text: We describe the risks that cybersecurity threats, including as a result of any previous cybersecurity incidents, pose to us that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We may experience delays or outages in our information technology systems and computer networks. We may be subject to breaches of our information technology systems or other cybersecurity incidents, which could damage our reputation and consumer relationships. Failures in our information technology systems and the costs of increasing information security regulation could also subject us to significant financial, legal and operational consequences" included as part of our risk factor disclosures under Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein. We have experienced, and will continue to experience, cyber incidents in the normal course of our business. However, to our knowledge, we have not had any cybersecurity incidents in the past three years that have had a material adverse effect on our business, financial condition, results of operations, or cash flows.


text: As we are a company that leverages data, technology and analytics to improve health care, we invest in long-term solutions to address current and foreseeable risks and threats to data security and privacy, while also enabling technological development that enhances the member experience. We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Alignment Healthcare, Inc.

ticker: ALHC

secItem: Item 1C


text: We have designed and deployed a comprehensive cybersecurity risk management program that is embedded in our broader risk management framework, all of which is overseen by our Board of Directors. Our program is designed to include ongoing assessment of our critical assets; detection and analysis of potential threats; timely management of identified security risks; and prompt remediation planning and implementation. To successfully operate and monitor our security readiness, we maintain a data security and privacy team with substantial real-world experience to detect and respond to cybersecurity threats. Our multi-layered security is bolstered by technologies and partners and includes annual employee and vendor security awareness trainings, enhanced access control, data loss protection and vulnerability management, among other technical and process security controls. Our proprietary data architecture, AVA, incorporates high security controls around member data. Our information security program considers how attackers are using emerging technologies (such as artificial intelligence) to help inform our defensive tactics. Our team also regularly reviews emerging product technology to improve our capabilities.


text: In 2021, we received the externally validated HITRUST certification, the gold standard compliance framework in the health care industry. Through our data security and privacy program and policies, we adhere to the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), other federal regulations and best-practices within the health care industry. Moreover, our risk analysis methodology is consistent with ISO 27001, the Federal Information Security Management Act and the U.S. Department of Commerce National Institute of Standards and Technology and Center for Internet Security Special Publication 800-66.


text: Our strict protection and security measures have resulted in zero security incident-related disruptions or downtime to our business continuity. However, there is no guarantee that a future security incident would not materially affect our business strategy, results of operations or financial condition. See "Risk Factors" beginning on page 27 of this Form 10-K.


text: Engagement of Third Parties Our information security program is under nearly constant third-party review as part of Sarbanes-Oxley compliance and the HITRUST certification process, including independent third-party penetration testing of all information technology assets at least annually and assessment of our vulnerability to ransomware. Multiple industry-standard third-party tools are utilized to detect vulnerabilities. Alignment is a member of the Healthcare Information Sharing and Analysis Center (Health-ISAC) operated by the U.S. Department of Health and Human Services and the Department of Homeland Security and is affiliated with the FBI InfraGard program, providing deep, actionable intelligence regarding healthcare security and privacy threats and countermeasures. We continuously monitor the Health-ISAC reporting to anticipate and respond to potential threats.


text: Management of Third-Party Cyber-Risk We rely on third-party vendors to provide supplemental benefits to our members and for a variety of other key business functions. Accordingly, our vendor onboarding process includes a comprehensive security assessment. Moreover, at least quarterly, we assess the risks from cybersecurity threats relating to each of our member-facing and other key third-party service providers with whom we share protected health information, personal identifying information and confidential information. We generally require our suppliers to adopt security-control principles based on industry-recognized standards and we seek audit rights over their security protocols.


text: As a component of its general oversight over key risks to our business, our Board of Directors has established robust oversight mechanisms designed to ensure effective governance in managing risks associated with cybersecurity threats. As a technology-enabled Medicare Advantage platform, we have selected directors with backgrounds in technology and expertise in data privacy and cybersecurity matters, which represent important elements of our risk management strategy.


text: Our Audit Committee is responsible for the direct oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on at least a quarterly basis from senior management, including leaders from our information security, compliance and legal teams regarding matters of cybersecurity. Reports by management to the Audit Committee include existing and new cybersecurity risks, status updates regarding how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. The Audit Committee's involvement ensures that cybersecurity considerations are integrated into the Company's broader strategic objectives. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework. As needed, this framework also includes consultations with our enterprise risk management committee, led by our Chief Compliance and Privacy Officer.


text: Alignment's cybersecurity organization is led by David MacLeod, our Chief Information Security Officer, who is responsible for the prevention, detection, mitigation, and remediation of cybersecurity incidents and reports to Robert Scavo, our Chief Information Officer, as well as to the Audit Committee. Mr. MacLeod has served as our CISO since December 2022, has over 25 years of diverse leadership experience in the healthcare information space (including over 20 years as a certified information systems security professional and chief information security officer) and holds advanced degrees in information technology management and computer science.


text: The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats to our information systems. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and systems along with other material risks to our operations, at least annually or whenever there are material changes to our systems or operations. These processes include plans to be used in the event of a cybersecurity incident, including incident reporting and business continuity. As part of our risk management process, we engage outside providers to conduct periodic internal and external penetration testing. We store our data in cloud environments with security appropriate to the data involved and have adopted controls around, among other things, vendor risk assessment, access and acceptable use and backup and recovery. Although we have experienced cybersecurity incidents in the past, cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition.

companyName: TransMedics Group, Inc.

ticker: TMDX


text: Our executive team, along with our Audit Committee, considers cybersecurity risk as part of our overall business strategy, financial planning and capital allocation. Our Audit Committee and Board of Directors engage with members of the executive team and are briefed on cybersecurity risks at least once each calendar year and with respect to any potentially material cybersecurity incidents. Our Chief Information Officer reports regularly, and at least annually, to our Audit Committee and such report may address overall assessment of our compliance with our cybersecurity policies, and include topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures. Our Chief Information Officer has served in various senior information technology roles, responsible for information security for over 20 years.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Ventyx Biosciences, Inc.

ticker: VTYX


text: We conduct risk assessments on a recurring basis to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Business Officer who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with other members of senior management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage consultants and other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: As of December 31, 2023, and through the date of this filing, we are not aware of any material cybersecurity incidents that have impacted the Company. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Business Officer and other members of senior management are primarily responsible to assess and manage our material risks from cybersecurity threats. We have engaged a third party, who authored security manuals and holds multiple industry certifications, as our Virtual Chief Information Security Officer (VCISO) to support our Head of IT in Cyber related architecture and assessment.


text: Our Chief Business Officer and other members of senior management oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Business Officer and other members of senior management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: rollout and expansion of cyber security tools and cyber industry awareness and trends.


text: Our Chief Business Officer and other members of senior management provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our Chief Business Officer provides annual briefings to the board of directors on cybersecurity risks and activities.


text: We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes and practices. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve and recover from security incidents in a timely manner. We require annual information security training to be completed by our employees, and we maintain a limited cybersecurity liability insurance policy.

companyName: REGENXBIO Inc.

ticker: RGNX


text: Our Senior Vice President of Information Technology (SVP, IT) is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. Our current SVP, IT has over 25 years of experience in information technology and possesses the requisite education, skills and experience expected of an individual assigned to these duties. We also engage third-party consultants and auditors to assess the effectiveness of our cybersecurity prevention and response systems and processes. Where applicable, third-party service providers are contractually obligated to notify us of material incidents arising from cybersecurity events within their purview.


text: We identify, assess and manage material risks from cybersecurity threats by following written policies and procedures, which are in compliance with the International Organization for Standardization (ISO) 27001 Information Security Management System. The output of this process is then integrated with our enterprise risk management (ERM) program. The ERM program is managed by our Chief Operating Officer (COO), with input from various representatives across our business operations, and is used to assess risks to our business based on their potential likelihood and magnitude of impact. Our information technology organization provides the inputs to our ERM process related to material cybersecurity risks and mitigation plans. The information technology team is responsible for the prevention, detection, mitigation and remediation of cybersecurity incidents. Cybersecurity incidents are documented and triaged in accordance with a defined process. Incidents deemed to be significant are escalated to the Audit Committee of our Board of Directors after appropriate assessment by the information technology organization and other internal stakeholders. In the event an incident highlights an emerging or previously unidentified cybersecurity risk, such risk is then synthesized into the ERM process.


text: The Audit Committee of our Board of Directors oversees our ERM program and is apprised of material risks arising from cybersecurity threats impacting our business. The COO provides quarterly reporting on our material enterprise risks to the Audit Committee. In addition to material risks identified by the ERM process, our information technology management provides periodic reporting, at least semi-annually, on our cybersecurity risk profile and risk mitigation strategies to the Audit Committee. This reporting is also made available to the full Board of Directors.


text: In the last three years, we have not identified any cybersecurity incidents which have materially affected, or are reasonably likely to materially affect, our business. For further information regarding cybersecurity risks, please refer to "Risk Factors – Risks Related to Our Business Operations" and other risks described in the "Risk Factors" section of this Annual Report on Form 10-K.


text: Protecting our data, which includes information related to our patients, members, and customers, is a primary area of our focus. Given the critical nature of this information, we have developed and implemented a robust cybersecurity risk management program to assess, identify, and manage risks associated with cybersecurity threats as identified in Item 106(a) of Regulation S-K. Cybersecurity is an important and integrated part of our risk management program that identifies, monitors and mitigates business, operational and legal risks.

companyName: UNIVERSAL HEALTH SERVICES INC

ticker: UHS


text: This program has a multi-tier risk management structure that includes regular reviews of laws, policies, vulnerabilities, and resource levels to address risks facing our organization. Such risks include operational, intellectual property theft, fraud, risks that have potential unfavorable impacts on our employees and/or patients, and violation of data privacy or security laws.


text: To address cybersecurity risks facing our organization, we have adopted a "continuous risk assessment" process. We engage a third party to conduct a bi-annual National Institute of Technology-Cyber Security Framework assessment to determine the maturity of our program and related controls. The results of that assessment are shared with management, which drives prioritization and investment in resources to address those risks. Likewise, annual penetration tests occur to review the efficacy of our technical controls, results which are reviewed by management and resolved in a timely manner. Other factors that feed into our risk management practices are also operational events and incidents, which can lead to controls being reviewed and enhanced.


text: We also have a mature incident response process in place in the event a cybersecurity incident occurs. This process defines roles, responsibilities and action plans designed to contain, eradicate, and restore systems in the event of a major disruption. Regularly, we conduct tabletop exercises to simulate responses to an incident and implement any insight gained from those exercises to improve our recovery practices. As part of these processes, we regularly engage with assessors, consultants, auditors, and other third parties to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: Third parties who provide services and solutions to our organization are also a source of cyber risk. Through a third-party risk management program, we review risks associated with these third parties through contractual reviews, vendor risk assessments, and continual risk reviews by monitoring the cybersecurity risk exposure these third parties pose and implementing remediation where necessary.


text: Based on the information available as of the date of this Form 10-K, during our fiscal year 2023 and through the date of this filing, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents (as such terms are defined in Item 106(a) of Regulation S-K), that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on risks to us from cybersecurity threats, see "Risks Related to Information Technology - A cyber security incident could cause a violation of HIPAA, breach of patient or other persons privacy, or other negative impacts." under "Item 1A. Risk Factors."


text: Cybersecurity is an integral part of our risk management program and is an area of focus for our Board of Directors and management. The Audit Committee of our Board of Directors is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates, as warranted, including quarterly updates from our Chief Information Security Officer ("CISO") regarding matters of cybersecurity, such as key risks facing the organization, core topics, review of incidents, as well as progress against key information security initiatives. Senior executive leadership also engage in ad-hoc discussions with management on cybersecurity topics. In addition, our Board of Directors are provided with an annual report regarding cybersecurity information and related topics.


text: Our cybersecurity risk management and strategy processes are overseen by our CISO along with leaders from our Information Security, Compliance, Legal and Internal Auditing teams. Such individuals have an average of over 20 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, using widely recognized industry frameworks. We use risk management strategies that focus on vital areas such as data protection, access control, incident response, and vulnerability management, and we have integrated these processes into our overall risk management program. We routinely assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Alector, Inc.

ticker: ALEC


text: We have implemented a multi-faceted cybersecurity program in accordance with globally recognized standards to protect the confidentiality, integrity, and availability of our information assets. The primary aims of this program are to devise, initiate, and maintain a cybersecurity approach that safeguards our systems, services, and data from unauthorized access, outages, exposure, modification, damage, and loss.


text: We have implemented a range of logical and technical controls to appropriately restrict physical and logical access. We maintain authentication controls in line with industry-recognized standards, including audit trails and logs for access. Access privileges are updated following any change in personnel or system, and are reviewed periodically, with the frequency determined by the associated risk of the application or system.


text: We engage the expertise of third-party organizations to assist us to design and implement our cybersecurity procedures, as well as to monitor and test our safeguards in the context of recognized industry standards and practices. This process aims to confirm that our security infrastructure is robust and efficient, and that it is designed to resist diverse security threats. We use the critical insights gained from these third-party assessments to continue to improve our security controls and protect our systems and data.


text: We evaluate potential cybersecurity risks associated with third-party service providers, including through a periodic vendor security review process overseen by our Head of Cybersecurity.


text: We have not encountered any cybersecurity threats or incidents to date that have materially affected, or that are reasonably likely to materially affect, our business, strategy, results of operations or financial condition. For additional information regarding cybersecurity risks and their potential impacts on our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Our Vice President, Technology and Digital Health, serves as our Head of Cybersecurity and is responsible for developing and executing our cybersecurity strategy and program. We also maintain a team of cybersecurity professionals who are responsible for security operations and report to the Head of Cybersecurity, who has more than 20 years' experience in cybersecurity and information technology infrastructure and operations.


text: Our Head of Cybersecurity is regularly informed about developments in cybersecurity, including potential threats and innovative risk management techniques in the interest of effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Head of Cybersecurity oversees the processes for monitoring our information systems, including periodic system audits to identify potential vulnerabilities and third-party audits and evaluations. In the event of a cybersecurity incident, the Head of Cybersecurity implements an incident response plan. This plan includes immediate actions to mitigate the impact of incidents and strategies for remediation of future incidents. The Head of Cybersecurity is responsible for reporting information about cybersecurity risks and incidents to our Chief Financial Officer and other members of executive management.


text: Our board of directors oversees our enterprise risk management, including our management of cybersecurity risks. The audit committee of our board of directors has primary responsibility for the oversight of risks from cybersecurity threats. The Head of Cybersecurity, or a delegate, provides quarterly reports to the audit committee on the effectiveness and overall status of our cybersecurity program, and is responsible for reporting to the audit committee information about our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses.


text: The Company faces motivated and persistent cybersecurity threats from a variety of adversaries on a daily basis. As a manufacturing company dispersed across multiple states supported by a global supply chain, the Company recognizes the critical importance of maintaining the safety and security of its networks and systems, as well as ensuring the confidentiality, integrity, and availability of its data. The Company employs a holistic process for overseeing and managing cybersecurity and information security risks which is supported by both management and its Board of Directors. As described in more detail below, the Company has established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. The Company has devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations and intends to continue to make significant investments to maintain the security of its data and cybersecurity infrastructure.

companyName: BOSTON BEER CO INC

ticker: SAM


text: The Company's cybersecurity program is led by its Chief Information Security Officer (CISO), who reports to its Chief Information Officer (CIO). The CISO is responsible for management of cybersecurity risk and the protection and defense of the Company's networks and systems. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in incident response, forensics, threat intelligence, vulnerability management, and mitigation. The Company's cybersecurity team has processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees, mechanisms to detect and monitor unusual network and endpoint activity, integrated threat intelligence, and containment and incident response tools. The cybersecurity team also leverages multiple third-party security programs for full-time monitoring of security stacks and on-demand support to act as force multipliers in the event of severe or critical security events.


text: The Company's Board of Directors has ultimate oversight of cybersecurity risk and aids in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board of Directors is assisted by the Audit Committee, which regularly reviews the cybersecurity program with management and reports to the Board of Directors. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur at least once annually, or more frequently as determined to be necessary or advisable.


text: The Company's approach to cybersecurity risk management includes the following key elements: • Multi-Layered Defense and Continuous Monitoring. The Company works to protect its computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from its defense and monitoring efforts to proactively prevent future attacks. The Company utilizes best-in-class SIEM technologies, data analytics and threat intelligence to detect anomalies and search for cyber threats. The Company's internal cybersecurity team and third-party security services provide comprehensive cyber threat detection and response capabilities and maintain a full-time monitoring system which complements the technology, processes and threat detection techniques we use to monitor, manage and mitigate cybersecurity threats. From time to time, the Company engages third-party consultants or other advisors to assist in assessing, identifying and/or managing cybersecurity threats and also periodically uses its Internal Audit function to conduct additional reviews and assessments. • Third-Party Risk Assessments. The Company conducts information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties, and its standard terms and conditions contain contractual provisions requiring certain security protections. • Training and Awareness. The Company conducts monthly attack simulations across the Company and provide awareness training to our coworkers to help identify, avoid and mitigate cybersecurity threats. Employees with network access participate annually in required training, including spear phishing, malware, access control, and other awareness training. The Company also periodically hosts tabletop exercises with management and other employees to practice rapid cyber incident response; • Supplier Engagement. The Company requires its suppliers to comply with its standard information security terms and conditions as a condition of doing business, and requires them to complete information security questionnaires to review and assess any potential cyber-related risks depending on the nature of the services being provided. The Company also monitors supplier network access to its networks and systems.


text: While the Company has experienced minor cybersecurity incidents in the past, to date none have materially affected the Company or its financial position, results of operations and/or cash flows. The Company continues to invest in the cybersecurity and resiliency of its networks and to enhance its internal controls and processes, which are designed to help protect its systems, infrastructure, and the information they contain.


text: In connection with the advisory agreement with a wholly-owned subsidiary of UHS, as discussed herein, we utilize certain of UHS' information technology ("IT") applications, consisting primarily of financial data applications. In addition, UHS and our third-party property managers rely extensively on IT systems to, as applicable, manage clinical and financial data, communicate with patients, tenants, payers, vendors and other third parties; and to summarize and analyze operating results. These various IT systems, and the networks and information systems of third parties that we, UHS and our third-party property managers rely on, are subject to damage or interruption from power outages, facility damage, computer and telecommunications failures, computer viruses, security breaches including credit card or personally identifiable information breaches, vandalism, theft, natural disasters, catastrophic events, human error and potential cyber threats, including malicious codes, worms, phishing attacks, denial of service attacks, ransomware and other sophisticated cyber-attacks, and our disaster recovery planning cannot account for all eventualities. These systems, in turn, interface with, and rely on, third-party systems that we do not control. Third parties to whom we outsource certain of our functions, or with whom our systems interface and who may, in some instances, store our sensitive and confidential data, are also subject to the risks outlined above and may not have or use controls effective to protect such information. An attack, breach or other system disruption affecting any of these third parties could similarly harm our business.

companyName: UNIVERSAL HEALTH REALTY INCOME TRUST

ticker: UHT


text: As cyber criminals continue to become more sophisticated through evolution of their tactics, techniques and procedures, we, UHS and our third-party property managers have taken, and will continue to take, additional preventive measures to strengthen the cyber defenses of the collective networks and data. Protecting data, which includes information related to clinical and financial data, and communications with patients, tenants, payers, vendors and other third parties is a primary area of focus for us, UHS, and our third-party property managers. Given the critical nature of this information, certain cybersecurity risk management programs were implemented to assess, identify, and manage risks associated with cybersecurity threats as identified in Item 106(a) of Regulation S-K.


text: UHS has a multi-tier risk management structure that includes regular reviews of laws, policies, vulnerabilities, and resource levels to address risks facing our organization. Such risks include operational, intellectual property theft, fraud, risks that have potential unfavorable impacts on our employees and/or patients, and violation of data privacy or security laws. To address cybersecurity risks facing UHS, and in turn us, to the degree applicable, UHS has adopted a "continuous risk assessment" process. UHS, through a third party, conducts a bi-annual National Institute of Technology-Cyber Security Framework assessment to determine the maturity of its program and related controls. The results of that assessment are shared with management of UHS, which drives prioritization and investment in resources to address those risks. Likewise, annual penetration tests occur to review the efficacy of technical controls, results which are reviewed by management of UHS and resolved in a timely manner. Other factors that feed into UHS' risk management practices are also operational events and incidents, which can lead to controls being reviewed and enhanced.


text: UHS also has a mature incident response process in place in the event a cybersecurity incident occurs. This process defines roles, responsibilities and action plans designed to contain, eradicate, and restore systems in the event of a major disruption. Regularly, UHS conducts tabletop exercises to simulate responses to an incident and implement any insight gained from those exercises to improve recovery practices. As part of these processes, UHS regularly engages with assessors, consultants, auditors, and other third parties to review UHS' cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: For our the third-party property managers that manage a significant portion of our properties, we conduct periodic reviews of the policies and procedures they have established to detect, contain, eradicate, and restore systems in the event of a major disruption.


text: Based on the information available as of the date of this Form 10-K, during our fiscal year 2023 and through the date of this filing, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on risks to us from cybersecurity threats, see "Risks Related to Business Operations - A cyber security incident could cause a violation of HIPAA, breach of member privacy, or other negative impacts." under "Item 1A. Risk Factors."


text: The Audit Committee of our Board of Trustees is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates, as warranted, regarding matters of cybersecurity, including review of significant issues encountered by us, UHS or our third-party managers.


text: UHS' cybersecurity risk management and strategy processes are overseen by leaders from their Information Security, Compliance, Legal and Internal Auditing teams. Such individuals have an average of over 20 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: Nucor recognizes the importance of developing, implementing, and maintaining effective cybersecurity measures designed to protect our information systems and the confidentiality, integrity, and availability of our data. We face a number of information technology and cybersecurity threats which could have an adverse effect on our business and results of operations.

companyName: NUCOR CORP

ticker: NUE


text: Notwithstanding the Company's cybersecurity framework and preventative strategies, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Item 1A. Risk Factors" for a discussion of cybersecurity risks.


text: We have developed and implemented a cybersecurity risk management program that is intended to enable us to assess, identify, and manage risk associated with cybersecurity threats. Our program is based on the Cybersecurity Framework promulgated by the National Institute of Standards and Technology and other applicable industry standards, and includes the following key elements: • identification and assessment of cybersecurity threats based on internal and external assessments and monitoring, information from internal stakeholders, and external publications and resources such as those made available by the United States Cybersecurity and Infrastructure Security Agency; • technical and organizational safeguards designed to protect against identified threats, including documented policies and procedures, technical controls, and employee education and awareness; • processes to detect the occurrence of cybersecurity events, and maintenance and regular testing of incident response and recovery and business continuity plans and processes; and • a third-party risk management process to manage cybersecurity risks associated with our service providers, suppliers, and vendors. The program is designed to foster a culture of cybersecurity risk management across the Company.


text: Integrated Overall Risk Management Assessing, identifying, and managing cybersecurity-related risks is integrated into our overall risk management framework. The Company conducts an annual cybersecurity risk assessment and reports the most significant risks and associated planned mitigation strategies to the Audit Committee of the Board of Directors. The annual risk assessment is carried out under the supervision of the President of Nucor Business Technology, the Company's Cybersecurity Director, and the Company's Vice President and Corporate Controller. See "Governance" below. The Board also regularly receives focused presentations regarding cybersecurity risks from the Company's Cybersecurity Director.


text: Third-Party Engagement Due to the complexity and ever-changing nature of cybersecurity threats, Nucor engages a range of external experts to assist in its assessment, identification, and management of risks from cybersecurity threats. These include cybersecurity assessors, forensic and incident response experts, and auditors to review the Company's cybersecurity posture and responsive efforts. Our relationships with these external partners enable us to leverage their expertise with the goal of maintaining best practices.


text: Oversight of Third-Party Risks Our third-party service providers, suppliers, and vendors face their own risks from cybersecurity threats that could impact Nucor in certain circumstances. In response, we have implemented processes for overseeing and managing these risks. Those processes include limiting the exposure of our information systems to external systems to the least practicable amount, assessing the third parties' information security practices before allowing them to access our information systems or data, requiring the third parties to implement appropriate cybersecurity controls in our agreements with them, and conducting ongoing monitoring of their compliance with those requirements. We also utilize third-party risk and compliance monitoring services to monitor our service providers, suppliers, and vendors and to augment the effectiveness of our risk mitigation efforts in this area.


text: Risks from Cybersecurity Threats As of the date of this report, no risks from cybersecurity threats, including as a result of cybersecurity incidents we have experienced in the past, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. The Company seeks to ensure effective governance in managing risks associated with cybersecurity threats, as more thoroughly described below.


text: The Audit Committee of the Board of Directors is responsible for the oversight of risks from cybersecurity threats. The Audit Committee is composed of directors with a wide range of experience, including risk management and controls, and technology. See "Integrated Overall Risk Management" above.


text: Management's Role in Cybersecurity Risk Management A division of the Company known as Nucor Business Technology, or NBT, is responsible for the Company's information technology needs, including cybersecurity risk assessment and management. NBT's cybersecurity function is led by the Cybersecurity Director, who reports to the President of NBT, who in turn reports to the Company's Chair, President, and Chief Executive Officer. The current Cybersecurity Director has twenty years of experience in the cybersecurity field and has broad expertise in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, and incident response.


text: The Company also has a Risk Committee composed of the following members of the Company's management: • Executive Vice President, Business Services & General Counsel • President, Nucor Business Technology • Vice President and Corporate Controller • Vice President and General Manager, Corporate Legal Affairs • General Manager of Internal Audit • Cybersecurity Director • Manager of External Reporting The Risk Committee is responsible for overseeing the Company's response to cybersecurity incidents. The Risk Committee and the Chair, President, and Chief Executive Officer inform the Audit Committee and the Board of Directors on cybersecurity risks.


text: Monitoring of Cybersecurity Incidents The Cybersecurity Director implements and oversees our processes for regularly monitoring our information systems. This includes security measures and regular audits to identify potential issues. In the event of a cybersecurity incident, we have an established incident response plan that requires prompt notification of the Cybersecurity Director or their designee, who in turn oversees our assessment of and response to the incident. The Cybersecurity Director is also responsible for informing the Risk Committee of cybersecurity incidents, which in turn has a detailed process for assessing the impacts of incidents and monitoring the Company's mitigation and remediation efforts. Depending on the nature of the incident, this process also provides for escalating notification to senior executives, including the Chair, President, and Chief Executive Officer and to the Board of Directors.


text: We are committed to protecting the privacy and security of our information assets and the data entrusted to us. Our cybersecurity program comprises multiple levels of physical, technical, and administrative safeguards. Our cybersecurity program is informed by industry standards, including the Center for Information Security (CIS) framework for security controls and benchmarks, the National Institute of Standards and Technology (NIST) standards, and the ISO 27000 framework. This does not imply that we meet any particular technical standards, specifications, or requirements at all times, only that we use CIS, NIST, and ISO 27000 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: TREACE MEDICAL CONCEPTS, INC.

ticker: TMCI


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration results in cybersecurity considerations as a key part of our decision-making processes. Our cybersecurity team considers emerging threats and new vectors of cyberattack and pursues a deliberate risk-avoidance approach. We also maintain our written security incident response runbook detailing the response and notifications involved with various security events.


text: Our cybersecurity training and education emphasizes periodic phishing tests and a mandatory training curriculum to assist our employees' awareness of common types of attacks. This includes awareness of phishing, malware, social engineering, and overall security best practices for new and existing employees. We also perform periodic, independent risk assessments that consider four primary areas of risk: physical, digital, social, and administrative/governance.


text: Since we understand that cybersecurity threats are complex and evolving, we have a dedicated team of both internal and external cybersecurity experts, which is led by our Chief Information Officer (CIO), Security Officer. This team is responsible for publishing information technology and security policies, promoting compliance with those policies, implementing a program to mitigate potential threats, and performing periodic risk and maturity assessments. Our risk mitigation measures include network segmentation, cyber protection and containment, detection and response, and recovery. The primary goal of this team is to decrease the risk of cyber incidents having a material impact.


text: We also have plans in place to respond to cybersecurity incidents. These plans address issues relating to preparation for and detection of incidents, as well as responding to and recovering from incidents. We have procedures designed to assess, investigate, contain, remediate, and mitigate cybersecurity incidents, as well as procedures that seek to comply with legal obligations and regulatory reporting requirements. We periodically engage with assessors, consultants, auditors, and other third parties to review our cybersecurity processes.


text: Recognizing the risks associated with third-party service providers, we implement processes to manage these risks. We conduct assessments of critical third-party providers before engagement and maintain ongoing monitoring to assess compliance with our cybersecurity standards. In addition, we require SOC 1 Type II attestations from those IT vendors whose applications or cloud infrastructure handle sensitive information.


text: In the past three years, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See the risk factor entitled "Our information technology systems may be subject to breaches, cyber-attacks or other disruptions that could, among other adverse consequences, cause us to violate laws and regulations and could adversely affect our business, results of operations, financial condition, cash flows, reputation or competitive position."


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee responsibility for oversight of risk assessment and risk management, including cybersecurity, and the Company's policies and controls relating to information technology, management information systems, and cybersecurity. The Audit Committee receives quarterly reports from management on our cybersecurity risk management activities. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity.


text: The CIO, Security Officer has over three decades of technology experience, working for leading technology and consulting companies and previously served as CIO, Security Officer for both public and private medical device and healthcare organizations. Our cybersecurity team includes a former chief information security officer for large healthcare organizations, a former head of global security for a major enterprise cybersecurity platform, and other similarly credentialed professionals. Our CIO, Security Officer reports to the Chief Financial Officer and provides regular reports to the Audit Committee on cybersecurity policies, procedures, and risk and remediation efforts. Our CIO, Security Officer also serves on our Disclosure Committee and has regular dialogue with the senior management team on information security matters and risk management practices.


text: The CIO, Security Officer is regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. We believe this ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The cybersecurity team implements and oversees processes for the regular monitoring of our information systems. In the event of a cybersecurity incident, the cybersecurity team follows a written security incident response runbook, which includes procedures to, among other things, respond to the incident, mitigate its impact, and evaluate and satisfy applicable obligations.


text: We have implemented policies and processes to evaluate and manage cybersecurity risks, incorporating them into our broader risk management framework. We regularly examine cybersecurity threats that could compromise our information systems' security or data.

companyName: Revolve Group, Inc.

ticker: RVLV


text: Every quarter, we evaluate our cybersecurity posture and reassess whether significant changes in our business could impact our digital infrastructure. These assessments aim to identify potential internal and external threats, estimate their probability and possible impact, and gauge the effectiveness of our current policies and processes in mitigating these threats.


text: Following these risk assessments, we evaluate whether and, if so, how to re-design, implement and maintain reasonable safeguards to minimize identified risks and reasonably address any identified gaps in existing safeguards. We also regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our chief architect, who reports to our co-chief executive officer, to manage the risk assessment and mitigation process.


text: We regularly check and improve our security measures and educate our employees about them with the help of our information technology team. Key personnel are made aware of our cybersecurity policies through trainings.


text: We engage third parties in connection with our risk assessment processes. We require all external service providers who may impact our cybersecurity risks to certify that they can set up and maintain proper security consistent with all applicable laws, manage security effectively for their work with us, and quickly inform us if they think their security has been breached.


text: We have never experienced a cybersecurity incident that was determined to be material, although, like many technology-dependent companies operating in the current environment, we have experienced cybersecurity incidents in the past.


text: For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations or financial condition, please see the section titled "Risk Factors."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors monitors and assesses strategic risk exposure, and our executive officers manage the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole and through the audit committee.


text: Our chief architect, who has over 15 years of experience in software engineering, has served as our chief architect for seven years, works with our cybersecurity management committee to manage our cybersecurity policies and processes, including those described in the "Risk Management and Strategy" section above. They stay informed and manage how we identify, address, prevent and resolve cybersecurity issues and related matters. This is done through regular checks of our systems, tests to identify security weaknesses and maintaining our incident response plan.


text: Our chief architect and the cybersecurity management committee are responsible for our cybersecurity rules and methods, like those described in the "Risk Management and Strategy" section. They stay updated and track how we prevent, identify, lessen and address cybersecurity issues. This is done through regular checks of our systems, tests to find security weaknesses and having a plan ready to respond to any incidents. In addition to regular meetings, the chief architect and co-chief executive officer regularly discuss active, emerging and potential cybersecurity risks. They keep each other informed about significant changes affecting cybersecurity, and they periodically update our board of directors or the audit committee about these changes as well as our cybersecurity risks, so that our board of directors can administer its oversight function as part of its broader oversight and risk management.


text: We rely on IT networks and systems to process, transmit and store electronic information and to manage or support our business. We have implemented information security processes designed to identify, assess and manage risks from cybersecurity threats to our systems and data.

companyName: Easterly Government Properties, Inc.

ticker: DEA


text: These processes are supported by a multidisciplinary team, including our legal department, management and third-party information security service providers, as described further below. We leverage internal and external resources to monitor and evaluate our threat environment, including the use of our third-party managed service provider, manual and automated tools, threat intelligence reporting and analysis services, security scans and testing and internal and external audits. In addition, as part of our ongoing cybersecurity efforts, we have implemented a process for mandatory cybersecurity awareness training for new employees during onboarding and at least annually thereafter. We also conduct ongoing phishing simulations in an effort to raise awareness and support our training efforts.


text: Our cybersecurity risk assessment process includes quarterly reviews of our cybersecurity controls, annual third-party penetration tests and annual internal assessments of our cybersecurity program as informed by the NIST Cybersecurity Framework. The results of our assessments are discussed with management and the audit committee of our board of directors. We have also established incident response processes for reporting to the audit committee for certain cybersecurity incidents, as appropriate.


text: We utilize certain third-party service providers to perform a variety of functions relating to the acquisition, development and management of our properties. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include a review of the cybersecurity practices of such provider, including through security questionnaires and applicable security certifications or reports, as appropriate.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, to date that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K for additional discussion about cybersecurity-related risks.


text: Our board of directors is responsible for overseeing our strategy and risk management process and discharges its duties both as a full board and through its committees. As reflected in the audit committee charter, our board has delegated to the audit committee oversight of our risk assessment and management process, including processes related to cybersecurity. The audit committee meets at least annually with management, our internal auditor and our contracted Chief Technology Officer to discuss our cybersecurity program in regards to potential significant financial or operational risk exposures and the measures implemented to monitor and address those risks, including those that may result from cybersecurity threats. As necessary or appropriate, these discussions may include our risk assessment and risk management policies. In addition to our multidisciplinary management team, we rely on our internal audit function in collaboration with a third-party information security service provider to lead our cybersecurity risk assessment and management processes and oversee their implementation and maintenance. We have a longstanding relationship with our third-party information security service provider, which includes services from our contracted Chief Technology Officer. The contracted Chief Technology Officer has approximately 15 years of information technology experience, including nine years in the finance and real estate sectors, and our Head of Internal Audit, has approximately 30 years of audit experience, including 20 years in the real estate and financial services sectors.


text: Management is responsible for hiring personnel to support our cybersecurity strategy, as appropriate, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management is also responsible for approving technology budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our clinical trial and related data, or Information Systems and Data.

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: Our information security function, which is led by our Vice President of Information Technology, or VP of IT, helps identify, assess and manage our cybersecurity threats and risks. The information security function identifies and assesses cybersecurity threats and risks by monitoring and evaluating our threat environment and the our risk profile using various methods including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats, evaluating threats reported to us, internal and external audits, leveraging third party threat assessments, conducting vulnerability identification assessments, and leveraging external threat intelligence.


text: Depending on the environment or system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, disaster recovery and business continuity plans, encryption of certain data, network security controls, data segregation for certain data, access controls, physical controls, systems monitoring, penetration testing, and cybersecurity insurance. Certain information about our assessment and management of material risks from cybersecurity threats is included in risk management reports as applicable to senior leadership and the audit committee.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, managed cybersecurity service providers, professional service firms, including legal counsel, forensic investigators, and penetration testing service providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as software-as-a-service providers, hosting companies, supply chain resources, contract research organizations, and contract manufacturing organizations. Depending on the nature of the services provided, the sensitivity of the critical systems, information and assets at issue, and the identity of the provider, we may conduct a review of security assessments provided by the vendor.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. "Risk Factors" in this Annual Report, including "If our information technology systems, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. Our board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our VP of IT, who has 25 years of experience in information technology including IT leadership in Department of Defense Research, who reports to our Chief Financial Officer, or CFO, who has over 20 years of experience as a CFO, including supervisory responsibility over IT and cybersecurity functions.


text: Our VP of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our VP of IT is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CFO, General Counsel, or GC, and Chief Executive Officer, or CEO. Our GC, CFO, and other leadership personnel work with our incident response team to help assess impact and mitigate and remediate cybersecurity incidents of which they are notified, in addition to notifying the audit committee of our board of directors, as appropriate.


text: Our board of directors' audit committee receives annual reports from our CFO, concerning our significant cybersecurity threats and risk and the processes the Company has implemented to address them. Our audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We recognize that cybersecurity threats pose a risk to our business. As part of the Company's overall risk management systems and processes, we employ a risk management framework designed with the goals of identifying, assessing and managing material risks from cybersecurity threats. Key aspects of this risk management framework include, but are not limited to: • Maintaining a cybersecurity incident response plan, coordinated by the Company's IT department and Chief Information Security Officer, which includes controls and procedures for identifying, reporting and responding to cybersecurity incidents; • Partnering with outside cybersecurity vendors periodically to gain an independent view of our cybersecurity and information security program; • Providing our employees with regular training on cybersecurity and the protection of our information systems; • Maintaining and testing a business continuity and disaster recovery program; • Database activity monitoring, encryption, secure file transfer protocols and application firewalls; and • Maintaining insurance coverage intended to address cybersecurity and data breach risks.

companyName: Addus HomeCare Corp

ticker: ADUS


text: We have also implemented processes to help identify, assess and manage cybersecurity risks associated with our use of third-party service providers.


text: We do not believe that risks from cybersecurity threats of which we are currently aware, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see "A cyber-attack or security breach could cause a loss of confidential consumer data, give rise to remediation and other expenses, expose us to liability under HIPAA, consumer protection laws, common law and other legal theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, adversely impact our financial results, and otherwise be disruptive to our business." included in Part I, Item 1A of this Form 10-K.


text: Our cybersecurity risk management program is integrated into our overall risk management system and processes. Together with the Board's standing committees, the Company's Board of Directors is responsible for ensuring that material risks, including material cybersecurity risks, are identified and managed appropriately. The Board receives updates at least bi-annually from our Chief Information Officer concerning our information security and cyber risk strategy, cyber defense initiatives, cyber event preparedness and cybersecurity risk assessments. The Chief Information Officer has extensive IT and program management experience and works closely with our Chief Information Security Officer, who oversees our cybersecurity program on a day-to-day basis. The Chief Information Security Officer has extensive cybersecurity experience, including more than 15 years working in senior IT infrastructure and IT security roles in the healthcare sector (seven of which years were spent as the Chief Information Security Officer). Our cybersecurity incident response plan provides that the Chief Information Security Officer will work with our IT Department and the impacted segment of our business to investigate and respond to any identified incident (including by escalating the incident to the Company's senior management and the Board depending on the nature and scope).


text: We recognize the need to maintain the security and confidentiality of personal information, protected health information, and other confidential data that we collect and use in connection with our business, and the importance of assessing, identifying, and managing various cybersecurity risks that may impact our business. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Alphatec Holdings, Inc.

ticker: ATEC


text: We design and assess our program based on various cybersecurity frameworks, most prominently the Health Information Trust Alliance ("HITRUST") Common Security Framework, and Service Organization Controls ("SOC") 2, developed by the American Institute of CPAs. In 2023, our cybersecurity systems and services issued a SOC 2 Type 1 report for the design of our security processes. We use this cybersecurity framework and information security controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity program includes annual review and assessment by external, independent third parties, who certify and report on these programs.


text: As part of our enterprise risk management process, we assess the various cybersecurity risks that may impact our business and implement plans and initiatives that are intended to mitigate those risks.


text: Our information security program includes: (i) risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, software, and services; (ii) an information security team principally responsible for managing our (1) information security risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents; (iii) risk assessments and security tests, conducted internally and by external security and risk audit providers, as appropriate; (iv) new-hire and annual cybersecurity awareness training of our employees; (v) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and (vi) third-party risk assessment procedures to review material third-party vendors and applications for information security.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight over our information security and technology risks, including our information security, cybersecurity and related risk management programs. The Audit Committee oversees management's implementation of our information security program and receives periodic reports from management on our material cybersecurity risks. Additionally, management updates the Audit Committee, as necessary, regarding material cybersecurity incidents. The full Board receives quarterly updates from management on our information security program.


text: Our management team, including our IT management team, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. To support data security, we have established an integrated risk management framework with practices that are derived from industry standards, including ISO 27001, HITRUST Common Security Framework (CSF) 11.2 certification, the NIST Cybersecurity Framework, and data privacy regulations, including HIPAA and the General Data Protection Regulation. The data security controls from these standards and regulations are evaluated for our risk management framework based on the needs of our business and our clients, the nature of our industry, and applicable regulations.


text: Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: The Company is not aware of any cybersecurity threats or incidents to date that have materially affected its strategy, results of operations, or financial condition. However, the scope and impact of any future cybersecurity incident cannot be predicted with certainty. More information on how material cybersecurity attacks may impact the Company's business is provided in "Item 1A. Risk Factors".

companyName: IMAX CORP

ticker: IMAX


text: Cybersecurity Risk Management Framework The Company employs a multi-faceted cybersecurity risk management framework, which is integrated into its enterprise risk management system. The Company aligns its security policies and practices with the ISO 27001 framework and manages its cybersecurity risks through a dedicated information security team, reporting to Mr. Preston. The information security team is tasked with, among other things, assessing, identifying and managing material cybersecurity risks and overseeing the implementation of the Company's cybersecurity strategy. The Company's cybersecurity risk management includes, but is not limited to, the following elements.


text: o The team conducts periodic risk assessments, which includes penetration testing and vulnerability scanning, on the Company's Information Technology (IT) infrastructure, systems, and networks to identify potential vulnerabilities, weaknesses, and risks, and evaluates the potential impact of cybersecurity risks on the Company's operations, financials, and business.


text: o The team implements and maintains a multi-layered defense approach to safeguard the Company's information technology infrastructure in accordance with industry best practices and updates the Company's systems and software to address identified vulnerabilities. The Company has also developed an incident response and disaster recovery plan to respond to cybersecurity incidents.


text: o The Company evaluates the risk profile of its third-party service providers and may include cybersecurity enhancement or compliance requirements in its service agreements, as needed. The information security team periodically reviews key vendors and counterparties' cybersecurity practices and may conduct audits or assessments at its discretion.


text: In addition, the Company has established clear lines of communication with key stakeholders, including executives, IT teams, employees, and customers, to ensure transparency and an effective response to cybersecurity incidents. Furthermore, the information security team develops and provides cybersecurity awareness training to the Company's employees and regularly communicates updates on best cybersecurity practices and improvements in the cybersecurity program.


text: The Company may use third-party programs and software and engage assessors, consultants, cybersecurity auditors, or other third parties to review, test, and advise on improvements to the Company's cybersecurity infrastructure.


text: Role of the Board of Directors The Audit Committee oversees the Company's risk management and assessment, including its mitigation strategies, and updates the entire Board on the Company's risk profile and exposures on an as needed basis. With respect to cybersecurity, the Company's Chief Technology Officer ("CTO") and Head of Information Security updates the Audit Committee on at least an annual basis on matters such as external cybersecurity threats and attack trends; updates to threat monitoring processes; the composition of the Company's information security team; cybersecurity awareness training and testing; cybersecurity strategy; cybersecurity metrics, and assessments the progress of cybersecurity programs; and the potential scope and impact of cybersecurity risks and incidents on the Company's operations and financial condition. The Audit Committee may also meet with management on an ad hoc basis to discuss and review any material cybersecurity incidents or threats.


text: Role of Management Management is responsible for managing risks and informing the Board of the Company's material near- and long-term risks and risk management strategies. Management presents the Company's risk assessment, which includes its cybersecurity risks, to the Audit Committee on at least an annual basis.


text: The Chief Technology Officer ("CTO") leads management's assessment and management of cybersecurity risks. The Company's Head of Information Security leads the information security team, which is responsible for managing day-to-day cybersecurity risks and implementing and maintaining the Company's cybersecurity strategy. The Head of Information Security reports to and regularly briefs the CTO on cybersecurity matters, including results of vulnerability testing and remediation, cyber incident responses, and progress on cybersecurity infrastructure initiatives. The CTO and Head of Information Security update the Audit Committee about cybersecurity risks and any investigation of a material cybersecurity incident.


text: The Company's current CTO has over 20 years of experience in senior technology leadership roles, involving oversight of all aspects of technology development and technical operations, including cybersecurity.


text: The Company's current Head of Information Securities has over 20 years of experience in cybersecurity roles, including in cybersecurity engineering, information security assessment, and development and management of corporate security policies and governance problems.


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company relies on the cybersecurity strategy and policies implemented by Bain Capital, the parent of the Advisor and Administrator, which apply to the Company and its operations.

companyName: Bain Capital Specialty Finance, Inc.

ticker: BCSF


text: Bain Capital has adopted and implemented an Information and Cybersecurity Program ("Cybersecurity Program") that prioritizes detection and analysis of and response to cybersecurity threats, management of security risks and resilience against cyber incidents, including those that may impact the Company. The Cybersecurity Program aligns with National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and is reviewed and adjusted as needed and is approved by the Bain Capital's Chief Information Security Officer ("CISO").


text: Bain Capital's Cybersecurity Program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help prevent and respond to cybersecurity threats and incidents, including threats or incidents that may impact the Company, the Advisor or the Administrator. Bain Capital's cybersecurity risk management processes, which are part of Bain Capital's overall risk management system, seek to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessments of cybersecurity risks, including those which may impact the Company, the Advisor, or the Administrator, are reported to the Bain Capital Credit Risk Oversight Committee ("ROC") for awareness, review or action, as appropriate. In addition, the Company relies on Bain Capital to periodically engage with third-party consultants and key vendors to assist it in assessing, enhancing, implementing and monitoring its cybersecurity risk management processes and responding to incidents.


text: Internal and external networks, including the networks on which the Company relies, are assessed for vulnerabilities. Bain Capital also engages with independent third parties to conduct relevant technical assessments.


text: Bain Capital seeks to remain aware of the evolving global threat landscape through vendor relationships, partnerships with threat intelligence providers and membership of industry forums/groups, as well as research performed by members of the Information Security Team. Bain Capital is currently an active member of the Financial Services Information Sharing and Analysis Center (FS-ISAC) and the Alternative Investment ISAC.


text: Bain Capital provides information security awareness training to employees, and function-specific security training is also provided (where appropriate based on job function). Bain Capital also engages in phishing campaigns.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on Bain Capital's Vendor Risk Management Program in conjunction with a Third Party Risk Management (TPRM) steering committee to assess risks posed when engaging with external vendors and/or third parties, including identifying and overseeing risks from cybersecurity threats associated with the Company's use of such entities.


text: In the event of a cybersecurity incident impacting the Company, the Advisor has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational and risk functions of Bain Capital, which may include coordinating with the relevant employees of the Advisor and management of the Company. The incident response plan includes notification to the applicable members of cybersecurity leadership, including Bain Capital's CISO, and, as appropriate, escalation to other relevant individuals.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with Bain Capital's CISO, as well as other risk management, legal, information technology, and/or compliance personnel of Bain Capital.


text: Material Impact of Cybersecurity Risks During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or that are reasonably likely to materially affect the Company, including our business strategy, operational results, and financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors— General Risk Factors— We are highly dependent on information systems, and systems failures or cyber-attacks could significantly disrupt our business, which may, in turn, negatively affect the value of our Common Shares and our ability to pay distributions."


text: The Company's Board of Directors ("Board") provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO"), which incorporates updates provided by Bain Capital's CISO regarding the overall state of the Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents potentially impacting the Company.


text: Bain Capital's CISO and Information Security Team are responsible for the Cybersecurity Program applicable to the Company and, along with the Company's CCO, are responsible for assessing and managing material risks from cybersecurity threats that impact the Company. The CCO of the Company oversees the Company's oversight function generally and relies on Bain Capital's CISO to assist with assessing and managing material risks from cybersecurity threats. The Company's CCO has been responsible for this oversight function as CCO to the Company for 9 years and has more than 13 years' experience in information security, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company. Members of Bain Capital's management also possess relevant expertise in various disciplines that are key to effectively managing such risks, such as extensive experience in managing compliance risks in the financial sector, including those related to cybersecurity. Bain Capital's CISO has deep expertise in cybersecurity, holding the CISSP certification and having completed an Executive Master's in Cyber Security from Brown University and having received a Chief Risk Officer Certificate from Carnegie Mellon. Members of Bain Capital's Information Security Team hold various industry certifications and regularly attend trainings and industry conferences


text: We recognize the critical importance of developing, implementing, and maintaining proactive cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. To that end, we engage in the following cybersecurity risk management principles:

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a Company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. The security function housed within our Information Technology department continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs and in cooperation with our broader risk management team.


text: Third-Party Risk Management Advisors Recognizing the complexity and the evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our cybersecurity program and practices. This ecosystem enables us to leverage specialized knowledge and insights, ensuring our cybersecurity program and practices remain attuned to our Company's particular needs and vulnerabilities. Our collaboration with these third-parties includes penetration tests on externally facings systems, threat assessments and subject matter expertise consultation on risk remediation and security enhancements.


text: Vendor Risk Oversight Given the risks associated with using third-party service providers, we have developed stringent practices to oversee and manage these risks. We start the assessment right from the vendor onboarding stage, by conducting security and background assessments of vendors prior to their engagement, and we monitor ongoing relationships to ensure compliance with our cybersecurity standards. This practice is designed to mitigate risks related to data breaches or other security incidents originating from third-parties.


text: Risks from Cybersecurity Threats To date, we have not yet experienced any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business, financial condition or results of operations.


text: The Board is acutely aware of the critical nature of managing risks associated with cybersecurity threats given the significance of these threats to our operational integrity and stakeholder confidence. As such, the Board engages with our management team for periodic updates on our cybersecurity risk program and progress on remediation efforts.


text: The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with depth of experience in enterprise risk management, compliance, corporate governance, technology, finance, and the unique characteristics and vulnerabilities of the oil and gas industry, equipping them to oversee cybersecurity risks effectively.


text: Management's Risk Management Role Our Chief Financial Officer and our VP of Technology play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide briefings to the Audit Committee encompassing a broad range of topics, including: • the current cybersecurity landscape and emerging threats; • the status of ongoing cybersecurity initiatives and progress on remediation efforts; and • compliance with regulatory requirements and industry standards.


text: Cybersecurity Risk Management Personnel Our VP of Technology, Shaam Farooq, has primary responsibility for assessing, monitoring, and managing our cybersecurity risks. Mr. Farooq has over 25 years of global technology leadership experience in the oil and gas, technology, manufacturing, and automotive industries. Mr. Farooq has led the technology functions and overseen the cybersecurity and digital transformation of startups and Fortune 100 companies alike and brings deep domain expertise and hands on experience to his role. His background includes extensive experience as an enterprise CISO and is an active participant in the oil and gas cybersecurity community, keeping abreast of late breaking threats and remediations. Shaam continues to refresh his Certified Information Systems Security Professional and Certified Information Security Manager trainings as schedule permits.


text: Cybersecurity Incident Monitoring The VP of Technology is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The VP of Technology has implemented industry tools and oversees the processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the VP of Technology is equipped with a well-defined incident response plan (IRP) which is continuously enhanced. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board The VP of Technology, in his capacity, regularly informs the Executive Chairman and Chief Executive Officer and President and Chief Financial Officer of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. In addition to regular briefings, any significant cybersecurity matters and strategic risk management decisions would be escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Board Oversight Responsibilities The Board of Directors bears the ultimate responsibility for ensuring that an adequate cyber and information technology risk (IT risk) management framework is in place and functioning as intended. IT risk focuses on information and information systems, especially the most critical and vital information assets. Without reliable and properly secured information systems, business operations could be severely disrupted. Likewise, the preservation and enhancement of the Company's reputation is directly linked to the way in which both information and information systems are managed. Maintaining an adequate level of security is one of several important aspects of managing IT risk. The Board's oversight responsibility in this respect includes oversight of the Company's vendor management program and the periodic evaluation of the Company's IT risk management controls.

companyName: FARMERS & MERCHANTS BANCORP INC

ticker: FMAO


text: The Board of Directors implements its IT risk oversight obligations primarily through the Board's Enterprise Risk Management Committee (ERM Committee). The primary function of the ERM Committee is to advise the Board of Directors regarding the enterprise risk management framework of the Company and to provide oversight to assist the Board of Directors in supervising enterprise risk management activities. The ERM Committee reviews and defines risk exposure limits for each specified risk category, including IT risk, while taking into consideration strategic goals and objectives and current market conditions. The Board ERM Committee reviews and approves any necessary changes to risk exposure limits after careful consideration of any changes in market conditions or corporate strategy and adopts guidelines, through the input of the Management Risk Committee's analysis and discussion, regarding the maximum loss exposure the Bank is able and willing to assume.


text: The Management Risk Committee is comprised of various members of Senior Management, Department Leaders, Compliance, Internal Audit and Risk Management. The Management Risk Committee is responsible for loss control and day-to-day oversight of the risk management function. Management Risk Committee meetings are held monthly. Results of the monthly review of risk categories are reported to the Board of Directors Enterprise Risk Management Committee (ERM) each quarter. In addition, the Company's risk position is reported to the Board of Directors quarterly.


text: At least annually, the Board of Directors reviews and approves the risk management program and policies based on information presented throughout the year from the ERM Committee and the Management Risk Committee.