text: The Company's Chief Information Officer ("CIO") oversees the Company's information technology programs and investments. The Company's CIO has over 20 years of information technology experience, including ten years in various information technology leadership roles. Our CIO holds a Bachelor of Science in Information Technology. The Company's Chief Security Officer ("CSO") reports to the Chief Risk Officer and oversees the Company's information security programs. The CSO possesses over 20 years of Information Security and Technology experience.


text: Our Risk Management Committee, which includes the Company's Chief Risk Officer (Chair), Director of Risk Management and CSO, assesses and monitors the effectiveness of the Company's cybersecurity risk management program. The Company's internal audit function also performs independent reviews and validation of the program, including policies and procedures as determined by their annual risk assessment.

companyName: Bankwell Financial Group, Inc.

ticker: BWFG

secItem: Item 1C


text: Both the CIO and CSO regularly report to the Board's Risk Committee on the Company's identification, prevention, detection, mitigation and remediation of cybersecurity risks and incidents. In 2024, the Risk Committee reviewed the Company's cybersecurity program and maturity assessment, provided regular oversight of cybersecurity risks, with cybersecurity discussions and dashboard reviews of key performance indicators and risks during the course of the year. With respect to specific incidents, the Company leverages an incident response framework to elevate and evaluate specific incidents to the CIO and CSO, along with the Company's senior leadership, including the finance, compliance, and legal functions. In the event of a potentially material cybersecurity incident, the Risk Committee would be immediately notified and briefed.


text: In January 2025, the Company hired a Chief Technology Officer ("CTO"), who oversees the Company's information technology programs and investments. The CTO now encompasses the responsibilities previously held by the Chief Information Officer.


text: In the ordinary course of our business, we receive, process, use, store, and share digitally large amounts of data, including user data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to our operations and business strategy. To this end, we have implemented a program designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them.

companyName: PINTEREST, INC.

ticker: PINS


text: The program is managed and monitored by a dedicated security team, which is led by our Chief Security Officer and includes mechanisms, controls, technologies, systems, policies and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the systems and data residing in them. For example, we conduct risk-based penetration and vulnerability testing and ongoing risk assessments, including due diligence on our key technology vendors and other contractors and suppliers. We also conduct employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.


text: Our Chief Security Officer, who reports directly to the Chief Technology Officer and has over 25 years of experience managing information technology and cybersecurity matters, including more than five years at Pinterest, together with our Privacy and Data Protection Team, are responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified any prior cybersecurity incidents that have materially affected us, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks related to Data, Security and Privacy."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit and Risk Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit and Risk Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Chief Security Officer as well as other members of the senior leadership team. The Board also receives periodic updates from management and the Audit and Risk Committee on cybersecurity risks.


text: In the ordinary course of our business, we receive, process, use, store, and share digitally large amounts of data, including user data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to our operations and business strategy. To this end, we have implemented a program designed to assess, identify and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them. Our cybersecurity program is informed in part by industry standards and best practice, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.


text: The program is managed and monitored by a dedicated security team, which is led by our Chief Security Officer and includes mechanisms, controls, technologies, systems, policies and other processes designed to prevent or mitigate data loss, theft, misuse or other security incidents or vulnerabilities affecting the systems and data residing in them. For example, we conduct risk-based penetration and vulnerability testing and ongoing risk assessments, including due diligence prior to engagement on and ongoing risk-based periodic audits of our key technology vendors and other contractors and suppliers. We also conduct employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts to assist with assessing, identifying and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.


text: Our Chief Security Officer, who reports directly to the Chief Technology Officer and has over 25 years of experience managing information technology and cybersecurity matters, including more than six years at Pinterest, together with our Privacy and Data Protection Team, are responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have not identified any prior cybersecurity incidents that have materially affected us, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks related to Data, Security and Privacy."


text: We employ a comprehensive strategy for identifying and addressing cybersecurity risks that is aligned with the U.S. Department of Commerce's National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity. This framework outlines standards and practices to promote the protection of critical infrastructure. We utilize a risk-based approach that focuses on critical systems where failure or exploitation could potentially impact the safety or reliability of our key assets or operations. Cybersecurity risks are integrated into our overall risk management processes, including, for example, quarterly security briefings with senior management, tabletop exercises with operations, finance and other company personnel, and by employing a continuous improvement model for our cyber protection strategy that is aligned with the DHS's National Infrastructure Protection Plan risk management framework.

companyName: KINDER MORGAN, INC.

ticker: KMI


text: Our management team has engaged third-party experts to provide guidance related to management of supply chain cybersecurity risks. Our strategy includes both short- and long-term initiatives to increase the security surrounding our assets and is supplemented using third-party threat monitoring, rigorous security protocols, and government partnerships. We perform cybersecurity assessments with respect to third parties who provide critical services or who have access to or store critical confidential data.


text: We have not identified any cybersecurity threats that have materially impaired or are reasonably likely to materially impair our operations or financial standing. Please read Item 1A. "Risk Factors—Risks Related to Our Business—A breach of information security or the failure of one or more key information technology (IT) or operational (OT) systems, or those of third parties, may adversely affect our business, results of operations or business reputation." and " Attacks, including acts of terrorism or cyber sabotage, or the threat of such attacks, may adversely affect our business or reputation." for discussions of risks from cybersecurity threats we face.


text: Measures We Take to Monitor and our Procedures for Responding to Data Breaches or Cyberattacks We have made investments to address data and cybersecurity risks. These investments include our use of continuous third-party security monitoring of our network perimeters, advanced persistent threat group monitoring to keep us informed of emerging serious threats, standardization of our network security architecture which separates business and supervisory control and data acquisition (SCADA) networks, and security information and event management software systems.


text: Our critical business systems are fully redundant and backed up at separate locations. Separate business and SCADA networks allow for isolation of potential threats and enhances the security of these systems. Our security systems correlate security events and aggregate security-related incident data, such as malware activity and other possible malicious activities. This system sends alerts if the data analysis shows that an activity could be a potential security issue. Security functionality is continuously monitored by our network operations center, and our network traffic is analyzed for signs of malicious activity through the CyberSentry program, which is managed by DHS's Cybersecurity and Infrastructure Security Agency and a third-party security operations center, which operates continuously. We maintain a dedicated SCADA group within our IT department to evaluate and respond to significant events and incidents that may impact our operations. Anti-virus solutions are deployed on the SCADA systems and workstations in our data centers and control centers.


text: Our processes and cybersecurity plans are part of our overall emergency response plans, and we conduct simulated exercise drills, including with multiple U.S. government agencies and peer companies, to enhance our preparedness and provide for continual process improvement.


text: If data and network defenses are bypassed, processes detailed in our Cyber Incident Response Plan would help identify, contain and eradicate threats and bring our systems back online if needed. Additionally, the plan requires that the appropriate level of our management be made aware of incidents and be updated as the situation warrants.


text: Vulnerability Assessments and Penetration Testing We hire an independent third-party cybersecurity firm to perform penetration testing annually. The third-party checks for vulnerabilities on our external and internal network perimeters. If vulnerabilities are found, corrective actions are implemented to remediate any issues.


text: Government and Industry Group Engagement We engage with a wide variety of government agencies and industry groups to enable cross-sharing of information and to identify opportunities to improve our security, including active participation in IT Sector Coordinating Councils and attendance at classified briefings and security architecture reviews hosted by the U.S. Department of Energy, the U.S. Federal Bureau of Investigation and DHS. Partnership with these agencies provides us with intelligence on a wide range of critical infrastructure protection and cybersecurity issues as well as an opportunity to exchange best practices.


text: Employee Training Our employees are required to take annual cyber and physical security training designed to help employees guard our cyber and physical data. Employees are tested on this training and cybersecurity performance is considered in annual employee performance reviews.


text: Cybersecurity Governance Structures Management's Role in Managing Cybersecurity Risk We are committed to protecting sensitive information and have a dedicated cybersecurity group within our IT department that is overseen by our Chief Information Officer. This group provides a quarterly cybersecurity report to our senior management, including the Chief Executive Officer, President, Chief Financial Officer, Chief Operating Officer, Chief Administrative Officer, Chief Information Officer, General Counsel, business segment Presidents and the Vice President—Corporate Security. This senior management team is involved in all significant cybersecurity decisions, including efforts undertaken to comply with the security directives issued by the TSA. Our Chief Executive Officer, General Counsel and our Chief Information Officer have attended classified briefings on cybersecurity in Washington, D.C. In addition to the quarterly reports to senior management, the cybersecurity team prepares broader management briefings that include updates regarding company-wide cybersecurity matters and initiatives and provide a forum for discussing data security risk solutions and formulating action plans.


text: Management of our cybersecurity team has extensive experience and training related to cybersecurity matters. These leaders hold top-secret clearance from the U.S. federal government and have attended classified briefings from relevant federal agencies. Our cybersecurity team has in excess of 120 years of combined cybersecurity experience as of year-end 2023, and members of the team hold various specialized certifications related to cybersecurity, including training related to penetration testing and information system auditing.


text: The Board's Role in Cybersecurity Risk Oversight The Audit Committee of our Board has oversight responsibility related to cybersecurity risk and is briefed quarterly by our Chief Information Officer on cybersecurity risk, our cybersecurity management program and initiatives, and, if applicable, notable cybersecurity events. In the event of a significant cybersecurity incident, our Chief Executive Officer will notify the Chairman of the Board or, in that person's absence, the lead independent director of the Board.


text: We employ a comprehensive strategy for identifying and addressing cybersecurity risks that is consistent with the security directives issued by TSA where required and aligned with the U.S. Department of Commerce's National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity. This framework outlines standards and practices to promote the protection of critical infrastructure. We utilize a risk-based approach that focuses on critical systems where failure or exploitation could potentially impact the safety or reliability of our key assets or operations. Cybersecurity risks are integrated into our overall risk management processes, including, for example, quarterly security briefings with senior management, tabletop exercises with operations, finance and other company personnel, and by employing a continuous improvement model for our cyber protection strategy that is aligned with the DHS's National Infrastructure Protection Plan risk management framework.


text: We have not identified any cybersecurity threats that have materially impaired or are reasonably likely to materially impair our operations or financial standing. Please read Item 1A. "Risk Factors—Risks Related to Our Business—A breach of information security or the failure of one or more key IT or operational (OT) systems, or those of third parties, may adversely affect our business, results of operations or business reputation." and " Attacks, including acts of terrorism or cyber sabotage, or the threat of such attacks, may adversely affect our business or reputation." for discussions of risks from cybersecurity threats we face.


text: Employee Training Our employees are required to take annual cyber and physical security training designed to help employees guard our cyber and physical data. Employees are tested regularly on cybersecurity, and cybersecurity performance is considered in annual employee performance reviews.


text: Cybersecurity Governance Structures Management's Role in Managing Cybersecurity Risk We are committed to protecting sensitive information and have a dedicated cybersecurity group within our IT department that is overseen by our Chief Information Officer. This group provides a quarterly cybersecurity report to our senior management, including the Chief Executive Officer, President, Chief Financial Officer, Chief Operating Officer, Chief Administrative Officer, Chief Information Officer, General Counsel, business segment Presidents and the Vice President—Corporate Security. This senior management team is involved in all significant cybersecurity decisions, including efforts undertaken to comply with the security directives issued by the TSA. Our Chief Information Officer and, occasionally, our Chief Executive Officer and our General Counsel have attended classified briefings on cybersecurity in Washington, D.C. In addition to the quarterly reports to senior management, the cybersecurity team prepares broader management briefings that include updates regarding company-wide cybersecurity matters and initiatives and provide a forum for discussing data security risk solutions and formulating action plans.


text: Management of our cybersecurity team has extensive experience and training related to cybersecurity matters. These leaders hold top-secret clearance from the U.S. federal government and have attended classified briefings from relevant federal agencies. Our cybersecurity team has in excess of 100 years of combined cybersecurity experience as of year-end 2024, and members of the team hold various specialized certifications related to cybersecurity, including training related to penetration testing and information system auditing.


text: Cybersecurity is the responsibility of our information security team, overseen by our Chief Information Security Officer ("CISO"). Our CISO reports to our Chief Information Officer ("CIO"), and our CISO and CIO regularly meet with our General Counsel to review cybersecurity risks, and evaluate their nature and severity, as well as identify potential mitigation and assess the impact of those mitigations on residual risk. Our enterprise risk management program also considers cybersecurity risks, including risks associated with our use of third-party service providers, alongside other company risks, and as part of these efforts, we gather information necessary to identify cybersecurity risks, and evaluate their nature and severity, as well as identify mitigations and assess the impact of those mitigations on residual risk. Our enterprise risk management program is reviewed annually with our Board.

companyName: Floor & Decor Holdings, Inc.

ticker: FND


text: We maintain a system of data protection and cybersecurity resources, technology, and processes. We regularly evaluate new and emerging risks and ever-changing legal and compliance requirements. We make strategic investments to address these risks and compliance requirements. We also perform annual and ongoing cybersecurity awareness training, which includes regular simulated phishing campaigns. We also run tabletop exercises, including with external advisors, to simulate a response to a cybersecurity incident, and we use the findings to improve our practices, procedures, incident response plan, and technologies. In the event of a cybersecurity incident, we have worked with external advisors to develop an incident response plan, which provides guidelines for responding to an incident and facilitates coordination across multiple parts of our Company. The incident response plan includes a procedure for notifying the CISO and CIO of any incident as well as a procedure for reporting any material incidents to the Audit Committee of our Board (the "Audit Committee") and Board as appropriate.


text: Our cybersecurity risk program is structured according to the National Institute of Standards and Technology (NIST) Cybersecurity framework. This program includes multiple layers of security controls, including network segmentation, security monitoring, endpoint protect, and identity and access management. The Company annually engages third parties to advise and assess the Company's cybersecurity programs, including to engage in penetration testing. The results of these assessments are reported to the CISO and our CISO, in consultation with our CIO and General Counsel, use the findings to improve our practices, procedures, and technologies. A summary of our cybersecurity efforts is reported to the Audit Committee, which has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity, regularly. Our Board also receives periodic updates relating to information security and cybersecurity risks. We have also purchased cyber liability insurance to provide a level of financial protection against the potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover or be sufficient to cover all losses or claims that may result from a cybersecurity incident.


text: Our CISO, CIO, and General Counsel collectively have over 35 years of business experience managing risks from cybersecurity threats and developing and implementing cybersecurity policies and procedures. Team members who support our information security program have relevant educational and industry experience.


text: In the last three fiscal years, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Risk Factors— Risks Related to our Business—If our efforts to protect the privacy and security of information related to our customers, us, our associates, our suppliers and other third parties are not successful, we could become subject to litigation, investigations, liability and negative publicity that could significantly harm our reputation and relationships with our customers and adversely affect our business, financial condition, and operating results." and "Risk Factors— Risks Related to our Business—A material disruption in our information systems, including our website or call center, could adversely affect our business or operating results and lead to reduced net sales and reputational damage." in Part 1 of this Annual Report.


text: Cybersecurity is the responsibility of our information security team, overseen by our Chief Information Security Officer ("CISO"). Our CISO reports to our Chief Information Officer ("CIO"), and our CISO and CIO regularly meet with our Chief Legal Officer ("CLO") to review cybersecurity risks and evaluate their nature and severity, as well as identify potential mitigations and assess the impact of those mitigations on residual risk. Our enterprise risk management program also considers cybersecurity risks, including risks associated with our use of third-party service providers, alongside other company risks, and as part of these efforts, we gather information necessary to identify cybersecurity risks and evaluate their nature and severity, as well as identify mitigations and assess the impact of those mitigations on residual risk. Our enterprise risk management program is reviewed annually with our Board.


text: Our cybersecurity risk program is structured according to the National Institute of Standards and Technology (NIST) Cybersecurity framework. This program includes multiple layers of security controls, including network segmentation, security monitoring, endpoint protection, and identity and access management. The Company annually engages third parties to advise and assess the Company's cybersecurity programs, including to engage in penetration testing. The results of these assessments are reported to the CISO, and our CISO, in consultation with our CIO and CLO, uses the findings to improve our practices, procedures, and technologies. A summary of our cybersecurity efforts is reported periodically to the Audit Committee, which has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Our Board also receives periodic updates relating to information security and cybersecurity risks. We have also purchased cyber liability insurance to provide a level of financial protection against the potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover or be sufficient to cover all losses or claims that may result from a cybersecurity incident.


text: Our CISO, CIO, and CLO collectively have over 35 years of business experience managing risks from cybersecurity threats and developing and implementing cybersecurity policies and procedures. Team members who support our information security program have relevant educational and industry experience.


text: During fiscal years 2024, 2023, and 2022, we did not experience a material information security breach incident, and the expenses we have incurred from information security breach incidents have been immaterial. We are not currently aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats that are reasonably likely to materially affect us, refer to Item 1A, "Risk Factors" in Part I of this Annual Report.


text: Information Security Program The mission of our information security organization is to design, implement, and maintain an information security program that protects our systems, services, and data against unauthorized access, disclosure, modification, damage, and loss. The information security organization is comprised of internal and external security and technology professionals. We continue to make investments in information security resources to mature, expand, and adapt our capabilities to address emerging cybersecurity risks and threats. The information security organization is overseen by the Information Security Advisory Team (the "ISAT"), further detailed under the caption "Cybersecurity Governance" below.

companyName: MARA Holdings, Inc.

ticker: MARA


text: Cybersecurity risk management is one component of our information security program that guides continuous improvement to, and evaluates the confidentiality, integrity, and availability of our critical systems, data, and operations.


text: Our approach to controls and risk management is based on guidance from the National Institute of Standards and Technology ("NIST") and the CryptoCurrency Security Standard ("CCSS"). This does not mean that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST and CCSS as a guide to help us identify, assess, and manage cybersecurity controls and risks relevant to our business.


text: Our cybersecurity risk management program includes: • Identifying cybersecurity risks that could impact our facilities, third-party vendors/partners, operations, critical systems, information, and broader enterprise information technology ("IT") environment. Risks are informed by threat intelligence, current and historical adversarial activity, and industry specify threats; • Performing a cybersecurity risk assessment to evaluate our readiness if the risks were to materialize; and • Ensuring risk is addressed and tracking any necessary remediation through an action plan.


text: In addition, we periodically engage third-party consultants and providers to assist us in assessing, testing, enhancing and monitoring our cybersecurity risk management programs and responding to any incidents. These third parties work in conjunction with the ISAT in an effort to continuously improve our cybersecurity risk posture. Examples of third-party actions include risk assessments and penetration testing of our systems.


text: While we face a number of ongoing cybersecurity risks in connection with our business, such risks have not materially affected us to date, including our business strategy, results of operations, or financial condition.


text: Our Board of Directors (the "Board") considers cybersecurity risk as part of its risk oversight function and has delegated the oversight of cybersecurity and other IT risks to the Board's Risk and Audit Committee. As part of this oversight, we created the ISAT. The ISAT is comprised of cybersecurity consultants and senior managers and executives from multiple functions within MARA, including IT, finance, legal, internal audit and operations. Members of the ISAT have extensive professional experience in cybersecurity, software engineering and information technology and hold industry-recognized certifications, including Certified Information Systems Security Professional (CISSP) and Systems Security Certified Practitioner (SSCP). The ISAT oversees our information security program and our strategy, including management's implementation of cybersecurity risk management. The ISAT meets at least semi-annually to discuss matters involving cybersecurity risks.


text: The ISAT ultimately provides information to our Risk and Audit Committee regarding its activities, including those related to cybersecurity risks. The Risk and Audit Committee also receives a briefing and continuing education from a member of the ISAT relating to our cybersecurity risk management program at least annually. The ISAT is responsible for notifying the Risk and Audit Committee of material cybersecurity incidents.


text: We consider cybersecurity risk to be an important potential risk to our business. Our Audit Committee maintains oversight of cybersecurity and other information technology risks affecting us. As such, on a quarterly basis, or as frequently as required, management provides reports regarding cybersecurity and other information technology risks to the Audit Committee, which, pursuant to its charter, is generally responsible for the oversight of many of our broader risk assessment and risk management policies. These management updates are designed to inform the Audit Committee of any potential risks relating to information security or data privacy and may outline any relevant mitigation or remediation tactics being implemented.

companyName: CIVITAS RESOURCES, INC.


text: Our Vice President of Information Technology, Jerry Vigil, leads our cybersecurity initiatives, reporting directly to the Chief Administrative Officer and Corporate Secretary and maintains open communication channels with the broader senior management team, the Board, and our Audit Committee. Mr. Vigil is responsible for implementing our cybersecurity strategy, managing daily operations, coordinating incident response, and regularly and routinely reviewing our security model and its practices and future initiatives with external auditors to ensure alignment with industry best practices, changes in audit compliance requirements, and adherence to planned business objectives, as well as providing regular updates and reports on our cybersecurity status and risk assessments to the Board. Mr. Vigil has over 25 years of information technology management experience and has served as our Vice President of Information Technology since January 2024. Mr. Vigil served in the same role at HighPoint Resources Corporation from May 2014 until its merger with us in April 2021. Mr. Vigil served as our Director of Information Technology from April 2021 through December 2023. Mr. Vigil has a Bachelor of Science in Business Technology Management and Computer Science from Regis University.


text: We maintain a robust system of data protection and cybersecurity resources, technology and processes. We regularly evaluate new and emerging risks and ever-changing legal and compliance requirements. We make strategic investments to address these risks and compliance requirements to keep our data secure. We monitor risks of sensitive information and reevaluate these risks on a frequent basis. We also perform annual and ongoing cybersecurity awareness training for our employees. We have a longstanding information security risk program structured according to the National Institute of Standards and Technology Cybersecurity Framework, industry best practices, privacy legislation, and other global and local standards and regulations. This program deploys both commercially available solutions and proprietary systems to manage threats to our information technology environment actively and includes a defense-in-depth approach with multiple layers of security controls, including network segmentation, security monitoring, endpoint protection, and identity and access management, as well as data protection best practices and data loss prevention controls, all of which are intended to preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, us.


text: We also employ a cybersecurity awareness program, which incorporates external expertise and guidance in all aspects of our cybersecurity program, that includes an extensive onboarding training requirement and monthly ongoing training on protecting corporate data and digital assets. We complete annual internal security audits and vulnerability assessments of our information systems and related controls, including systems affecting personal data. In addition, we leverage cybersecurity specialists to complete annual external audits and objective assessments of our cybersecurity program and practices, including our data protection practices, as well as to conduct targeted attack simulations. We continually enhance our information security capabilities in order to protect against emerging threats, while also increasing our ability to detect and respond to cyber incidents and maximize our resilience to recover from potential cyber-attacks. We have a robust incident response plan in place that provides a documented runbook for responding to cybersecurity incidents and facilitates coordination across multiple parts of our entity. Additionally, we have purchased network security and cyber liability insurance in order to provide a level of financial protection, should a data breach occur. Our insurance covers situations arising from, among other things, cyber-related breaches and interruptions in the business continuity of our computing environment. These policies are annually reviewed by industry underwriters at which time our security practices, programs, processes, and procedures are thoroughly disclosed, reviewed, and evaluated for purposes of determining our insurability.


text: We have not experienced any material information security breaches in the last three years, nor are we aware of any cybersecurity risks that are reasonably likely to have a material adverse affect on us. As such, we have not spent any material amount of capital on addressing information security breaches in the last three years, nor have we incurred any material expenses from penalties and settlements related to a material breach during this same time. For additional information about our cybersecurity risks, please refer to "Item 1A. Risk Factors - We are subject to cyber security risks. A cyber incident could occur and result in information theft, data corruption, operational disruption, or financial loss.".


text: Our Vice President of Information Technology ("VP-IT") leads our cybersecurity initiatives, reporting directly to the Chief Administrative Officer and Corporate Secretary and maintains open communication channels with the broader senior management team, the Board, and our Audit Committee. The VP-IT is responsible for implementing our cybersecurity strategy, managing daily operations, coordinating incident response, and regularly and routinely reviewing our security model and its practices and future initiatives with external auditors to ensure alignment with industry best practices, changes in audit compliance requirements, and adherence to planned business objectives, as well as providing regular updates and reports on our cybersecurity status and risk assessments to the Board. The VP-IT has over 25 years of information technology management experience and has served as our VP-IT since January 2024.


text: We maintain a robust system of data protection and cybersecurity resources, technology and processes. We regularly evaluate new and emerging risks and ever-changing legal and compliance requirements. We make strategic investments to address these risks and compliance requirements to keep our data secure. We monitor risks of sensitive information and reevaluate these risks on a frequent basis. We also perform annual and ongoing cybersecurity awareness training for our employees. We have a longstanding information security risk program structured according to the National Institute of Standards and Technology Cybersecurity Framework, industry best practices, privacy legislation, and other global and local standards and regulations. This program deploys third-party cybersecurity solutions to actively manage threats to our information technology environment and includes a defense-in-depth approach with multiple layers of security controls, including network segmentation, security monitoring, endpoint protection, and identity and access management, as well as data protection best practices and data loss prevention controls, all of which are intended to preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, us.


text: We have not experienced any material information security breaches in the last three years, nor are we aware of any cybersecurity risks that are reasonably likely to have a material adverse affect on us. As such, we have not spent any material amount of capital on addressing information security breaches in the last three years, nor have we incurred any material expenses from penalties and settlements related to a material breach during this same time. For additional information about our cybersecurity risks, refer to "Item 1A. Risk Factors - Risks Related to Our Business and Operations - We are subject to cyber security risks. A cyber incident could occur and result in information theft, data corruption, operational disruption, or financial loss."


text: We have processes in place designed to protect our information systems, data, assets, infrastructure and computing environments from cybersecurity threats and risks while maintaining confidentiality, integrity and availability. These enterprise-wide processes are based upon policies, practices and standards that guide us on identifying, assessing and managing material cybersecurity risks and include, but are not limited to: • placing security limits on physical and network access to our information technology ("IT") and operating technology ("OT") systems; • employing internal IT and OT controls designed to detect cybersecurity threats by collecting and analyzing data in our centralized cybersecurity operations center; • utilizing layers of defensive methodologies designed to facilitate cyber resilience, minimize attack surfaces and provide flexibility and scalability in our ability to address cybersecurity risks and threats; • providing cybersecurity threat and awareness training to employees and contractors; • limiting remote network access to our IT and OT network environments; and • assessing our cybersecurity resiliency through various methods, including penetration testing, tabletop exercises with varying scenarios and participants ranging from individuals on our operations teams to executive leadership, and analyzing our corporate cybersecurity incident response plan.

companyName: Marathon Petroleum Corp

ticker: MPC


text: We apply an enterprise risk management ("ERM") methodology as established and led by our executive leadership team to identify, assess and manage enterprise-level risks. Our cybersecurity risk program directly integrates and is intended to align with our governing ERM program.


text: We engage with external resources to contribute to and provide independent evaluation of our cybersecurity practices, including a periodical assessment of our cybersecurity program performed by a third party. Our cybersecurity leadership and operational teams monitor cybersecurity threat intelligence and applicable cybersecurity regulatory requirements in a variety of ways, including by communicating with federal agencies, trade associations, service providers, and other miscellaneous third-party resources. Our management team through consultation with our Senior Vice President and Chief Digital Officer ("CDO"), Vice President and Chief Information Security Officer ("CISO") and the Audit Committee of our Board use the information gathered from these sources to inform long-term cybersecurity investments and strategies which seek to identify, protect, detect, respond and recover from cybersecurity incidents.


text: We manage third-party service provider cybersecurity risks through contract management, evaluation of applicable security control assessments, and third party risk assessment processes.


text: As of February 28, 2024, we do not believe that any past cybersecurity incidents have had, or are reasonably likely to have, a material adverse effect on the company, including our business, operations or financial condition. However, there can be no assurance that our cybersecurity processes will prevent or mitigate cybersecurity incidents or threats and that efforts will always be successful. It is possible that these events may occur and could have a material adverse effect on our business, operations or financial condition. See "Business and Operational Risks--We are increasingly dependent on the performance of our information technology systems and those of our third-party business partners and service providers" in Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: Our full Board of Directors oversees enterprise-level risks and has delegated to the Audit Committee of our Board oversight of risks from cybersecurity threats as informed through the ERM program. Our CDO and CISO are standing members of the ERM committee, comprised of members of senior management, and as part of the committee, report on and evaluate cybersecurity threats and risk management efforts, as communicated to them by way of their direct reports and the larger cybersecurity team. The CDO and CISO provides regular cybersecurity briefings to the Board of Directors and the Audit Committee as needed, with a minimum of two briefings per year. The Audit Committee further reviews and provides input on our cybersecurity and information security strategy.


text: Our CISO is responsible for the cybersecurity program which is comprised of Cybersecurity GRC (Governance, Risk & Compliance), Cybersecurity Architecture, Operations & Engineering, and a Cyber Fusion Center that includes Threat Intelligence, Vulnerability Management, & Incident Response. Our CISO has 30 years of experience in the oil and gas industry and has held various leadership and strategic roles across IT, software R&D and marketing.


text: Our CISO works at the direction of the CDO, who has more than 20 years of executive IT leadership experience and leads the company's Digital and Information Technology functions that seek to provide innovative, secure, and reliable technology products and services to MPC and its customers.


text: We have processes in place designed to protect our information systems, data, assets, infrastructure and computing environments from cybersecurity threats and risks while maintaining confidentiality, integrity, and availability. These enterprise-wide processes are based upon policies, practices and standards that guide us on identifying, assessing, and managing material cybersecurity risks and include, but are not limited to: • placing security limits on physical and network access to our information technology ("IT") and operating technology ("OT") systems; • employing internal IT and OT controls designed to detect cybersecurity threats by collecting and analyzing data in our centralized cybersecurity operations center; • utilizing layers of defensive methodologies designed to facilitate cyber resilience, minimize attack surfaces, and provide flexibility and scalability in our ability to address cybersecurity risks and threats; • providing cybersecurity threat and awareness training to employees and contractors; • limiting remote network access to our IT and OT network environments; and • assessing our cybersecurity resiliency through various methods, including penetration testing, tabletop exercises with varying scenarios and participants ranging from individuals on our operations teams to executive leadership, and analyzing our corporate cybersecurity incident response plan.


text: We apply an enterprise risk management ("ERM") methodology as established and led by our executive leadership team and overseen by our Board to identify, assess, and manage enterprise-level risks. Our cybersecurity risk program directly integrates and is intended to align with our governing ERM program.


text: We engage with external resources to contribute to and provide independent evaluation of our cybersecurity practices, including a periodic assessment of our cybersecurity program that is performed by a third party. Our cybersecurity leadership and operational teams monitor cybersecurity threat intelligence and applicable cybersecurity regulatory requirements in a variety of ways, including by communicating with federal agencies, trade associations, service providers, and other miscellaneous third-party resources. Our management team, through consultation with our Senior Vice President and Chief Digital Officer ("CDO"), Vice President and Chief Information Security Officer ("CISO"), and the Audit Committee of our Board, use the information gathered from these sources to inform long-term cybersecurity investments and strategies which seek to identify cybersecurity threats and protect against, detect, respond to and recover from cybersecurity incidents.


text: The information systems, data, assets, infrastructure, and computing environments of our third-party service providers are also at risk of cybersecurity incidents. We manage third-party service provider cybersecurity risks through contract management, evaluation of applicable security control assessments, and third-party risk assessment processes.


text: As of February 27, 2025, we do not believe that any risks from cybersecurity threats, including as a result of past cybersecurity incidents, have had, or are reasonably likely to have, a material adverse effect on the company, including our business strategy, results of operations or financial condition. However, there can be no assurance that our cybersecurity processes will prevent or mitigate cybersecurity incidents or threats and that efforts will always be successful. It is possible that cybersecurity incidents may occur and could have a material adverse effect on our business strategy, results of operations, or financial condition. See "Business and Operational Risks--We are increasingly dependent on the performance of our information technology systems and those of our third-party business partners and service providers" in Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: Our full Board of Directors oversees enterprise-level risks and has delegated to the Audit Committee of our Board oversight of risks from cybersecurity threats as informed through the ERM program. Our CDO and CISO are standing members of the ERM committee, comprised of members of senior management, and as part of the committee, report on and evaluate cybersecurity threats and risk management efforts, as communicated to them by way of their direct reports and the larger cybersecurity team. The CDO and CISO are responsible for managing risks from cybersecurity threats. The CDO and CISO provide regular cybersecurity briefings to the Board of Directors including the Audit Committee, with a minimum of two briefings per year and additional briefings as needed. The Audit Committee also has direct access to the CDO and CISO and their management teams for other updates on cybersecurity and information security strategy throughout the year. Additionally, the CDO and CISO, from time to time, meet with members of management to discuss cybersecurity risks, strategy, and threats.


text: Our CISO is responsible for implementing the cybersecurity program which is comprised of Cybersecurity GRC (Governance, Risk & Compliance), Cybersecurity Architecture, Engineering & Operations, and a Cyber Fusion Center that includes Threat Intelligence, Vulnerability Management, & Incident Response. Our CISO has more than 30 years of experience in the oil and gas industry and has held various leadership and strategic roles across IT, software R&D and marketing, including collectively serving as a chief information security officer for seven years at two publicly traded companies. Our CISO also holds an Executive Master in Cybersecurity degree, a Master of Computer Science degree, and undergraduate degrees in both computer science and mathematics.


text: Our CISO works at the direction of the CDO, who has more than 20 years of executive IT leadership experience and leads the company's Digital and Information Technology functions that seek to provide innovative, secure, and reliable technology products and services to MPC and its customers. Prior to joining MPC in 2021, our CDO was employed by GE and its subsidiary companies for over 20 years, holding several executive IT leadership roles with increasing responsibility. He was then named Senior Vice President and Chief Information Officer of Services for parent company GE in 2017 and was later named the Vice President and Chief Information Officer of GE Healthcare. Our CDO holds a Bachelor's degree in Business Administration, Management and Information Systems.


text: We are committed to properly addressing the cybersecurity threats we face, and we have processes to assess, identify, and manage material risks from cybersecurity threats. We apply a comprehensive approach to the mitigation of cybersecurity risks. The risk of cybersecurity threats is integrated into our overall risk management program, which includes an annual risk prioritization process to identify key enterprise-level risks. The cybersecurity threat risk action plan is managed by a dedicated information technology ("IT") committee (the "IT Committee"), which oversees our cybersecurity program. The IT Committee comprises senior company leaders as well as our outsourced IT services provider. To oversee and identify cybersecurity threat risks on a day-to-day basis, we maintain a security operations center with round-the-clock monitoring. We have established policies, including those related to privacy, information security and cybersecurity, and we employ a broad and diversified set of mitigation strategies and techniques to reduce cybersecurity risks, including continuous monitoring, early detection tools, proactive vulnerability management, and remediation. Our information security policies are modeled against the National Institute of Standards and Technology's Cybersecurity Standards and incorporate concepts from the Zero Trust Framework.

companyName: RLJ Lodging Trust

ticker: RLJ


text: Given the ever-changing cybersecurity landscape, our IT Committee regularly meets to identify opportunities for incremental improvements, assess additional layers of security, and evaluate new technologies for implementation. In addition, we engage, as necessary, cybersecurity experts to analyze our IT policies, procedures, and infrastructure to assess their effectiveness and to identify opportunities for improvement.


text: We conduct an annual information security compliance training for all employees to enable them to detect and report malware, ransomware, and other malicious software and social engineering attempts that may compromise our IT systems. Employees also are subject to spear-phishing training campaigns, which allow us to assess the effectiveness of our training programs.


text: Our management companies are ultimately responsible for our guests' information, and we monitor these companies, as well as other third party service providers, to ensure that they are complying with our privacy, information security and cybersecurity policies. We also assess the cybersecurity proficiency of potential third party cloud suppliers before utilizing their services.


text: We work closely with our internal and external auditors to assess, identify and manage cybersecurity risks. Our IT internal controls are audited by our external auditor as part of our Sarbanes-Oxley Act compliance activities, and this process includes assessing the design and operating effectiveness of those controls.


text: Any failure to maintain proper function, security and availability of our information technology networks and systems could interrupt our operations, our financial reporting and compliance, damage our reputation, and subject us to liability claims or regulatory penalties, which could have a material and adverse effect on our business, financial condition and results of operations. Management has not identified cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" above for more information.


text: Our board of trustees is responsible for overseeing the assessment and management of enterprise-level risks that may impact us, including cybersecurity. Two board members have information security expertise from their professional experience. Nathaniel A. Davis has expertise in information technology and experience reviewing and addressing cybersecurity risks. Patricia L. Gibson also has experience assessing and addressing cybersecurity risks through her past professional experience.


text: Our Audit Committee has primary responsibility for the oversight of risks from cybersecurity threats. Management, including members of the IT Committee, reports at least annually to the Audit Committee regarding cybersecurity risks and mitigation strategies. We consider each member of our Audit Committee to possess information security experience by way of their oversight responsibilities over this area. In addition to ensuring adequate safeguards are in place to minimize the chance of a successful cyber attack, we have established a cybersecurity incident response plan to effectively address any cybersecurity threat that may occur despite these safeguards. We believe our cybersecurity incident response plan will help ensure timely, consistent and compliant responses to actual or attempted data incidents impacting our company. The cybersecurity incident response plan includes an escalation framework, including processes for informing the board of trustees of material cybersecurity incidents.


text: Our management companies are ultimately responsible for our guests' information, and we monitor these companies, as well as other third-party service providers, to ensure that they are complying with our privacy, information security and cybersecurity policies. We also assess the cybersecurity proficiency of potential third-party cloud suppliers before utilizing their services.


text: As part of our overall enterprise risk management function, we have implemented and currently maintain various information security processes designed to assess, identify, and manage material risks from cybersecurity threats to our critical computer network, third-party hosted services, and our critical data (collectively, our "Information Systems").

companyName: Ubiquiti Inc.

ticker: UI


text: We have engaged an outside consultant that assists our efforts to prevent threats toward our Information Systems. This consultant monitors data feeds from certain of our key Information Systems. The consultant notifies and works with the Company to investigate and resolve any potential cybersecurity threats identified.


text: Internally, to help manage risk from potential cybersecurity threats, we require our employees to participate in mandatory cybersecurity trainings provided by a third-party specialist which focuses on building awareness of common tactics by threat actors, such as phishing. This training is provided on an annual basis.


text: All of our offices use our own gateway consoles, which have intrusion detection features built in. Additionally, access to our key Information Systems requires an in-office network or VPN with multi-factor authentication, and we employ additional protective measures including the use of our proprietary identity management tool. We also use third-party tools to protect our employee laptops and self-hosted servers and have implemented a public bug bounty program that helps to identify vulnerabilities in our products.


text: We and certain of our vendors have experienced cyber-attacks in the past and may experience cyber-attacks in the future. For example, as previously disclosed, we became aware in January 2021 that certain of our information technology systems hosted by a third-party cloud provider were improperly accessed and certain of our source code and the credentials used to access the information technology systems themselves had been compromised. We received a threat to publicly release these materials unless we made a payment, which we have not done. As a result, it is possible that the source code and other information could be publicly disclosed or made available to our competitors. Due to the nature of the source code and the other information that we believe was improperly accessed, we at this time do not believe that any public disclosure will have a material adverse effect on our business or operations, but it is impossible to gauge the precise impact of any such disclosure.


text: Except as described above, to date, risks from cybersecurity threats have not previously materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition. For additional information about cybersecurity risks, see Item 1A. "Risk Factors."


text: Role of the Board Our Board of Directors (the "Board") has the responsibility for the oversight of risk management, including those risks related to cybersecurity. Our Board holds strategic planning sessions with senior management to discuss strategies, key challenges, risks and opportunities for us. This involvement of our Board in setting our business strategy is a key part of its oversight of risk management, its assessment of management's appetite for risk, and its determination of what constitutes an appropriate level of risk for us. Our senior management attends meetings of our Board and its committees on a quarterly basis, and as otherwise needed, and are available to address any questions or concerns raised by our Board on risk management and any other matters.


text: Role of Management Our senior management, with the oversight of the Board, is responsible for the day-to-day management of the material risks we face, including those related to cybersecurity. We believe it is important to work cross functionally within the Company to manage cybersecurity risks and threats. Therefore, our cybersecurity team is made up of individuals from multiple different departments throughout the Company, including but not limited to our security, IT, R&D and legal teams. The cybersecurity team as a whole has academic degrees related to cybersecurity, technical know-how, and real-world experience managing cybersecurity incidents and risks. Material issues identified by our cybersecurity team are brought to the attention of our Chief Executive Officer and/or our Executive Vice President of Operations and Legal Affairs who in turn will update the Board, as necessary.


text: We rely on the cybersecurity strategy and policies implemented by Monroe Capital, the parent of both MC Advisors and MC Management that also apply to the Company. Monroe Capital's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Monroe Capital's enterprise-wide cybersecurity program is aligned to the National Institute of Standards and Technology Cybersecurity Framework. Monroe Capital's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Monroe Capital has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors and other third parties who entrust us with their sensitive information.

companyName: MONROE CAPITAL Corp

ticker: MRCC


text: Monroe Capital's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help Monroe Capital prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us, MC Advisors or MC Management. Monroe Capital's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us, our investment adviser or our administrator, is integrated into Monroe Capital's enterprise risk management program, which is overseen by the Monroe Capital Operations and Risk Committee ("ORC"), as discussed below. In addition, Monroe Capital periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing and monitoring its cybersecurity risk management programs and responding to incidents.


text: The Monroe Capital cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness and data protection training including for employees of MC Advisors and MC Management. Monroe Capital also has annual certification requirements for employees, including employees who provide services to us pursuant to our Investment Advisory and Management Agreement and our Administration Agreement with respect to certain policies supporting the cybersecurity program. Monroe Capital undertakes periodic internal security reviews of our information systems and related controls, including systems affecting personal data and the cybersecurity risks of Monroe Capital's and our critical third-party vendors and other partners. Monroe Capital also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.


text: In the event of a cybersecurity incident impacting us, MC Advisors or MC Management, Monroe Capital has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational functions of Monroe Capital, including coordinating with the relevant employees of MC Advisors and MC Management. The incident response plan includes notification to the applicable members of cybersecurity leadership, including Monroe Capital's Head of Information Technology, and the Computer Security Incident Response Team ("CSIRT"), as appropriate, escalation to the full ORC and/or an internal ad hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on their nature, incidents may also be reported to the audit committee or full board of directors of Monroe Capital, as well as to the Audit Committee (the "Audit Committee") of our Board of Directors (the "Board") and to our full Board, if appropriate.


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and store sensitive data. "Information systems" means electronic information resources that we own or use, including physical or virtual infrastructure controlled by these information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the information necessary to maintain or support our operations. Because cybersecurity threats continue to evolve, we have been required and may continue to be required to expend significant resources to continue to implement, modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. Financial expenditures may also be required to meet regulatory changes in the information security and cybersecurity domains. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors—General Risk Factors—The failure in cyber security systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively."


text: To address cybersecurity threats (defined as potential unauthorized occurrences on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems or any information residing in those systems therein), we have a implemented an incident and event response program. That program is a component of our overall enterprise risk management and business continuity frameworks. We employ an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity relative to our information systems, as well as to report on any suspected advanced persistent threats. The program is designed to allow for the detection and timely and efficient recovery from cybersecurity incidents (defined as a violation or imminent threat of violation of information security policies, acceptable use policies, or standard computer security practices) and events by providing a well-defined, organized approach for handling any potential threats to the confidentiality, integrity, and/or availability of our information systems.


text: The CSIRT maintains overall responsibility for addressing and resolving incidents that occur at Monroe Capital. The CSIRT: (i) coordinates efforts in response to incidents; (ii) manages the assessment, recovery, and remediation efforts related to incidents; (iii) manages communication, both internal and external, regarding incidents; and (iv) manages notification of regulatory bodies as required by law in response to incidents.


text: We contract with a third-party vendor (oversight for which is outlined in our Vendor Risk Management Policy) who monitors our information systems for suspicious activity, such as unauthorized intrusions. Suspected or confirmed threats, incidents, or events, however, also may be reported by employees, intrusion detection systems, third-party servicers, or government entities. Once reported, cybersecurity incidents are to be brought to the attention of the Head of Information Technology, the ORC and the CSIRT, which provides status updates to the Information Security Committee ("ISC"), with the frequency of such updates depending upon the perceived threat level of the reported incident.


text: After receiving notice of a cybersecurity threat, such threats are investigated to determine whether an actual incident has occurred and, if so, whether a more thorough assessment by the entire ISC is appropriate. During these assessments, steps may be taken to isolate affected systems. Outside advisors may be employed regarding the cybersecurity threat, including to conduct legal and forensic investigations and work with other third parties who might be engaged to assist in any response and associated publicity.


text: During or at the conclusion of an assessment of a cybersecurity incident, we will respond to the incident. The response will vary based upon the severity of the incident or event. The Head of Information Technology will note the classification of the information potentially impacted, paying close attention to information classified as personally identifiable information and sensitive. The Head of Information Technology and appropriate personnel will determine whether the incident is likely to affect ongoing business operations. If such is the case (e.g., contamination is widespread across production systems), Monroe Capital's Incident Response Plan and Business Continuity Plan shall be invoked, as necessary. In determining the level of response, we have identified three criticality levels of incidents and events based upon the following criteria: • Risk to confidential data • Risk to business continuity • Risk to critical systems • Revenue impact • Client impact


text: Incident and risk event levels each vary from level 3 (or low) risk to level 1 (high) risk. The determination of the incident and risk level will dictate the level of personnel that will be responsible for addressing the incident, controlling the effects of the incident and formulating the response to the incident. Responses may include, when appropriate and/or required, notification to regulatory agencies (e.g., SEC), authorities (e.g., F.B.I., Department of Justice), clients, third parties or internal personnel.


text: The CSIRT is responsible for incident reporting and response. The action steps taken, beyond notification, are typically accomplished with the assistance of the IT department. The Head of Information Technology or CSIRT team member will work with the appropriate personnel to respond to the incident (following written guidelines) and to ensure concurrent documentation of the same. Should a breach occur at a third party that has a material impact on Monroe Capital, the CSIRT must be notified.


text: Following a cybersecurity incident, and during its investigation and the formulation of a response, our processes also envision measures designed to contain and/or eradicate the incident and prevent further effects. Once it is determined that the incident has been resolved, we then work to establish appropriate controls (if applicable) to address similar future events and/or prevent another similar event from occurring in the future. To date, we have not experienced any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Our cybersecurity program is managed by Monroe Capital's dedicated internal cybersecurity team, which is responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by Monroe Capital's Head of Information Technology, who has a bachelor's degree in systems engineering and over 12 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The CSIRT includes members of Monroe Capital's senior executive management, including its Chief Operating Officer, Chief Compliance Officer and the Head of Information Technology, who acts as chairperson of the ISC. The ISC is comprised of Monroe Capital's Head of Information Technology, Chief Operating Officer and Chief Compliance Officer. The purpose of the ISC is to protect Monroe Capital's technology, data and information, and the ISC is tasked with responding to technology and data security incidents. The ORC is a cross-functional committee that governs and oversees the Monroe Capital enterprise risk management program, including cybersecurity. The ORC includes members of Monroe Capital's senior executive management, including its Chief Compliance Officer, Chief Operating Officer, Chief Credit Officer, President & Co-Portfolio Manager, Chief Financial Officer of Management Company and Chief Financial Officer of Investment Funds, who acts as chairperson of the ORC. The ORC, through regular consultation with the Monroe Capital internal cybersecurity team and employees of MC Advisors and MC Management, assesses, discusses, and prioritizes Monroe Capital's approach to high-level risks, mitigative controls and ongoing cybersecurity efforts.


text: As part of its oversight responsibilities over risks and controls, the Board is ultimately responsible for overseeing our cyber and information security risks. The Audit Committee has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Members of the ORC and other Monroe Capital personnel periodically report to our Audit Committee as well as our full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Monroe Capital's cybersecurity program as it impacts us, the external threat environment, and Monroe Capital's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Monroe Capital's preparedness, prevention, detection, responsiveness and recovery with respect to cybersecurity incidents.


text: Material Impact of Cybersecurity Risks As of the date of this annual report on Form 10-K, we are not aware of any material risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about the cybersecurity risks that we face is discussed in Item 1A of Part I, "Risk Factors" in this annual report on Form 10-K under the heading "The failure in cybersecurity systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively."


text: Our cybersecurity program is managed by Monroe Capital's dedicated internal cybersecurity team, which is responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by Monroe Capital's Head of Information Technology, who has a bachelor's degree in systems engineering and over 13 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The CSIRT includes members of Monroe Capital's senior executive management, including its Chief Operating Officer, Chief Compliance Officer and the Head of Information Technology, who acts as chairperson of the ISC. The ISC is comprised of Monroe Capital's Head of Information Technology, Chief Operating Officer and Chief Compliance Officer. The purpose of the ISC is to protect Monroe Capital's technology, data and information, and the ISC is tasked with responding to technology and data security incidents. The ORC is a cross-functional committee that governs and oversees the Monroe Capital enterprise risk management program, including cybersecurity. The ORC includes members of Monroe Capital's senior executive management, including its Chief Compliance Officer, Chief Operating Officer, Chief Credit Officer, President & Co-Portfolio Manager, Chief Financial Officer of Management Company and Chief Financial Officer of Investment Funds, who acts as chairperson of the ORC. The ORC, through regular consultation with the Monroe Capital internal cybersecurity team and employees of MC Advisors and MC Management, assesses, discusses, and prioritizes Monroe Capital's approach to high-level risks, mitigative controls and ongoing cybersecurity efforts.


text: Disclosure of cybersecurity risk, management, & strategy CompuData Supports Pismo Coast Village through their Managed IT Services. This is done through patch management, a managed Network, Managed Security, and Managed 24/7 support. Pismo Coast Village has a comprehensive risk management process that all nodes on the network are set to follow. All external Vendors are SOC II compliant. Our users access all applications utilizing a two-factor authentication method at the Domain level and SSO for third Party applications.

companyName: PISMO COAST VILLAGE INC


text: Pismo Coast Village has not had a material or data breach. Our strategy is to mitigate risks preventatively. The is implemented through best-in-class cybersecurity strategies preventative measures carried out by our vendor CompuData. Our identifiable risk areas are twofold: First within accounting and second, within taking payments. Our accounting department is hosted on a cloud system utilizing SSL for access and encryption. Our Managed Services company, CompuData, manages risk and preventative cyber security to that server. Within our taking of payments, we are fully PCI compliant within our payment processing service, Clover. No Credit card information is stored or transferred outside of that system.


text: We engage a third-party Vendor as mentioned above, CompuData. Our vendors are whitelisted and are SOC II certified. Our Whitelisted Vendor applications are Newbook, Sage, Clover, and Office 365.


text: Material Effects from Cybersecurity Incidents Our business is subject to risk from cybersecurity threats and incidents, including attempts to gain unauthorized access to our systems or networks, or those of our managers, employees, and third-party vendors and service providers, to disrupt operations, corrupt data or steal confidential or personal information and other cybersecurity breaches. Nuvera considers cybersecurity risk a serious threat to our assets and our people and has put processes in place designed to mitigate the risk and impact of any such cybersecurity threat or incident.

companyName: Nuvera Communications, Inc.

ticker: NUVR


text: Our operations rely on the secure, accurate and timely receipt, storage, transmission, use, disclosure, and other processing of confidential and other information (including personal information) in our systems and networks. We also rely on the secure, accurate and timely receipt, storage, transmission, use, disclosure, and other processing of confidential and other information in the systems and networks of our customers and third parties, including suppliers, sellers and servicers, financial market utilities, and other third parties. Cybersecurity risks for companies like ours continue to increase. Like many companies and government entities, from time to time we have been, and expect to continue to be, the target of attempted cybersecurity incidents and other information security threats, including those from nation-state and nation-state supported actors.


text: As of the date of this report we have not experienced or aware of any cybersecurity incidents resulting, or reasonably likely to result in, a material impact to our company, including to our business, financial condition, and results of operations. There is no assurance that our cybersecurity risk management program will prevent cybersecurity incidents from having such impacts in the future.


text: Additionally, insider threats also remain a risk given our workforce diversification to include contractors, remote workers, part-time employees, and full-time employees. As referenced above, our third-party vendors and service providers and their supply chain connections remain a potential source of risk.


text: For additional information, see Risk Factors – Risks Related to Our Business. Potential cybersecurity threats are changing rapidly and advancing in sophistication. We may not be able to protect our systems and networks, or the confidentiality of our confidential or other information (including personal information), from cybersecurity incidents and other unauthorized access, disclosure, and disruption.


text: Our cybersecurity program is built upon the National Institute for Standards and Technology and other best practice frameworks. We employ processes for assessing, identifying, and managing material risks from cybersecurity threats, including engaging an independent cybersecurity consultant to audit our systems and procedures, make recommendations for improvement and monitor remediation of any identified risks. We also conduct random vulnerability testing including network penetration testing, phishing and social engineering tests. In addition, we also require Systems and Organization Control ("SOC") type reports from our service providers for our payroll and human resources system and stock administrator.


text: Although we maintain systems and controls designed to prevent cybersecurity breaches from occurring, and we have processes to identify and mitigate threats, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become increasingly sophisticated. Moreover, despite our efforts, the possibility of a breach occurring cannot be eliminated entirely. As we engage in more electronic transactions with service customers and vendors, and rely more on cloud-based information systems, the related security risks will increase, and we will need to expend additional resources to protect our technology and information systems. In addition, there can be no assurance that our internal information technology systems or those of our third-party contractors, or our consultants' efforts to implement adequate security and control measures, will be sufficient to protect us against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks which could result in financial, legal, business or reputational harm.


text: All employees of the Company have ownership in managing cybersecurity and data privacy risks, however, oversight responsibility is shared by our BOD, Audit Committee and cybersecurity management team. The Audit Committee is responsible for our cybersecurity policies and provides regularly updates to the BOD Our cybersecurity management team, in conjunction with our third-party chief information security officer ("CISO"), conduct regular assessment and management of material risks from cybersecurity threats, including review with our internal cybersecurity management team. All employees and consultants are directed to report to our cybersecurity management team any irregular or suspicious activity that could indicate a cybersecurity threat or incident.


text: Our cybersecurity management team has primary responsibility for identifying, assessing and managing our exposure to cybersecurity threats and incidents, subject to oversight by the Audit Committee of the BOD of the processes we establish to assess, monitor and mitigate that exposure.


text: If a potentially material cybersecurity threat or incident is identified or discovered, the Company's Cybersecurity Management Team will trigger our incidence response plan, including notifying our CEO, CFO, and other relevant business executives. Our Cybersecurity Management Team, along with our CISO, will work with the appropriate leaders and employees in any impacted business groups, as well as appropriate personnel in our finance, legal and other impacted departments, to assess the risks to the Company and potential impact while determining appropriate remediation steps. If executive management determines that a cybersecurity threat or incident could be material to the Company, our management will notify the Audit Committee, who will escalate the risk to our full BOD, depending on an assessment of the risk.


text: Risk Management and Strategy Disclosure We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: TRANS LUX Corp


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: Governance Disclosure Our Board is periodically informed of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Executive Officer and Chief Accounting Officer are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.


text: Our Chief Executive Officer and Chief Accounting Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: Our Chief Financial Officer and IT consultant provide periodic briefings to the audit committee regarding the Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the Board on such reports.


text: The Company's business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. Our Manager is an affiliate of TPG Inc. ("TPG"), a leading global alternative asset management firm. We, in conjunction with our Manager and its affiliates, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. These processes include responses to and assessments of internal and external threats to the security, confidentiality, integrity and availability of the Company's data and systems along with other material risks to its operations, at least annually or whenever there are material changes to our systems or operations. As part of the risk management process, TPG engages outside providers to conduct periodic internal and external penetration testing. TPG has informed us that it uses NIST Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that TPG, its affiliates or we meet any particular technical standards, specifications, or requirements. TPG stores data, including the Company's data, in cloud environments with security that we believe is appropriate for the data involved and has adopted controls around, among other things, vendor risk assessment, access and acceptable use and backup and recovery.

companyName: TPG Mortgage Investment Trust, Inc.

ticker: MITT


text: The Company utilizes certain third-party service providers to perform a variety of functions in the operation of its business. TPG has processes to oversee and identify material risks associated with the use of third-party service providers, taking into account the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "Risks Related to our Company, Business, and Operations—Cybersecurity risks may cause a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our business.", for additional discussion about cybersecurity-related risks.


text: Our Board of Directors holds oversight responsibility over the Company's strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. The Board regularly engages in discussions with management regarding the Company's risk assessment and risk management policies. In addition, the Audit Committee of our Board of Directors (the "Audit Committee") oversees the management of systemic risks, including cybersecurity, in accordance with its charter. The Audit Committee engages in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks.


text: Our Board of Directors, including the Audit Committee, is briefed on our Manager's information security program and cybersecurity risks at least once each year and as needed in connection with any potentially material cybersecurity incidents. The Chief Information Security Officer reports at least annually to our Board of Directors, including the Audit Committee, and such report may address overall assessment of the Company's compliance with this and other cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.


text: As an externally managed company, we rely on our Manager and its affiliates' information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by TPG. TPG has established an Enterprise Risk Committee ("ERC") to manage overall risk across the organization including cybersecurity risks identified by TPG's cybersecurity team; the ERC includes representatives from relevant functions and is led by TPG's Chief Executive Officer. TPG has also established an Operational Risk Committee ("ORC") responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of our Manager's risk management, control and governance processes is assigned to TPG's Chief Information Security Officer, who periodically reports, among others, potentially material cybersecurity incidents to the ORC and, in coordination with the Chief Information Officer and Head of Operations, reports to the ERC at least annually. The Chief Information Security Officer leads TPG's cybersecurity team, which includes individuals dedicated to incident detection and response. This team is responsible for identifying threats that can impact the organization, including the Company, and designing controls to mitigate vulnerabilities before they are exploited and to detect and neutralize any threats that do materialize. The Chief Information Security Officer and Chief Information Officer each have more than 20 years of experience in their fields. The Chief Information Security Officer and senior members of the cybersecurity team hold industry standard certifications.


text: The Company's business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. Our Manager is an affiliate of TPG, a leading global alternative asset management firm. We, in conjunction with our Manager and its affiliates, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. These processes include assessments of internal and external threats to the confidentiality, integrity and availability of the Company's data and systems along with other material risks to its operations.


text: These risk assessments inform our cybersecurity program and the continued development of a layered set of controls aimed at preventing, detecting, and responding to threats. TPG's administrative, organizational, technical and physical security controls include, but are not limited to, policies and procedures, system hardening vulnerability scanning, and patching, employee training and awareness, third-party risk management processes, backup and recovery processes, access controls, data encryption in transit and at rest, network perimeter controls, and identity verification. TPG also has policies and controls in place designed to detect and respond to cybersecurity events, including an incident response plan, an incident response team with dedicated roles and responsibilities for assessing and responding to a cybersecurity event, system logging and ongoing monitoring, and periodic training exercises simulating cybersecurity events that are designed to raise awareness and test the team's response readiness capabilities.