, cybersecurity threats, we did not experience any material cybersecurity incident in the year ended December 31, 2023. We may nevertheless be unsuccessful in the future in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For additional information regarding cybersecurity risks, see "Risk Factors - Risks Related to Cybersecurity and Technology".


text: The Bank's Information Security Officer ("ISO"), who reports to our Chief Compliance & Risk Officer, is directly responsible for assessing and managing cybersecurity risks pursuant to the Company's Information Security Program, which is approved by our Board of Directors periodically. The current ISO has more than 5 years of cybersecurity experience and holds multiple industry certifications.


text: The cybersecurity department of the Bank's Information Technology ("IT") department is responsible for the day-to-day operations of our cybersecurity controls and defenses. The department is managed by the Bank's Director of Information Systems and Security, who reports to the Bank's Chief Technology Officer The current Director of Information Systems and Security has more than 24 years of technology and cybersecurity experience. Our Chief Technology Officer periodically reports information about the Company's cybersecurity risks and operational developments to our Board of Directors.


text: We perform periodic risk assessments of the Company's information systems based on regulatory guidance issued by the Federal Financial Institutions Examination Council ("FFIEC") and state and federal regulators, including the FDIC and the UDFI. We use multiple real-time and interval-based monitoring and reporting mechanisms to detect and respond to cybersecurity incidents. We also engage multiple independent third parties or cyber experts to detect and defend against cybersecurity threats and to assess information security programs and practices including penetration testing. Additionally, we participate in various cybersecurity industry forums and have access to law enforcement analyses regarding current threats.


text: The ISO, along with the Bank's Third-Party Oversight Committee, evaluates cybersecurity risks and information systems of third parties whose information systems support important Company operations or with whom the Company has significant business relationships at onboarding, on an ongoing basis and upon termination of the business relationship. Such evaluations may include reviews of reports or performing assessments of a third party's information systems pursuant to established cybersecurity frameworks such as International Organization for Standardization ("ISO") ISO 27001 or Cybersecurity Framework ("CSF") published by the US National Institute of Standards and Technology, as well as reviews of reports issued by a third party's auditors developed under the attestation standards issued by the American Institute of Certified Public Accountants ("AICPA"). When appropriate, the Company may include additional risk mitigation measures in its onboarding requirements for third parties to address any identified risk factors, such as minimum required information security performance agreements to enable cybersecurity threats and incidents to be managed within applicable industry or regulatory standards, disclosure obligations requiring reporting to the Company of the occurrence and mitigation of cybersecurity threats and incidents, and requirements to maintain adequate levels of cybersecurity insurance coverage.


text: While we have experienced, and expect to continue to experience, cybersecurity threats, we did not experience any material cybersecurity incident in the year ended December 31, 2024. We may nevertheless be unsuccessful in the future in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For additional information regarding cybersecurity risks, see "Risk Factors - Risks Related to Cybersecurity and Technology".


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Company's Senior Director of Cybersecurity and the Cybersecurity Core Team, supported by our Cybersecurity Leadership Team.

companyName: Snap One Holdings Corp.


text: Responsible for the day-to-day execution of our cybersecurity strategy, our Senior Director of Cybersecurity has a background with experience in information security and risk management. This person has over 28 years of IT and cybersecurity experience, with over 10 years specializing in digital forensics, incident response, and risk management, and holds a Management of Information Systems degree and Certified Information Systems Security Professional ("CISSP") and Certified Information Security Manager ("CISM") cybersecurity certifications. The Senior Director of Cybersecurity develops and implements policies, procedures, and controls to safeguard our information assets, and leads incident response efforts, ensuring a swift and effective response to potential cyber threats.


text: Comprised of specialists in risk assessment, vulnerability management, and threat intelligence, the Cybersecurity Core Team focuses on identifying, evaluating, and mitigating cyber risks. Their backgrounds include various cybersecurity certifications including CISSP, CISM, Offensive Security Certified Professional ("OSCP"), Certified Information Systems Auditor ("CISA"), and Certified Cloud Security Professional ("CCSP"). This team conducts regular risk assessments, monitors the threat landscape, and collaborates with other departments to promptly address vulnerabilities.


text: Comprised of leaders from various departments with a goal of providing high-level oversight and strategic direction for cybersecurity initiatives, the Cybersecurity Leadership Team strives to align cyber risk management with the overall business strategy and ensure resources are allocated appropriately. Members include employees from various operational perspectives and departments including IT, Finance, Legal, Product Development, Marketing, and People Management to foster a holistic approach to cybersecurity.


text: Engage Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage with external consultants and auditors to assess and enhance our security posture. These third parties conduct periodic audits, vulnerability assessments, and provide recommendations to strengthen our overall cybersecurity framework. These partnerships enable us to leverage specialized knowledge and insights.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we endeavor to conduct due diligence of our third-party service providers before engagement and implement contractual protections designed to address potential risks and vulnerabilities.


text: Risks from Cybersecurity Threats We are not aware of any specific cybersecurity incidents that individually or together materially affected our business in 2023, however we acknowledge that the current cyber environment means that we, like other companies in our industry, are under constant threat from hackers, terrorists and other cyber criminals that, if successful, could lead to data breaches, unauthorized access to sensitive information, and other cyber threats that would be reasonably likely to materially affect our business strategy, financial condition, or results of operations.


text: Board of Directors Oversight Management maintains a structured and systematic approach to reporting cybersecurity information to our Board. The audit and risk management committee (the "audit committee") of our Board has primary oversight over our cybersecurity program. The audit committee is comprised of independent directors with expertise in risk management, technology, finance, and cybersecurity. In addition, audit committee members also have experience with cybersecurity oversight from their membership on other public company boards.


text: The audit committee meets periodically to review and assess the effectiveness of our cybersecurity program, incident response plans, and overall resilience against evolving threats. The audit committee also actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures cybersecurity considerations are integrated into Snap One's broader strategic objectives.


text: Management's Role Managing Risk Quarterly briefings and formal updates are provided by members of management to the audit committee to maintain transparency and facilitate informed decision-making regarding cybersecurity investments and strategies. These reports encompass a broad range of cybersecurity topics, including: • Current Policies: Updates on the Company's cybersecurity policies, procedures, and incident response plans; • Threat Landscape Assessment: An overview of our current cybersecurity threat landscape, emerging trends, and potential risks; • Incident Reporting: Details on any cybersecurity incidents, breaches, or threats, including the nature of the incident, response actions taken, and remediation plans. • Investments and Initiatives: Updates on cybersecurity investments, initiatives, and projects to improve our overall cybersecurity posture; and • Compliance and Regulatory Landscape: Insights into changes in cybersecurity regulations, compliance status, and efforts to align with industry best practices.