text: Important to these programs is our Adviser's investment in threat-intelligence, its active engagement in industry and government security-related forums, and its utilization of external experts to challenge its program maturity, assess its controls and routinely test its capabilities.


text: Our board of directors oversees cybersecurity risk and receives updates, at a minimum, twice a year from the CISO (or designee) regarding cybersecurity, which updates include a review of our Adviser's global security program and cybersecurity, including risks and protections for us and our Adviser. The Global Operational Risk Management Committee, one of our Adviser's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. In addition, the CISO provides quarterly updates to our company's enterprise risk management committee, which in turn provides quarterly updates to our board of directors, and members of our management team are included in our Adviser's incident response process in the event a cyber security incident occurs that could materially impact us.

companyName: Invesco Real Estate Income Trust Inc.

secItem: Item 1C


text: As of December 31, 2023, we have not experienced any cyber incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Cyber threats are considered one of the most significant risks facing financial institutions. Since our company is externally managed, we rely upon the operational and investment risk oversight functions of our Adviser and its affiliates. To mitigate risk from cyber threats, our Adviser has a designated Global Chief Security Officer ("GCSO") who leads its global security department, which is responsible for identifying, assessing and managing cybersecurity threats. The GCSO has experience in the public and private sectors, specializing in security, investigations and incident response. The global security department oversees, among other things, the following groups across Invesco: Information Security, Strategic Intelligence, Corporate Security, Business Continuity, Crisis Management, Global Privacy Office, Business Security, Projects and Strategy This structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees and critical assets safe, upholding privacy rights, and enabling a secure and resilient business.


text: Our Adviser's information security program is led by its Chief Information Security Officer ("CISO") who reports directly to the GCSO and has extensive experience in information security and risk management. Our Adviser's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets.


text: Our Adviser's cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or a third-party. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness of cyber phishing threats.


text: Our board of directors oversees cybersecurity risk and receives updates, at a minimum, twice a year from the CISO (or designee) regarding cybersecurity, which updates include a review of our Adviser's global security program and cybersecurity, including risks and protections for us and our Adviser. The Global Operational Risk Management Committee, one of our Adviser's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. In addition, the CISO provides quarterly updates to our enterprise risk management committee, which in turn provides quarterly updates to our board of directors, and members of our management team are included in our Adviser's incident response process in the event a cybersecurity incident occurs that could materially impact us.


text: As of December 31, 2024, we have not experienced any cyber incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: We are committed to protecting our information assets and systems. We have an enterprise-wide information security program designed to identify, protect against, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. We have installed privacy/security protection systems and devices on our network in an attempt to prevent cyberthreats and other unauthorized access to information.

companyName: Envista Holdings Corp

ticker: NVST


text: We have adopted a comprehensive Information Security Policy applicable to all of our employees and business partners. We also maintain a Global Security Incident Response Plan ("GSIRP") to ensure we remain prepared in the event of a cyberattack or other form of network penetration. Our GSIRP is a cross functional plan that documents the details and decision-making process required during a response to a security incident, as well as the reporting protocol with clear escalation timelines and responsibilities. We test our GSIRP with tabletop exercises administered by a third party security consultant. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cyber issues.


text: Like most multinational corporations, our information technology systems have been subject to computer viruses, malicious codes, unauthorized access and other cyberattacks, and we expect the sophistication and frequency of such attacks to continue to increase. To date, no attempted cyberattack or other attempted intrusion on our information technology networks has resulted in a material adverse impact on our business strategy, results of operations or financial condition. There can be no assurance that future incidents will not materially affect us, including our business strategy, results of operations or financial condition. Please refer to "Item 1A. Risk Factors—Risks Related to Our Business" for further detail about the material cybersecurity risks we face.


text: Our Senior Director of Information Security reports to our Chief Information Officer and is responsible for leading our enterprise-wide information security team. The team focuses on developing and implementing strategies, processes and response plans to protect the confidentiality, integrity, and availability of our assets. Our Senior Director of Information Security has prior experience as a chief information security officer and over 25 years of experience in Technology and Security. Our security team also includes members who maintain industry security certificates. Our team is additionally supported by third parties to assist in the operations of our program, compliance audits and security penetration testing.


text: We evaluate and manage risks relating to cybersecurity as part of our overall enterprise risk management program. We perform an annual assessment across the Company to identify and review potential risks. Risks are prioritized based on threat models to improve cybersecurity throughout the Company. Our Board of Directors oversees our enterprise risk management program.


text: The Audit Committee of our Board of Directors has the responsibility of exercising oversight with respect to our cybersecurity risk management and risk controls. Our Chief Information Officer provides periodic reports to the Audit Committee regarding our cybersecurity program, including our information risk management and oversight, security education and training, cyber threat detection and response processes, and relevant internal and industry cybersecurity attacks. The Board also receives a report out on cybersecurity issues and governance at least annually, with periodic updates as needed.


text: Risk Management and Strategy We are committed to taking action to protect our information assets and systems. We have an enterprise-wide information security program designed to identify, protect against, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats, including those associated with our use of third-party service providers. We have installed privacy/security protection systems and devices on our network in an attempt to prevent cyberthreats and other unauthorized access to information. Additionally, we conduct security risk assessments prior to engaging third party suppliers and other vendors and business partners to validate that they maintain appropriate safeguards to protect our and their information systems in connection with services they provide. This risk assessment is heightened with respect to vendors or business partners that have access to our critical systems and information.


text: We have adopted an Information Security Policy applicable to all of our employees and business partners. We provide security awareness education and training for our employees annually, conduct regular internal "phishing" testing and mandatory training for "clickers," and publish internal alerts to highlight any emerging or urgent security threats. We also maintain a Global Security Incident Response Plan ("GSIRP") to guide our response in the event of a cyberattack or other form of network penetration. Our GSIRP is a cross functional plan that documents the details and decision-making processes required during a response to a security incident, as well as the reporting protocol with escalation timelines and responsibilities. We test our GSIRP with tabletop exercises administered by a third party security consultant. We leverage the standards set by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as well as industry best practices to measure our security posture and manage risk. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cyber issues, although our insurer may deny coverage for a future claim or our insurance coverage may be insufficient to cover all losses from a cyberattack.


text: We evaluate and manage risks relating to cybersecurity as part of our overall enterprise risk management program. We perform an annual assessment across the Company to identify and review potential risks. Risks are prioritized based on threat models to improve cybersecurity throughout the Company.


text: Cybersecurity Governance Our Senior Director of Information Security reports to our Chief Information Officer and is responsible for leading our enterprise-wide information security team. The team focuses on developing and implementing strategies, processes and response plans to protect the confidentiality, integrity, and availability of our assets. Our Senior Director of Information Security has prior experience as a chief information security officer and over 25 years of experience in Technology and Security. Our security team also includes members who maintain industry security certificates. Our team is additionally supported by third parties to assist in the operations of our program, compliance audits and security penetration testing.


text: Our Board of Directors oversees our enterprise risk management program. The Audit Committee of our Board of Directors has the responsibility of exercising oversight with respect to our cybersecurity risk management and risk controls. Our Chief Information Officer provides periodic reports to the Audit Committee regarding our cybersecurity program, including our information risk management and oversight, security education and training, cyber threat detection and response processes, and relevant internal and industry cybersecurity attacks. The Board also receives a report out on cybersecurity issues and governance at least annually, with periodic updates as needed. Board members receive periodic presentations on cybersecurity topics from our Chief Information Officer and external experts as part of the Board's continuing education on topics that impact public companies.


text: Material Cybersecurity Risks, Threats, and Incidents Like most multinational corporations, our information technology systems have been subject to computer viruses, malicious codes, unauthorized access and other cyberattacks, and we expect the sophistication and frequency of such attacks to continue to increase. For example, during the second half of 2023, one of our largest distributors experienced a cybersecurity incident which impacted their ability to place orders and consequently impacted the timing of orders received. This incident, however, as well as other cyberattacks to date, did not have a material impact on our business strategy, results of operations or financial condition. There can be no assurance that future incidents will not materially affect us, including our business strategy, results of operations or financial condition. Please refer to "Item 1A. Risk Factors—Risks Related to Our Business" for further detail about the material cybersecurity risks we face.


text: Cybersecurity Risk Management and Strategy At STERIS, the enterprise risk management ("ERM") program is designed to identify, assess, and manage risks across STERIS's enterprise. Cybersecurity risk management is integrated into STERIS's ERM program, under which we regularly assess cybersecurity risks in accordance with what we believe are industry cybersecurity best practices. Further, we implement controls to protect the confidentiality, integrity and availability of STERIS's information systems and information. We maintain cybersecurity and incident response procedures to address our security standards and requirements and provide a framework for assessing and responding to cybersecurity threats and incidents. Additionally, as part of our ERM program, STERIS oversees and identifies risks associated with third-party service providers with whom we do business, which process includes due diligence, risk management assessments and contractual safeguards. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cybersecurity issues.

companyName: STERIS plc

ticker: STE


text: STERIS has an Executive Cybersecurity Steering Committee consisting of the Senior Vice President & Chief Financial Officer, the Vice President, Chief Accounting Officer, the Vice President, Investor Relations & Corporate Communications, the Vice President & Chief Information Officer ("CIO"), the Vice President, Chief Compliance Officer, the Senior Vice President, General Counsel & Company Secretary, and the Chief Information Security Officer ("CISO") that is responsible for providing governance, risk and compliance oversight for STERIS's incident response program, providing guidance and support for cybersecurity non-technical initiatives, and for verifying that appropriate actions are taken following an incident occurrence. We have adopted and maintain an incident response policy that covers our incident response program and the duties and responsibilities of our Incident Response Team ("IRT") responsible for managing and responding to cybersecurity incidents, including data breaches. Our IRT is led by the CISO and is comprised of senior management and others, including external resources, as required. Our incident response policy includes steps for detecting and investigating cybersecurity incidents, assessing the nature, scope, and severity of cybersecurity threats, identifying the impact of cybersecurity incidents, communicating cybersecurity incident disclosures, and implementing cybersecurity countermeasures and mitigation strategies.


text: A subcommittee of our IRT reviews and assesses associated public reporting implications of cybersecurity incidents. Our process also includes informing the Board of Directors and the Audit Committee following a material cybersecurity incident.


text: We engage third-party security experts to support our risk assessment activities and to provide system security enhancements. Our program includes regular vulnerability and penetration testing (internal and external) of our enterprise systems by independent external security experts.


text: Education and awareness training on information security and data protection is conducted regularly for Associates. Members of the IRT, the Executive Cybersecurity Steering Committee and the Board of Directors receive additional training on responding to cybersecurity incidents.


text: Our Board of Directors has oversight responsibility for the ERM program, and delegates the risk management assessment and risk management approach, including risks related to cybersecurity, to its Audit Committee. Among other responsibilities, the Audit Committee is responsible for monitoring internal controls, including those related to cybersecurity risk.


text: Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to monitor such potential cybersecurity risk exposures, putting in place appropriate mitigation measures and maintaining the cybersecurity program. Our cybersecurity program for our information systems is directed by our CIO and, with the cybersecurity team, our CIO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO is CISSP-ISSMP and CISM certified and is part of a team of experienced information system security professionals with diverse certifications, including CISSP, CISM, CNSS, CEH, CySA+, CompTIA - Security+, CySA+, PenTest+, and CASP+ and others. Management, including the CIO and CISO, update the Audit Committee on a regular basis on our cybersecurity program, material cybersecurity risks, mitigation strategies, cybersecurity metrics, developments in cybersecurity and proposed updates to our cybersecurity program.


text: In fiscal year 2024, STERIS did not experience any cyberattack or other attempted intrusion or other incident with respect to our information systems that materially affected or was likely to materially affect our business strategy, results of operations, financial condition or cash flows. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced or will not experience in the future undetected cybersecurity incidents. For more information about these risks, please see "Item 1A Risk Factors" in this annual report on Form 10-K.


text: Cybersecurity Risk Management and Strategy At STERIS, the ERM program is designed to identify, assess, and manage risks across STERIS's enterprise. Cybersecurity risk management is integrated into STERIS's ERM program, under which we regularly assess cybersecurity risks in accordance with what we believe are industry cybersecurity best practices. Further, we implement controls to protect the confidentiality, integrity and availability of STERIS's information systems and information. We maintain cybersecurity and incident response procedures to address our security standards and requirements and provide a framework for assessing and responding to cybersecurity threats and incidents. Additionally, as part of our ERM program, STERIS oversees and identifies risks associated with third-party service providers with whom we do business, which process includes due diligence, risk management assessments and contractual safeguards. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cybersecurity issues.


text: STERIS has an Executive Cybersecurity Steering Committee consisting of the Senior Vice President & Chief Financial Officer, the Vice President, Chief Accounting Officer, the Vice President, Investor Relations & Corporate Communications, the Vice President & Chief Information Officer ("CIO"), the Vice President, Chief Compliance Officer, the Senior Vice President, General Counsel & Company Secretary, and the Vice President, Chief Information Security Officer ("CISO") that is responsible for providing governance, risk and compliance oversight for STERIS's incident response program, providing guidance and support for cybersecurity non-technical initiatives, and for verifying that appropriate actions are taken following an incident occurrence. We have adopted and maintain an incident response policy that covers our incident response program and the duties and responsibilities of our Incident Response Team ("IRT") responsible for managing and responding to cybersecurity incidents, including data breaches. Our IRT is led by the CISO and is comprised of senior management and others, including external resources, as required. Our incident response policy includes steps for detecting and investigating cybersecurity incidents, assessing the nature, scope, and severity of cybersecurity threats, identifying the impact of cybersecurity incidents, communicating cybersecurity incident disclosures, and implementing cybersecurity countermeasures and mitigation strategies. A subcommittee of our IRT reviews and assesses associated public reporting implications of cybersecurity incidents. Our process also includes informing the Board of Directors and the Audit Committee following a material cybersecurity incident.


text: Education and awareness training on information security and data protection is conducted regularly for employees. Members of the IRT, the Executive Cybersecurity Steering Committee and the Board of Directors receive additional training on responding to cybersecurity incidents.


text: Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to monitor such potential cybersecurity risk exposures, putting in place appropriate mitigation measures and maintaining the cybersecurity program. Our cybersecurity program for our information systems is directed by our CIO and, with the cybersecurity team, our CIO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CIO has a Bachelor of Science in Computer Engineering, a Master of Business Administration, and over 35 years of experience working in the information technology field, including approximately 20 years of CIO positions. Our CISO is CISSP-ISSMP and CISM certified and is part of a team of experienced information system security professionals with diverse certifications, including CISSP, CISM, CNSS, CEH, CySA+, CompTIA - Security+, CySA+, PenTest+, and CASP+ and others. Management, including the CIO and CISO, update the Audit Committee on a regular basis on our cybersecurity program, material cybersecurity risks, mitigation strategies, cybersecurity metrics, developments in cybersecurity and proposed updates to our cybersecurity program.


text: In fiscal year 2025, STERIS did not experience any cyberattack or other attempted intrusion or other incident with respect to our information systems that materially affected or was likely to materially affect our business strategy, results of operations, financial condition or cash flows. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced or will not experience in the future undetected cybersecurity incidents. For more information about these risks, please see "Item 1A Risk Factors" in this annual report on Form 10-K.


text: As a leader in building and operating electronic marketplaces, we face a broad set of cybersecurity risks stemming from managing complex technology systems, handling sensitive data, and the digital nature of our business. Managing cybersecurity risk is critically important to our business. We have comprehensive cybersecurity risk management and governance systems in place across our global operations designed to support successful operation of our systems.

companyName: Tradeweb Markets Inc.

ticker: TW


text: Risk Management and Strategy We operate in an environment where cybersecurity risks is a dynamic and evolving factor. We are committed to appropriately managing and minimizing the impact of cybersecurity risk on the achievement of our business objectives. We view cybersecurity risk management as a fundamental business process essential to our overall success. As such, we have integrated our cybersecurity program into our comprehensive Risk Framework, which is in place to support the management and oversight of risk across our organization. The Risk Framework establishes a consistent approach for identifying, assessing, measuring, mitigating, and reporting on material risks, including cybersecurity risks. The Risk Framework is composed of process components such as risk governance, risk identification and assessment, risk measurement, risk response and remediation and risk analysis and reporting.


text: The general objectives for our cybersecurity program are to protect our information systems from cyber threats and to protect the confidentiality, integrity and availability of systems and information used, owned, or managed by Tradeweb and our customers. This involves a comprehensive and ongoing effort to protect against, detect, and respond to cybersecurity threats and vulnerabilities. Our cybersecurity program includes a number of components, such as: • conducting regular risk assessments to identify potential vulnerabilities and threats; • implementing strong cybersecurity frameworks by adopting policies, standards and guidelines derived from a combination of ISO/IEC 27001 principles, the National Institute of Standards and Technology Cybersecurity Framework and industry best practices; • enforcing strict access control policies as appropriate; • implementing strong encryption protocols; • utilizing advanced threat detection systems; • conducting regular security audits and penetration testing; • conducting thorough security assessment of third-party vendors and service providers on an ongoing basis; and • continuous monitoring of our and third-party systems.


text: As part of our cybersecurity program, we have robust incident response and business continuity plans designed to provide a framework for quick and effective remediation of cyber issues, which are tested periodically throughout the year. Additionally, we have worked to create a culture of security by providing regular cybersecurity training to employees to raise awareness about various cyber threats like phishing, social engineering, and insider threats. We provide additional targeted training to individuals responsible for managing our information systems. We also maintain cyber insurance coverage intended to mitigate certain costs associated with certain cybersecurity events.


text: In addition, each year, we undergo System and Organization Controls ("SOC") 1 and SOC 2 audit reviews performed by an independent third-party firm to test our information technology systems internal controls. In 2023, we also engaged a third-party service provider to conduct a cybersecurity maturity assessment of our information security program. We also regularly engage additional assessors, auditors and service providers in connection with the implementation, assessment, enhancement and evaluation of our cybersecurity program, including our risk management processes.


text: We have not been a victim of a cyber-attack or other cybersecurity incident that has had a material impact on us, our business strategy, results of operations or financial condition; however, we have from time to time experienced non-significant cybersecurity events, including attempted denial of service attacks, malware infections, phishing and other information technology events that are typical for an electronic financial services company of our size. An actual, threatened or perceived cyber-attack or breach of our security could materially affect us, including our business strategy, results of operations and financial condition in many ways, including through the loss of clients or client confidence, expenditure of significant costs to repair system, network or infrastructure damages as well as to protect against future cyber-attacks, security breaches or harm and potential litigation or other claims or actions, including from regulatory agencies. For additional information regarding risks related to cybersecurity threats, see Part I, Item 1A. – "Risk Factors — Risks Relating to Cybersecurity and Intellectual Property — Actual or perceived security vulnerabilities in our systems, networks and infrastructure, breaches of security controls, unauthorized access to confidential or personal information or cyber-attacks could harm our business, reputation and results of operations" and "— Systems failures, interruptions, delays in service, catastrophic events and resulting interruptions in the availability of our platforms or solutions could materially harm our business and reputation."


text: Role of our Board of Directors The Board of Directors of Tradeweb Markets Inc. exercises direct oversight of the strategic risks to the Company. The Audit Committee of the Board reviews guidelines and policies governing the process by which senior management assesses and manages our exposure to risk, including our major financial and operational risk exposures including those derived from cybersecurity risk, and the steps management takes to monitor and control such exposures. Our Board and our Audit Committee each receive periodic reports from our Chief Information Security Officer and Chief Risk Officer to assess key cybersecurity risks for the Company and the measures implemented to mitigate them, as well as updates regarding changes to our cybersecurity risk profile or newly identified significant risks. In addition, the Audit Committee reports to the Board on these matters at each regularly scheduled Board meeting. The Board and Audit Committee provide feedback and recommendations accordingly.


text: Role of Management We operate on a "three lines of defense" risk governance model, with partnership and communication across the three lines. The first line of defense is comprised of the business and technology managers, the second line of defense is comprised of the Compliance, Risk and Information Security teams and the third line of defense is comprised of the Internal Audit function. The second and third lines of defense focus on providing the first line of defense with advisory and assurance functions for informed and actionable risk-based decisions. The Enterprise Risk Committee (the "ERC") is chaired by our Chief Risk Officer and includes our President, Chief Technology Officer, General Counsel, Global Head of Enterprise Risk, Chief Information Security Officer, Head of Global Compliance, Global Head of Human Resources, Head of Internal Audit and various global heads of business lines and corporate functions. The ERC is responsible for the governance and oversight of our Risk Framework, which includes cybersecurity risks. Its responsibilities include, supervising risk mitigation strategies and their implementation, overseeing compliance and regulatory aspects, managing crisis, approving risk tolerance, reviewing and approving material policy changes and evaluating the effectiveness of the organization's risk management practices. The ERC regularly obtains reports from the Chief Information Security Officer who maintains the primary responsibility for assessing and managing the cybersecurity risks, to evaluate the principal cybersecurity risks for the Company and review strategies in place to mitigate them. The ERC meets quarterly and reports to senior management, including the Chief Executive Officer and Chief Financial Officer. Senior management provides oversight and support in aligning cyber risk management with the Company's strategic decisions, fostering a culture of risk awareness across the organization and allocating adequate resources to support the initiatives.


text: Our Chief Information Security Officer leads a highly qualified cybersecurity team in assessing, managing and reducing material risks from cybersecurity threats to protect critical operations and delivery of service. Our Chief Information Security Officer has over 25 years of industry experience, with more than a decade of CISO experience at various financial institutions. Many members of the cybersecurity team hold Certified Information Systems Security Professional and Certified Information Systems Auditor certifications. In addition, our Global Head of Enterprise Risk has over a decade of experience managing enterprise risk programs and maintains multiple information security certifications. We also belong to several professional and recognized industry organizations related to cybersecurity, including FS-ISAC, FCA Cyber Coordination Group and SIFMA in order to stay up-to-date on industry-wide trends.


text: Risk Management and Strategy We operate in an environment where cybersecurity risk is dynamic and evolving. We are committed to appropriately managing and minimizing the impact of cybersecurity risk on the achievement of our business objectives. We view cybersecurity risk management as a fundamental business process essential to our overall success. As such, we have integrated our cybersecurity program into our comprehensive Risk Framework, which is in place to support the management and oversight of risk across our organization. The Risk Framework establishes a consistent approach for identifying, assessing, measuring, mitigating, and reporting on material risks, including cybersecurity risks. The Risk Framework is composed of process components such as risk governance, risk identification and assessment, risk measurement, risk response and remediation and risk analysis and reporting.


text: The general objectives for our cybersecurity program are to protect our information systems from cyber threats and to protect the confidentiality, integrity and availability of systems and information used, owned, or managed by Tradeweb and our customers. This involves a comprehensive and ongoing effort to protect against, detect, and respond to cybersecurity threats and vulnerabilities. Our cybersecurity program includes a number of components, such as: • conducting regular risk assessments to identify potential vulnerabilities and threats; • implementing strong cybersecurity frameworks by adopting policies, standards and guidelines derived from a combination of ISO/IEC 27001 principles, the National Institute of Standards and Technology Cybersecurity Framework and industry best practices; • enforcing strict access control policies as appropriate; • implementing strong encryption protocols; • utilizing advanced threat detection systems; • conducting regular security audits and penetration testing; • conducting thorough security assessments of third-party vendors and service providers on an ongoing basis; and • continuous monitoring of our and third-party systems.


text: In addition, each year, we undergo System and Organization Controls ("SOC") 1 and SOC 2 audit reviews performed by an independent third-party firm to test our information technology systems internal controls. We also regularly engage additional assessors, auditors and service providers in connection with the implementation, assessment, enhancement and evaluation of our cybersecurity program, including our risk management processes.


text: We have not been a victim of a cyber attack or other cybersecurity incident that has had a material impact on us, our business strategy, results of operations or financial condition; however, we have from time to time experienced non-significant cybersecurity events, including attempted denial of service attacks, malware infections, phishing, subversion of internal security controls and other information technology events that are typical for an electronic financial services company of our size. An actual, threatened or perceived cyber attack or breach of our security could materially affect us, including our business strategy, results of operations and financial condition in many ways, including through the loss of clients or client confidence, expenditure of significant costs to repair system, network or infrastructure damages as well as to protect against future cyber attacks, security breaches or harm and potential litigation or other claims or actions, including from regulatory agencies. These risks extend to the third parties we rely on to provide certain services, including technology services, to us. Please see Part I, Item 1A. —"Risk Factors—Risks Relating to the Operation and Performance of Our Business—We rely on third parties to perform certain key functions, and their failure to perform those functions could result in the interruption of our operations and systems and could result in significant costs and reputational damage to us." For additional information regarding risks related to cybersecurity threats, see also Part I, Item 1A. – "Risk Factors — Risks Relating to Cybersecurity and Intellectual Property Actual or perceived security vulnerabilities in our systems, networks and infrastructure, breaches of security controls, unauthorized access to confidential or personal information or cyber attacks could harm our business, reputation and results of operations" and "— Systems failures, interruptions, delays in service, catastrophic events and resulting interruptions in the availability of our platforms or solutions could materially harm our business and reputation."


text: Role of our Board of Directors The Board of Directors of Tradeweb Markets Inc. exercises direct oversight of the strategic risks to the Company. The Audit and Risk Committee of the Board reviews guidelines and policies governing the process by which senior management assesses and manages our exposure to risk, including our major financial and operational risk exposures including those derived from cybersecurity risk, and the steps management takes to monitor and control such exposures. Our Board and our Audit and Risk Committee each receive periodic reports from our Chief Information Security Officer, Chief Risk Officer and Chief Administrative Officer to assess key cybersecurity risks for the Company and the measures implemented to mitigate them, as well as updates regarding changes to our cybersecurity risk profile or newly identified significant risks. In addition, the Audit and Risk Committee reports to the Board on these matters at each regularly scheduled Board meeting. The Board and Audit and Risk Committee provide feedback and recommendations accordingly.


text: Role of Management We operate on a "three lines of defense" risk governance model, with partnership and communication across the three lines. The first line of defense is comprised of the business and technology managers, the second line of defense is comprised of the Compliance, Risk and Information Security teams and the third line of defense is comprised of the Internal Audit function. The second and third lines of defense focus on providing the first line of defense with advisory and assurance functions for informed and actionable risk-based decisions. The Enterprise Risk Committee (the "ERC") is chaired by our Chief Risk Officer and includes our Chief Technology Officer, General Counsel, Chief Administrative Officer, Global Head of Enterprise Risk, Chief Information Security Officer, Head of Global Compliance, Global Head of Human Resources, Head of Internal Audit and various global heads of business lines and corporate functions. The ERC is responsible for the governance and oversight of our Risk Framework, which includes cybersecurity risks. Its responsibilities include, supervising risk mitigation strategies and their implementation, overseeing compliance and regulatory aspects, managing crises, approving risk tolerance, reviewing and approving material policy changes and evaluating the effectiveness of the organization's risk management practices. The ERC regularly obtains reports from the Chief Information Security Officer who maintains the primary responsibility for assessing and managing the cybersecurity risks, to evaluate the principal cybersecurity risks for the Company and review strategies in place to mitigate them. The ERC meets quarterly and reports to senior management, including the Chief Executive Officer and Chief Financial Officer. Senior management provides oversight and support in aligning cyber risk management with the Company's strategic decisions, fostering a culture of risk awareness across the organization and allocating adequate resources to support the initiatives.


text: Our Chief Information Security Officer leads a highly qualified cybersecurity team in assessing, managing and reducing material risks from cybersecurity threats to protect critical operations and delivery of service. Our Chief Information Security Officer has over 25 years of industry experience, with more than a decade of CISO experience at various financial institutions. Many members of the cybersecurity team hold Certified Information Systems Security Professional and Certified Information Systems Auditor certifications. In addition, our Global Head of Enterprise Risk has more than a decade of experience managing enterprise risk programs and maintains multiple information security certifications. We also belong to several professional and recognized industry organizations related to cybersecurity, including FS-ISAC, FCA Cyber Coordination Group and SIFMA in order to stay up-to-date on industry-wide trends.


text: We maintain a cyber risk management program that is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The design of our program is based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework.

companyName: STEM, INC.

ticker: STEM


text: We have implemented a cyber incident response standard operating procedure (the "SOP") detailing actions to be taken in the event of a cyber incident. Pursuant to the SOP, any suspected cyber breaches or detected vulnerabilities are promptly reported by our cybersecurity team to our Chief Technology Officer ("CTO") and Chief Legal Officer ("CLO") for further assessment and/or remediation. In addition, we require our employees to regularly participate in mandatory cybersecurity training that covers critical aspects of digital security, including phishing prevention, threat awareness, and safe data handling practices. Cybersecurity risk considerations are also incorporated into our broader business continuity planning. In addition to our internal processes, our partnerships with various third-party vendors comprise a key component of our cyber risk management program. We engage several reputable third-party companies to monitor and maintain the performance and effectiveness of our products and services, as well as to conduct System and Organization Controls (SOC) assessments and our mandatory cybersecurity training for employees.


text: Our Compliance and Security Officer ("CSO") is the head of our experienced cybersecurity team and is responsible for assessing and managing our cyber risk management program. Our CSO collaborates with our business, engineering, human resources, legal, and other functions to implement and enforce our cyber policies. Our CSO reports to our CTO, and they collectively inform our senior management regarding the prevention, detection, mitigation, and remediation of incidents and vulnerabilities.


text: The Audit Committee of the Board of Directors (the "Board") oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Each quarter,, our CTO updates the Audit Committee on the development and effectiveness of our cyber risk management program. In addition, the Audit Committee is responsible for periodically reviewing and discussing with management our practices with respect to cybersecurity and information security risk management. In addition, cybersecurity risks are reviewed by the Board as part of the Company's corporate risk mapping exercise.


text: Although we have experienced, and will continue to experience, cyber incidents in the normal course of our business, prior cyber incidents have not had a material adverse effect on our business. For a further explanation of the cybersecurity risks and threats that we could be subject, see "A failure of our information technology and data security infrastructure could adversely affect our business and operations" in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: We have implemented a cyber incident response standard operating procedure (the "SOP") detailing actions to be taken in the event of a cyber incident. Pursuant to the SOP, any suspected cyber breaches or detected vulnerabilities are promptly reported by our cybersecurity team to our Chief Technology Officer ("CTO") and Chief Legal Officer ("CLO") for further assessment and/or remediation. In addition, we require our employees to regularly participate in mandatory cybersecurity training that covers critical aspects of digital security, including phishing prevention, threat awareness, and safe data handling practices. Cybersecurity risk considerations are also incorporated into our broader business continuity planning. In addition to our internal processes, our partnerships with various third-party vendors comprise a key component of our cyber risk management program. We engage several reputable third-party companies to monitor and work to maintain the performance and effectiveness of our products and services, as well as to conduct System and Organization Controls (SOC) assessments and our mandatory cybersecurity training for employees. We are also implementing systems and processes designed to oversee, identify and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use.


text: Our Compliance and Security Officer ("CSO"), who has extensive cybersecurity knowledge and skills gained from more than 20 years of work experience at the Company and elsewhere, is the head of our experienced cybersecurity team and is responsible for assessing and managing our cyber risk management program. The CSO receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CSO collaborates with our business, engineering, human resources, legal, and other functions to implement and enforce our cyber policies. Our CSO reports to our CTO, and they collectively inform our senior management regarding the prevention, detection, mitigation, and remediation of incidents and vulnerabilities.


text: The Audit Committee of the Board of Directors (the "Board") oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Each quarter, our CTO updates the Audit Committee on the development and effectiveness of our cyber risk management program. In addition, the Audit Committee is responsible for periodically reviewing and discussing with management our practices with respect to cybersecurity and information security risk management. In addition, cybersecurity risks are reviewed by the Board as part of the Company's corporate risk mapping exercise.


text: Although we have experienced, and will continue to experience, cyber incidents in the normal course of our business, as of the date of this report, prior cyber incidents have not had a material adverse effect on the Company, including our business strategy, results of operations, and financial conditions. For a further explanation of the cybersecurity risks and threats to which we could be subject, see "A failure of our information technology and data security infrastructure could adversely affect our business and operations" in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and approved medications ("Information Systems and Data").

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: Our information security team, supported by our legal and compliance departments, help identify, assess and manage our cybersecurity threats and risks. Our information security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, depending on the context, including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing certain reports of threats and threat actors, conducting scans of certain environments, evaluating our and our industry's risk profile, evaluating certain threats reported to us, conducting third-party threat assessments, coordinating with law enforcement about certain threats, conducting internal audits and threat assessments, and conducting vulnerability assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident detection and response procedures and policies; disaster recovery/business continuity plans; risk assessments; implementation of certain security controls; encryption of certain data; network security, access, and physical controls for certain systems; management, tracking and disposal of certain assets; systems monitoring; employee training; penetration tests by third-party service providers; tabletop exercises conducted by third parties; and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the information security team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional service firms such as legal counsel, threat intelligence providers, cybersecurity consultants and software providers, penetration testing services, and other third-party service providers including for identity management solutions.


text: We use third-party service providers to perform a variety of functions throughout our business application providers, hosting companies, contract research organizations (CROs), contract manufacturing organizations (CMOs), supply chain resources, and other business-related SaaS platforms. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes conducting risk assessments of certain vendors, reviewing certain vendors' security assessments, reviewing reports of certain of our vendors' security, and reviewing the written information security program of certain vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our business is subject to complex, stringent and evolving U.S. and foreign laws, regulations, and rules, contractual obligations, industry standards, policies and other obligations relating to privacy and data protection. Our actual or perceived failure to comply with such obligations could result in regulatory investigations or actions, litigations (including class claims) and mass arbitration demands, fines and penalties, disruptions of and changes to our business practices, monetary penalties, reputational harm, loss of revenue or profits, and other adverse business consequences."; and "If our information technology systems, or those used by our CMOs, CROs, commercial vendors or other contractors, consultants or third parties with whom we work, or our data are or were compromised, we could experience material adverse consequences, including but not limited to regulatory investigation, actions, litigation, fines and penalties, disruptions of our business operations, reputation harm, loss of revenue or profits, and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director of Information Technology/Information Security, Vice President, Legal, Chief Compliance Officer ("CCO"), and Chief Financial Officer ("CFO"). Our Executive Director of Information Technology/Information Security has over ten years of experience in information technology and security, and previously held positions such as Associate Director of Informational Technology and Operations, Senior Manager of Informational Technology, and similar roles at other companies.


text: Our Executive Director of Information Technology/Information Security is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, helping prepare for cybersecurity incidents, approving cybersecurity processes, reviewing security assessments and other security-related reports, and communicating key priorities to relevant personnel. Our CFO is responsible for approving budgets as related to cybersecurity.


text: Our incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Executive Director of Information Technology/Information Security, Data Protection Officer, and the Vice President, Legal. These individuals work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee of the board of directors receives annual reports from our Senior Director of Information Technology/Information Security concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee of the board of directors also receives and has access to various presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Lyft, Inc.

ticker: LYFT


text: We conduct a regular risk assessment process with monthly management reviews of the cybersecurity risk landscape to identify threats and may conduct further assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we may accept identified risks; re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Head of Security & Privacy who reports to our Chief Information Officer ("CIO"), to manage the risk assessment and mitigation process.


text: As part of our risk management processes, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings. We require relevant third-party service providers to confirm that they have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We regularly discuss our internal controls over financial reporting with our independent registered public accounting firm and other service providers assist us in evaluating the design and implementation of our cybersecurity controls and procedures, as well as to monitor and test our safeguards.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Any actual or perceived security or privacy breach or incident could interrupt our operations, harm our brand and adversely affect our reputation, brand, business, financial condition and results of operations."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors has oversight responsibilities for material risk for the company, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function as a whole, as well as through the audit committee.


text: Our Head of Security & Privacy has primary responsibility for assessing and managing our material risks from cybersecurity threats in partnership with our CIO and other business leaders. The Head of Security and Privacy has served in various roles within the cybersecurity field for over 15 years, including security leadership roles in multiple organizations. The Head of Security and Privacy holds an undergraduate degree in information security and forensics and a graduate degree in information assurance and has attained various professional certifications within the field including Certified Information Systems Security Professional and Certified Ethical Hacker certifications.


text: Our Head of Security & Privacy oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes and procedures by which our Head of Security & Privacy is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include our incident response process, tracking in our centralized risk repository, and our vulnerability management process. Our Incident Response policy describes and supports the activities we take to prepare for discovery, response, and recovery from cybersecurity incidents, which include processes to determine severity, escalation, and response to incidents, as well as those necessary to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: Our Head of Security & Privacy or other business leaders provide quarterly updates to the audit committee regarding our company's cybersecurity risks and activities. These updates include any relevant recent cybersecurity incidents and related mitigation and remediation efforts, cybersecurity systems testing, status updates on Security and Privacy team efforts, and the like. Our audit committee provides updates to the board of directors on material cybersecurity risks and activities.


text: Following these risk assessments, we may accept identified risks; re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer (CISO), who reports to our Chief Information Officer ("CIO"), to manage the risk assessment and mitigation process.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors, " in this annual report on Form 10-K, including the risk factor entitled "Any actual or perceived security or privacy breach or incident could interrupt our operations, harm our brand and adversely affect our reputation, brand, business, financial condition and results of operations."


text: Our CISO has primary responsibility for assessing and managing our material risks from cybersecurity threats in partnership with our CIO and other business leaders. The CISO has served in various roles within the cybersecurity field for over 15 years, including security leadership roles in multiple organizations. The CISO holds an undergraduate degree in information security and forensics and a graduate degree in information assurance and has attained various professional certifications within the field including Certified Information Systems Security Professional and Certified Ethical Hacker certifications.


text: Our CISO oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes and procedures by which our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include our incident response process, tracking in our centralized risk repository, and our vulnerability management process. Our Incident Response policy describes and supports the activities we take to prepare for discovery, response, and recovery from cybersecurity incidents, which include processes to determine severity, escalation, and response to incidents, as well as those necessary to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: Our CISO or other business leaders provide quarterly updates to the audit committee regarding our company's cybersecurity risks and activities. These updates include any relevant recent cybersecurity incidents and related mitigation and remediation efforts, cybersecurity systems testing, status updates on Security and Privacy team efforts, and the like. Our audit committee provides updates to the board of directors on material cybersecurity risks and activities.


text: Cybersecurity Risk Management and Strategy Maintaining our information security systems, communication networks, IT systems and data centers utilized by our business, and any outsourced service providers that may hold any data utilized by our business is crucial to the successful operation of our business.

companyName: Microvast Holdings, Inc.

ticker: MVST


text: The company has made investments in our technology to identify and manage the material risks of cybersecurity threats that could hinder our operations. As part of our regular cybersecurity risk management systems, we routinely reach out to external cybersecurity experts and third-party consultants to provide advice and implement changes in our current policies. The company also relies on the utilization of outsourced service providers who help provide certain functions that are key to the operations of our business. The company has taken steps to ensure the security of any data we might provide to these service providers and to ensure that our operations would be mitigated in terms of risk by engaging reputable service providers who maintain cybersecurity protection programs and protocols for their customers.


text: Microvast has established a combination of policies and procedures, and technologies have been designed and implemented, to prevent, detect, respond to, and recover from cybersecurity threats and incidents. Information security policies are regularly reviewed and updated. The policies were created using NIST-CSF framework to ensure that best practices for information security are being adhered to. Internal control tests are regularly performed to test the compliance of the policy processes and procedures and to remediate any identified gaps.


text: Effect of Cybersecurity Threats The company did not experienced a cybersecurity incident that materially impacted our operations during the year ended December 31, 2023, and the company is not aware of any active risks from cybersecurity incidents or risks that are reasonably likely to have a material impact on the operations of our business, including its business strategy, or financial condition. For more information on additional risks that the company might face regarding cyberattacks and cybersecurity, see "Risk Factors - Risks Related to our Business and Industry - Cyberattacks or risks related to cybersecurity could have a material effect on our business."


text: Cybersecurity Governance On July 26, 2023, the SEC adopted a final rule requiring registrants to disclose certain information related to the registrants' policies regarding cybersecurity risk management and strategy in addition to current policies regarding cybersecurity governance.


text: Microvast's SVP of Information Technology and the Information Security Manager are responsible for assessing as well as managing and determining the risks that could potentially have material impact on Microvast operations and business activity.


text: The SVP of Information Technology and the Information Security Manager have both worked in the Cybersecurity realm for many years. Both have led information security teams and have deep knowledge of the requirements for implementing and managing a cybersecurity program. Their expertise and experience include establishing policies and procedures, compliance enforcement, and the ability to identify potential security risks and develop strategies for mitigating those risks, incident response planning and threat mitigation.


text: The management team plays a crucial role in the cybersecurity process by setting the tone for the organization's approach to cybersecurity and ensuring that it is integrated into the overall business strategy. Key responsibilities of Microvast management in cybersecurity include: • setting security objectives: establishing clear security objectives that align with the organization's overall goals and risk tolerance. • resource allocation: ensuring sufficient resources, including budget, personnel, and technology, to effectively manage cybersecurity risks. • policy development: ensuring security policies and procedures align with industry standards and best practices. • risk Management: overseeing the organization's risk management program including conducting regular risk assessments and implementing controls to mitigate identified risks. • incident response: Providing oversight and ensuring that the organization has an effective incident response plan that has been tested and employees trained on how to effectively respond to cybersecurity incidents promptly and appropriately. • compliance: ensuring that the organization complies with relevant and applicable cybersecurity regulations and standards and stays abreast of emerging threats and best practices.


text: The Board reviews and evaluates the organization's effectiveness to manage cybersecurity threats. The SVP of Information Technology, the General Counsel, and the CEO are responsible for reporting and communicating cybersecurity threats that have material impact on the organization to the Board. The Board regularly reviews the organization's risk posture and provides guidance to minimize or mitigate risk.


text: Cybersecurity Risk Management and Strategy The security and integrity of our information systems, communication networks, IT infrastructure, and data centers are critical to the successful operation of our business.


text: As such, we have invested in advanced technologies to identify and manage material cybersecurity risks that could impede our operations. We also engage reputable outsourced service providers to perform key operational functions, ensuring comprehensive protection of shared data and adherence to rigorous cybersecurity protocols.


text: Microvast utilizes a set of policies, procedures, and technologies designed to prevent, detect, respond to, and recover from cybersecurity threats and incidents. These policies, based on the NIST Cybersecurity Framework, are regularly reviewed and updated to integrate industry best practices. Internal control evaluations are conducted routinely to ensure compliance and address any identified vulnerabilities.


text: Our company did not experience any cybersecurity incidents that materially impacted our operations for the year ended December 31, 2024. We remain unaware of any active threats that could significantly affect our business strategy or financial condition. For more information on cybersecurity risks, see "Risk Factors — Risks Related to Our Business and Industry."


text: Cybersecurity Governance On July 26, 2023, the SEC adopted a rule requiring enhanced disclosure of cybersecurity risk management, strategy, and governance. Microvast's SVP of Information Technology, is responsible for risk assessment and management. This individual has experience in developing security policies, enforcing compliance, orchestrating incident responses, and implementing cybersecurity strategies.


text: Management is actively involved in cybersecurity governance, ensuring alignment with our overall business strategy. Their responsibilities include: • Security Objectives: Establishing security goals that correspond with corporate objectives and risk appetite. • Resource Allocation: Providing adequate resources, including budget and personnel, to address cybersecurity risks effectively. • Policy Development: Developing and maintaining policies that meet industry standards. • Risk Management: Directing risk management initiatives and instituting control measures to mitigate recognized risks. • Incident Response: Overseeing the implementation and regular testing of incident response plans, with employee training to ensure effective response capabilities. • Compliance: Ensuring adherence to applicable regulations, while remaining vigilant about emerging threats.


text: Our Board of Directors evaluates our readiness to manage cybersecurity threats, receiving regular updates from the SVP of Information Technology, General Counsel, and CEO regarding any materially impactful cybersecurity risks.


text: Specific Cybersecurity Measures Microvast has implemented various cybersecurity measures, including, but not limited to the following: • Establishing physical security protocols and securing network access via VPN. • Requiring multi-factor authentication for email and collaboration platforms. • Deploying endpoint detection and response (EDR) and antivirus solutions across all devices. • Enforcing strong password policies with a secured password vault for system credentials. • Minimizing attack vectors by eliminating external web-facing business-critical applications. • Utilizing encryption technologies to safeguard intellectual property and mitigate data loss risks. • Developing a comprehensive suite of information security policies and a strategic information security roadmap. • Implementing a Security Information and Event Management (SIEM) system.


text: These efforts, coupled with the isolation of industrial networks and structured software installation processes, demonstrate our continued commitment to maintaining robust cybersecurity defenses.


text: The Company's Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board of Directors is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and procedures are fully integrated into the Company's information technology practices and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Kontoor Brands, Inc.

ticker: KTB


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance


text: As discussed in more detail under the heading "Governance," The Board of Directors' oversight of cybersecurity risk management is led by the Audit Committee of the Board of Directors (the "Audit Committee"), which interacts quarterly with the Company's ERM function, the Company's Chief Information Security Officer ("CISO"), other members of management and relevant management committees and councils.


text: • Collaborative Approach The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. In the event that the Company experiences a cybersecurity incident it will take steps to contain, assess and remediate the incident. • Technical Safeguards The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Audit Committee, under the oversight of the Board of Directors, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board of Directors and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board of Directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: The CISO, in coordination with the Chief Information Officer ("CIO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.


text: The CISO has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Security Officer of two large international companies. The CISO holds an undergraduate degree in business and is pursuing a master's degree in business. The CISO also has attained the professional certification of Certified Information Systems Security Professional (CISSP). The CIO holds an undergraduate degree in business and has served in various roles in information technology for over 30 years, including serving as either the Chief Technology Officer or Chief Information Officer of four public companies. The Company's Chief Executive Officer and Chief Financial Officer each hold undergraduate and graduate degrees in their respective fields, and each have over 10 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Notwithstanding any of these measures, our systems, networks, products and services remain potentially vulnerable to known or unknown cybersecurity attacks and other threats, any of which could have a material adverse effect on our consolidated results of operations, financial condition and cash flows. We have experienced, and will continue to experience, cyber incidents in the normal course of our business. As of the date of this report, we have not identified any risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, our business strategy, results of operation or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on us will not occur in the future. For additional information on the risks we face from cybersecurity threats, please see the risk factor titled, "We are subject to data security and privacy risks that could negatively affect our business operations, results of operations or reputation" in Item 1A. "Risk Factors."


text: The Company's Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board of Directors is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes and procedures are fully integrated into the Company's information technology practices and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: As discussed in more detail below under the heading "Governance," the Board of Directors' oversight of cybersecurity risk management is led by the Audit Committee of the Board of Directors (the "Audit Committee"), which interacts quarterly with the Company's ERM function, the Company's Chief Information Security Officer ("CISO"), other members of management and relevant management committees and councils.


text: • Collaborative Approach The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. In the event the Company experiences a cybersecurity incident, it will take steps to contain, assess and remediate the incident. • Technical Safeguards The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The CISO, in coordination with the Chief Information Officer ("CIO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee and the Board of Directors when appropriate.


text: The CISO has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Security Officer of two large international companies. The CISO holds an undergraduate degree in business and a master's degree in business administration. The CISO also has attained the professional certification of Certified Information Systems Security Professional (CISSP). The CIO holds an undergraduate degree in business and has served in various roles in information technology for over 30 years, including serving as either the Chief Technology Officer or Chief Information Officer of four public companies. The Company's Chief Executive Officer and Chief Financial Officer each hold undergraduate and graduate degrees in their respective fields, and each have over 10 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Risk Management and Strategy As part of our enterprise risk management function, we have implemented processes to assess, identify and manage the material risks facing our company, including risks from cybersecurity threats. Our enterprise risk management function represents our overall risk management system. Our cybersecurity program is built upon recognized security frameworks. We believe that our processes provide us with a comprehensive assessment of potential cybersecurity threats. We conduct regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage the material risks from cybersecurity threats include the risks arising from threats associated with third-party service providers, including cloud-based platforms.

companyName: Crown Electrokinetics Corp.

ticker: CRKN


text: We rely heavily on our information technology ("IT") systems across various aspects of our operations, from product development to customer relations. Given the innovative nature of our business, particularly in the realms of smart glass and fiber optics, ensuring the security, integrity, and availability of data is paramount. We operate in an environment where the protection of intellectual property and sensitive data, including proprietary technology information and customer data, is critical. We are therefore committed to a comprehensive cybersecurity strategy that encompasses not only compliance with relevant privacy laws but also proactive risk management.


text: Our cybersecurity framework is overseen its Information Technology ("IT") Team. The IT team is geared towards developing and refining a risk-informed decision-making process, emphasizing the early identification and mitigation of cybersecurity risks. The IT Leader leads the charge in implementing a cybersecurity risk management program, employing a mix of technological tools, rigorous processes, and external assessments to safeguard our assets. Regular training programs, including those focused on phishing and secure data handling, are mandatory for all employees, reinforcing the culture of cybersecurity awareness.


text: Despite robust security measures, we acknowledge the possibility of cyber threats breaching its defenses. We have developed a cybersecurity incident response plan that provides a documented framework for handling cybersecurity incidents and facilitates coordination across multiple parts of the Company. This includes a structured procedure for incident detection, analysis, containment, and recovery, underscored by the IT Leader for material incident evaluation and communication.


text: Given the integration of third-party services within our operational framework, we extend our cybersecurity vigilance to our partners and suppliers. This includes contractual safeguards and continuous monitoring to manage and mitigate risks presented by external entities.


text: To date, we have not experienced a cybersecurity incident that has had a material impact on our business strategy, results of operations or financial condition, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, as discussed more fully under "Item 1A. Risk Factors," cybersecurity attacks are continually evolving to become more sophisticated and, while we have invested in the protection of our data and information technology to reduce the risk of a cybersecurity incident, our efforts may not be effective in preventing breakdowns or breaches in our systems.


text: Board's Roles and Responsibilities The governance of cybersecurity within our is structured to ensure a clear delineation of oversight responsibilities. The Board of Directors, particularly through its Audit Committee, plays a crucial role in supervising our cybersecurity posture. The Audit Committee is composed of individuals with deep expertise in risk management, finance, and technology, enabling it to provide informed oversight of cybersecurity risks. Periodic briefings that are held ensures that the Board of Directors remains actively engaged in guiding and evaluating our cybersecurity strategy.


text: Management's Roles and Responsibilities Operational responsibility for cybersecurity falls to the management, led by the IT department. The management team is tasked with executing our cybersecurity strategy, focusing on risk assessment, incident prevention, and response. This includes conducting vulnerability assessments, ensuring continuous monitoring, and staying updated on cybersecurity trends and threats. The Software Engineer, with extensive experience in information security, works in close coordination with other key management roles to ensure a unified approach to cybersecurity across our company.


text: Our approach to cybersecurity is integral to its operations, reflecting a commitment to safeguarding its innovative technologies and sensitive data. Through a combination of strategic oversight by the Board of Directors and diligent execution by management, we aim to uphold the highest standards of cybersecurity resilience and integrity.


text: Cybersecurity Risk Management The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company, from time-to-time, may engage third-party consultants, legal advisors, and audit firms to evaluate and test the Company's risk management systems and assess and remediate certain potential cybersecurity incidents, as appropriate.

companyName: Acreage Holdings, Inc.


text: As part of our enterprise risk management program, the Board of Directors (the "Board") meets with our senior management team, which includes our Chief Executive Officer, Chief Financial Officer, and General Counsel to address risks associated with cybersecurity threats on a regular basis. The Board receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been resolved.


text: Cybersecurity threats are one of the Company's most critical risks, with our Senior Director of Technology assigned as the executive risk owner. Our Senior Director of Technology, in coordination with our senior management team, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. Multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Senior Director of Technology and the senior management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Board, when appropriate.


text: Our Senior Director of Technology boasts over ten years of experience spearheading technology operations for organizations with a keen emphasis on cybersecurity. His extensive background has been pivotal in shaping our cybersecurity policies, implementing our cybersecurity program, and supervising information governance and compliance measures.


text: During the year ended December 31, 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. See "Item 1 A. Risk Factors" for more information on the Company's cybersecurity-related risks.


text: Risk Management and Strategy We have established certain processes designed to assess, identify and manage cybersecurity risks, which are built into our information technology functions and are designed to help protect our information assets and operations from internal and external cyber threats. Our cybersecurity risk management processes target integral areas such as data protection, access control, incident response and vulnerability management and are integrated into our overall enterprise risk management process. As part of our overall enterprise risk management process, our company's information technology functions, including our Information Technology department leaders and third-party service providers, identify, assess and evaluate cybersecurity risks impacting our operations across the Company.

companyName: Immunovant, Inc.

ticker: IMVT


text: Depending on the information systems and environment, our cybersecurity program includes various administrative, physical, and technical safeguards designed to manage and mitigate material risks from cybersecurity threats, including, for example: an incident response plan, incident detection and response, risk assessments, encryption of data, network security controls, data segregation, access controls, physical security, systems monitoring, a vendor risk management program, penetration testing, cybersecurity insurance, dedicated cybersecurity staff, and asset management, tracking and disposal. Additionally, we provide all employees, including part-time and temporary employees, with annual and ad hoc cybersecurity awareness training.