text: We perform risk assessments relating to cybersecurity and technology risks at least annually. Our cybersecurity risk management program has been developed based on industry standards, including those published by the National Institute of Standards and Technology ("NIST"). Highlights of the program include: • Corporate policies and procedures that guide our use of information systems, confidentiality and security strategy; • Identifying critical assets and high-risk threats, and implementing technical prevention and detection controls and response and recovery practices; • A third-party risk management process to assist in making risk-informed technology product and services decisions on third parties who provide, manage, store or have access to material data or information, including the completion of security questionnaires and independent assessments of controls, audits and/or contract terms; • Defined data loss prevention standards in place to detect and prevent data loss, including requiring third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices; • Security awareness training for employees to identify cybersecurity concerns and take appropriate actions; and • Evaluating our program's effectiveness by performing regular internal and third-party assessments of our controls, including external penetration testing and consultation on security enhancements.


text: Risks identified through our cybersecurity program are assessed to determine the potential impact and likelihood of occurrence and mitigation plans are developed and implemented accordingly.

companyName: Xenon Pharmaceuticals Inc.

ticker: XENE

secItem: Item 1C


text: The Audit Committee of our Board of Directors bears the primary responsibility for oversight of cybersecurity risks. The Audit Committee is composed of board members with diverse expertise, including risk management, technology and finance, equipping them to oversee cybersecurity risks effectively. Management's oversight is performed through an IT Strategy Committee, a subset of executive management including our Chief Financial Officer, or CFO, and Chief Legal Officer, and relevant functional expertise, including our Senior Vice President, Information Systems, or SVP, IS. Our SVP, IS, is the primary member of the IT Steering Committee charged with responsibility for assessing, monitoring and managing our cybersecurity risks. With over 20 years of experience in information technology strategy and operations, his background includes extensive experience as an IT executive at various companies. At least annually, the SVP, IS, and the CFO provide a comprehensive report to the Audit Committee regarding cybersecurity risk assessments, planned enhancements to our cyber security program, and incident reports and remediation, if any.


text: The SVP, IS, oversees processes for the regular monitoring of our information systems, including potential vulnerabilities. In the event of a cybersecurity incident, the IT organization and designated members of executive management follow an established Cybersecurity Incident Response Plan. This plan includes immediate actions to contain the threat, mitigate the impact and assess materiality, and requires retrospective review and identification of corrective actions to reduce future risk.


text: During the fiscal year ended December 31, 2024, we did not experience any material impact to our business, financial position or operations resulting from previously identified cyberattacks or other information security incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material breaches. For a discussion of these risks, see "Item 1A—Risk Factors—Risk Related to Our Business and Industry—Our business and operations could suffer in the event of an actual or perceived information security incident such as a cybersecurity breach, system failure, or other compromise of our systems and/or information, including information held by a third-party contractor or vendor."


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. This program includes: • Robust Firewalls and Intrusion Detection Systems: The company has invested in state-of-the-art firewalls and intrusion detection systems designed to prevent unauthorized access to its networks. • Regular Security Assessments: The company conducts regular security assessments to identify vulnerabilities and address them promptly. This includes penetration testing, vulnerability scanning, and third-party audits. • Employee Training and Awareness: The company provides comprehensive cybersecurity training to all employees to educate them about potential risks, phishing attacks, and best practices for protecting sensitive information. • Incident Response Plan: The company has developed an incident response plan that outlines the steps to be taken in the event of a cybersecurity breach. This includes isolating affected systems, investigating the breach, and notifying relevant stakeholders. • Cyber Insurance: The company has obtained cyber insurance coverage to mitigate the financial impact of a cybersecurity breach. This insurance policy covers expenses related to incident response, legal fees, and potential customer compensation.

companyName: Arcellx, Inc.

ticker: ACLX


text: By implementing these risk management strategies, we aim to minimize the likelihood and impact of a cybersecurity breach, thereby safeguarding our assets and maintaining the trust of our stakeholders.


text: We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Director of Information Technology, who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage assessors, consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. To oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with its work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function primarily through the audit committee.


text: Our Director of Information Technology and members of our cybersecurity committee (a management committee), which includes legal and privacy representatives, are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers. Our Director of Information Technology has expertise in security frameworks and standards (such as the Cybersecurity Framework established by the National Institute of Standards and Technology at the U.S. Department of Commerce), proficiency in security tools such as security information and event management systems, intrusion detection systems and vulnerability scanners, and has experience with threat intelligence, threat modeling, risk assessment, and risk management practices, as well as analyzing logs, investigating security incidents, and performing forensic analysis.


text: Our Director of Information Technology and members of our cybersecurity committee oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Director of Information Technology and members of our cybersecurity committee are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: Security Awareness Training, Patch Management Process, Endpoint Detection and Response, Managed Detection and Response, Incident Response Plan, Data Encryption, Access Control, Network Security, and Vulnerability Management.


text: Our Director of Information Technology, our Controller, and members of our cybersecurity committee provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company relies on the cybersecurity strategy and policies implemented by Bain Capital, the parent of the Advisor and Administrator, which apply to the Company and its operations.

companyName: Bain Capital Specialty Finance, Inc.

ticker: BCSF


text: Bain Capital has adopted and implemented an Information and Cybersecurity Program ("Cybersecurity Program") that prioritizes detection and analysis of and response to cybersecurity threats, management of security risks and resilience against cyber incidents, including those that may impact the Company. The Cybersecurity Program aligns with National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and is reviewed and adjusted as needed and is approved by the Bain Capital's Chief Information Security Officer ("CISO").


text: Bain Capital's Cybersecurity Program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help prevent and respond to cybersecurity threats and incidents, including threats or incidents that may impact the Company, the Advisor or the Administrator. Bain Capital's cybersecurity risk management processes, which are part of Bain Capital's overall risk management system, seek to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessments of cybersecurity risks, including those which may impact the Company, the Advisor, or the Administrator, are reported to the Bain Capital Credit Risk Oversight Committee ("ROC") for awareness, review or action, as appropriate. In addition, the Company relies on Bain Capital to periodically engage with third-party consultants and key vendors to assist it in assessing, enhancing, implementing and monitoring its cybersecurity risk management processes and responding to incidents.


text: Internal and external networks, including the networks on which the Company relies, are assessed for vulnerabilities. Bain Capital also engages with independent third parties to conduct relevant technical assessments.


text: Bain Capital seeks to remain aware of the evolving global threat landscape through vendor relationships, partnerships with threat intelligence providers and membership of industry forums/groups, as well as research performed by members of the Information Security Team. Bain Capital is currently an active member of the Financial Services Information Sharing and Analysis Center (FS-ISAC) and the Alternative Investment ISAC.


text: Bain Capital provides information security awareness training to employees, and function-specific security training is also provided (where appropriate based on job function). Bain Capital also engages in phishing campaigns.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on Bain Capital's Vendor Risk Management Program in conjunction with a Third Party Risk Management (TPRM) steering committee to assess risks posed when engaging with external vendors and/or third parties, including identifying and overseeing risks from cybersecurity threats associated with the Company's use of such entities.


text: In the event of a cybersecurity incident impacting the Company, the Advisor has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational and risk functions of Bain Capital, which may include coordinating with the relevant employees of the Advisor and management of the Company. The incident response plan includes notification to the applicable members of cybersecurity leadership, including Bain Capital's CISO, and, as appropriate, escalation to other relevant individuals.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with Bain Capital's CISO, as well as other risk management, legal, information technology, and/or compliance personnel of Bain Capital.


text: Material Impact of Cybersecurity Risks During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or that are reasonably likely to materially affect the Company, including our business strategy, operational results, and financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors— General Risk Factors— We are highly dependent on information systems, and systems failures or cyber-attacks could significantly disrupt our business, which may, in turn, negatively affect the value of our common stocks and our ability to pay distributions."


text: The Company's Board of Directors ("Board") provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO"), which incorporates updates provided by Bain Capital's CISO regarding the overall state of the Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents potentially impacting the Company.


text: Bain Capital's CISO and Information Security Team are responsible for the Cybersecurity Program applicable to the Company and, along with the Company's CCO, are responsible for assessing and managing material risks from cybersecurity threats that impact the Company. The CCO of the Company oversees the Company's oversight function generally and relies on Bain Capital's CISO to assist with assessing and managing material risks from cybersecurity threats. The Company's CCO has been responsible for this oversight function as CCO to the Company for 10 years and has more than 14 years' experience in information security, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company. Members of Bain Capital's management also possess relevant expertise in various disciplines that are key to effectively managing such risks, such as extensive experience in managing compliance risks in the financial sector, including those related to cybersecurity. Bain Capital's CISO has deep expertise in cybersecurity, holding the CISSP certification and having completed an Executive Master's in Cyber Security from Brown University and having received a Chief Risk Officer Certificate from Carnegie Mellon. Members of Bain Capital's Information Security Team hold various industry certifications and regularly attend trainings and industry conferences.


text: We maintain processes for identifying, assessing, and managing material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K) as part of our broader enterprise risk management program under the oversight of the Audit Committee of the Company's Board of Directors. These processes include a wide variety of mechanisms, controls, technologies, systems, and methods that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting data. We also use systems and processes to oversee and identify risks from cybersecurity threats associated with our third-party service providers.

companyName: Xperi Inc.

ticker: XPER


text: Our corporate information security organization is led by our Chief Information Officer ("CIO"), who brings over 30 years of information technology experience across a wide range of industry sectors, including semiconductor and technology. Before joining Xperi, our CIO was the Chief Information Security Officer for a large technology company. Our CIO oversees our cybersecurity strategy and the development of our cybersecurity capabilities, encompassing risk management and mitigation, incident prevention, detection, and remediation. Our CIO and corporate information security organization collaborate with technical and business stakeholders across our businesses to analyze risks and devise detection, mitigation, and remediation strategies. Additionally, they engage outside legal counsel, experts, consultants, and other third parties to conduct regular audits, assist with forensic investigations, and address cybersecurity threats and incidents. When necessary, they seek input from external experts and consultants on security industry and threat trends.


text: Significant incidents are reviewed by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as being or becoming potentially material is promptly escalated for further assessment and reported to designated members of senior management. Senior management is responsible for assessing the materiality of an incident, complying with any regulatory requirements, and communicating relevant information to the Audit Committee, as appropriate. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters.


text: Although the risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition to date, there can be no assurance that they will not be materially affected by such risks or a material incident in the future, or that we have not experienced an undetected cybersecurity incident. As discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to the Company, including potentially to our results of operations and financial condition. See "Risk Factors — If we or our third-party providers experience significant disruptions of our IT Systems or data security incidents, this could result in harm to our reputation, subject us to liability, cause us to modify our business practices, and otherwise materially adversely affect our business, results of operations, and financial conditions."


text: The Company's Board of Directors has oversight of our strategic and business risk management and has delegated cybersecurity risk management oversight to the Audit Committee of the Board. The Audit Committee oversees the guidelines and policies governing the process by which management assesses and manages our exposure to risk, including material risks from cybersecurity threats. The Audit Committee receives regular updates from management, including our CIO, regarding our cybersecurity risk management program, including cybersecurity risks, threats, incidents, and mitigation strategies.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our development programs and clinical trials (Information Systems and Data).

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: Our Information Technology (IT) department and Senior Director of IT, with the assistance of our legal department, help identify, assess and manage our cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating our and our industry's risk profile, evaluating threats reported to us and coordinating with law enforcement about such threats as may be appropriate, conducting internal and external audits, conducting internal threat assessments to evaluate for both internal and external threats, having third parties conduct threat assessments, and conducting vulnerability assessments designed to identify vulnerabilities.


text: Depending on the environment, systems and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, an incident response policy; incident detection and response processes; a vulnerability management policy; a disaster recovery plan; risk assessments; encrypting certain data; network security controls; data segregation; maintaining access and physical controls; asset management, tracking and disposal; systems monitoring; employee training; penetration testing conducted by third parties; maintaining cybersecurity insurance; and having dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program; (2) the IT department and Senior Director of IT discuss cybersecurity risk with management, including our legal department to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports certain risks to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms (including legal counsel), cybersecurity consultants, cybersecurity software providers, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as hosting companies, contract research organizations (CROs), and contract manufacturing organizations (CMOs). We have processes to manage cybersecurity risks associated with our use of certain of these providers. These processes include reviewing certain vendors' written security program and security assessments, and imposing certain contractual obligations related to cybersecurity on the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management processes may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see the section of this Annual Report on Form 10-K titled "Risk Factors", including, but not limited to, the risk factor titled "If our internal information technology systems or sensitive information, or those of our third-party CROs or other contractors or consultants, are or were compromised, we could experience adverse consequences from such compromise, including but not limited to, a material disruption of our product candidates' development programs, regulatory investigations or actions, litigation, fines and penalties, reputational harm, loss of revenue or profits, and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our personnel, including our Senior Director of IT, who has 20 years of experience in IT and cybersecurity and is a member of the Information Systems Audit and Control Association (ISACA).


text: Our Senior Director of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our General Counsel is responsible for approving budgets and, along with our Senior Director of IT, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability and patch management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CEO and General Counsel. Such management members work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from our Senior Director of IT concerning significant cybersecurity threats, related risks and the processes we have implemented to address them. The audit committee also has access to various reports, summaries and presentations related to cybersecurity threats, risks and mitigation.


text: We have implemented and maintain a comprehensive information security program designed to protect the confidentiality, integrity, and availability of our critical systems and information, as well as to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our systems and processes are assessed by independent third parties for compliance with: the International Standard Organization ("ISO") 27001; System and Organization Controls ("SOC") 2, Type 2; and Payment Card Industry Data Security Standards ("PCI DSS") Level 1.

companyName: Red Violet, Inc.

ticker: RDVT


text: Our information security program includes the following key elements to help identify, manage, mitigate, and respond to cybersecurity threats: • Risk assessments—We conduct risk assessments designed to help identify material cybersecurity risks, quantify the impact and probability of each risk, develop mitigating controls, and periodically reassess previously identified risks. • Testing—We conduct regular testing of our systems and controls to help identify and address potential vulnerabilities. • Technical safeguards—We utilize various technical safeguards to help protect our information systems from cybersecurity threats. We regularly review our technical safeguards and update them in accordance with recognized best practices and standards. • Business continuity and disaster recovery planning—We maintain business continuity and disaster recovery plans and periodically test those plans. • A cybersecurity incident response plan—We maintain a policy governing actions required for reporting and managing cybersecurity incidents. We have designated an Incident Response Team with clearly defined roles and responsibilities for managing all material aspects of our reporting and response plan. • Employee training and awareness programs—We provide training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees participate in annual training, including insider threat awareness, simulated phishing exercises, and other awareness training. • Third-party risk management —We maintain a third-party risk management program that is designed to help identify, assess, manage, mitigate, and respond to risks associated with the Company's suppliers and other third parties.


text: We regularly review our information security program and associated policies, making periodic updates as we deem necessary and appropriate in accordance with recognized best practices and standards.


text: Our information security program and cyber risk management program is managed and overseen by Jeff Dell, our Chief Information Officer ("CIO") and a team of information security personnel reporting to the CIO. Our CIO reports directly to the CEO and is responsible for the assessment and management of material risks for cybersecurity threats. Mr. Dell brings over 30 years of experience in information technology and information security, working as an executive within data-driven companies for the last 20 years, including serving as CIO since our formation in August 2017 and continuing through our Spin-off from cogint. Mr. Dell holds a Bachelor of Science in Business from Arizona State University and has earned GCIA, GCWN, GWAPT and CISSP certifications. For additional information regarding Mr. Dell's business experience, see Part 1, Item 1 Business – Information About Our Executive Officers included in this Annual Report.


text: Management holds monthly Information Security Management System (ISMS) meetings which include members of the executive management team as well as the CIO and other key individuals reporting to the CIO. Cybersecurity risks, threats, and vulnerabilities, as well as existing mitigating controls, are discussed in ISMS meetings. Our CIO also provides quarterly reports of our information security program, as well as any material cybersecurity risks, to the Board of Directors.


text: We did not experience a material cybersecurity incident during the year ended December 31, 2024, which has materially affected or is reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the possibility of future cybersecurity incidents, as well as cybersecurity and technology risks more generally, could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. See "Item 1A. Risk Factors – Cybersecurity and Technology Risks" for more information.


text: Cytokinetics recognizes the critical importance of developing, implementing, and maintaining cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity, and availability of our critical data.

companyName: CYTOKINETICS INC

ticker: CYTK


text: Managing Material Risks & Integrated Overall Risk Management Our cybersecurity team, led by our Chief Information Security Officer, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example, through manual and automated tools, internal and external audits, third-party threat assessments and third-party conducted red/blue team testing and tabletop incident response exercises and by subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments for internal and external threats and conducting vulnerability assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining an incident response plan, a vulnerability management policy, disaster recovery and business continuity plans and a vendor risk management program; conducting employee training, systems monitoring and penetration testing; implementing security standards, network security controls, access controls and physical security; encrypting and segregating data; though asset management, tracking and disposal; and maintaining cybersecurity insurance.


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a culture of cybersecurity risk management. This integration is designed to make cybersecurity considerations an integral part of our decision-making processes. Our risk management team works closely with our IT department and cybersecurity team to evaluate and address cybersecurity risks connected with our business objectives and operational needs.


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Cytokinetics engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights. Our collaboration with these third parties includes periodic audits, threat assessments, and consultation on security enhancements.


text: Oversee Third Party Risk Because we are aware of the potentially material risks from cybersecurity threats associated with third-party service providers, Cytokinetics implements processes to oversee and manage these risks. Depending on the nature of the services provided and the identity of the service provider, we may conduct security assessments of the provider before engagement and may monitor their compliance with our cybersecurity policies after engagement. The monitoring includes periodic assessments by our Chief Information Security Officer and on an ongoing basis by our security specialists. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Risks from Cybersecurity Threats For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the discussion under the headings "Our internal computer systems, or those of our CROs, CMOs, supply chain partners, collaboration partners or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our drug development programs" and "Significant disruptions of information technology systems or breaches of data security could adversely affect our business".


text: Cytokinetics' Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats. Our Board has established oversight mechanisms designed to ensure effective governance in managing material risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise, including, risk management, technology, and finance. The Audit Committee reports to the Board of Directors periodically regarding cybersecurity topics presented to the Audit Committee, and all materials made available to the Audit Committee are available to rest of the Board of Directors.


text: Management's Role Managing Risk Our Chief Information Security Officer, Chief Executive Officer and Chief Financial Officer play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide cybersecurity briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including as applicable: the current cybersecurity landscape and emerging threats, the status of ongoing cybersecurity initiatives and strategies, incident reports and learnings from any cybersecurity events, and compliance with regulatory requirements and industry practices. In addition to our scheduled meetings, the Audit Committee, our Chief Information Security Officer, Chief Executive Officer and Chief Financial Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates from one another, as appropriate, on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Cytokinetics. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Management Personnel in Cybersecurity Primary responsibility for assessing, monitoring and managing our risks from cybersecurity threats rests with our Chief Information Security Officer, Mr. Eric Brown, Vice President of Information Technology. With over 10 years of experience in the field of cybersecurity and over 20 years of experience in IT more broadly, Mr. Brown brings a wealth of expertise to his role. His background includes extensive experience as an enterprise Chief Information Security Officer. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Chief Information Security Officer has overall responsibility for the Company's IT department and operations, including oversight over the cybersecurity team to ensure efforts to contain and remediate security incidents are sufficient and effective.


text: Monitor Cybersecurity Incidents The CISO is responsible for informing himself from appropriate sources about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CISO implements and oversees processes for the monitoring of our information systems. This includes the deployment of security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions designed to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors Our Chief Information Security Officer, in his capacity, regularly informs our executive management team of material cybersecurity risks and incidents. This is how executive management is kept abreast of our cybersecurity posture and potentially material cybersecurity risks facing Cytokinetics. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated by any of our executive officers to the Audit Committee, so that the Audit Committee can oversee and provide guidance on critical cybersecurity issues.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan based on National Institute of Standards and Technology (NIST) 800-61.

companyName: Commerce.com, Inc.

ticker: CMRC


text: We design and assess our program based on a combination of the International Organization for Standardization (ISO) 27001, Center for Internet Security (CIS) 18, and the National Institute of Standards and Technology Cybersecurity Framework (NIST). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes but is not limited to: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • an annual tabletop exercise conducted by a third party to simulate a cyber emergency and practice our response to such a scenario; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for relevant service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, could materially affect us, including our operations, business strategy, results of operations, or financial condition. See Risk Factors – "We store and process confidential information, including personal information of our customers and their shoppers. If we or our third-party providers fail to protect the security of this information and/or experience a data security incident, our reputation may be harmed and we may be exposed to material financial penalties and legal liability, which could materially adversely affect our business, results of operations, and financial condition."


text: Our Board of Directors and Audit Committee jointly oversee management's implementation of our security organization, which is charged with assessing and taking steps to mitigate the data privacy and cybersecurity risks that we face as a software-as-a-service platform.


text: The Board and Audit Committee receive regular reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also regularly receives briefings from management on our cyber risk management program. Board and Audit Committee members receive presentations on cybersecurity topics from our Chief Technology Officer and others within the Chief Technology Officer's team, as well as other internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Technology Officer and the Chief Technology Officer's team are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes decades of experience across several public companies, including in the IT, cybersecurity, retail, and financial industries.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, personal information, and Personal Health Information ("PHI") (collectively, "Information Systems and Data").

companyName: Personalis, Inc.

ticker: PSNL


text: The board of director's audit committee and the internal cybersecurity team help identify, assess and manage the Company's cybersecurity threats and risks, including through the use of our risk register. Our internal cybersecurity team includes our information security function, security management, engineering operations, legal, risk management and third-party service providers. Our cybersecurity team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and Personalis' risk profile using various methods including, for example: using manual and automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments, employee reporting, encryption of data, penetration testing, and regular reviews and internal and external audits.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plan, incident detection and response, disaster recovery and business continuity plans, risk assessments, network security controls, access controls, user management, asset management, hardware and data segregation, system monitoring and regular reviews.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register. Additionally, the cybersecurity team monitors activity on a continual basis and works with security management to prioritize our risk profile and mitigate cybersecurity threats that are more likely to lead to a material impact to our business on a monthly basis; executive management evaluates material risks from cybersecurity threats against our overall business objectives on a periodic basis and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk periodically.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, threat intelligence service providers, forensic investigators, and professional services firms.


text: We use third-party service providers to perform a variety of functions throughout our business, including, but not limited to infrastructure support and maintenance, supply chain resources, contracting services and software integrations. These vendors are reviewed as part of our vendor management program, including the management of cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I, Item1A. Risk Factors in this Annual Report on Form 10-K, including " If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences. "


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our executive leadership team and led by the Vice President of Informatics, who has more than 20 years of experience in information technology and oversees the Informatics department which includes the Company's hardware, software, help desk, and cybersecurity team.


text: The Vice President of Informatics reports to our Chief Financial Officer and is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. The Vice President of Informatics is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the internal cybersecurity team and others, depending on severity. The cybersecurity team works with our incident response team to help the company mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The board of directors receives periodic updates from certain members of the cybersecurity team concerning the Company's significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee and board also have access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: The Company's risk management program is designed to identify, assess, and mitigate risks across various areas and functions, including financial, operational, technological, regulatory, reputational, and legal. Cybersecurity is a critical component of the risk management program. The Company's information security program is designed to protect the security, availability, integrity, and confidentiality of its computer systems, networks, software and information assets, including customer and other sensitive data.

companyName: PROSPERITY BANCSHARES INC

ticker: PB


text: The structure of the Company's information security program is designed around the National Institute of Standards and Technology Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, the Company leverages certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. The Chief Information Security Officer (CISO), who reports directly to the Chief Risk Officer, and the Chief Information Officer (CIO), who reports directly to the Director of Corporate Strategy, along with key members of their teams, regularly collaborate with peer banks and industry groups to discuss cybersecurity trends, issues and best practices. The information security program is periodically reviewed with the goal of addressing changing threats and conditions.


text: The Company employs an in-depth, layered, defensive strategy that embraces a "secure by design" philosophy when designing new products, services, and technology. The Company leverages people, processes, and technology as part of its efforts to manage and maintain cybersecurity controls and employs a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity. The Company also actively monitors its email gateways for malicious phishing email campaigns and monitors remote connections as a portion of its workforce has the option to work remotely.


text: The Company has established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. It engages in regular assessments of its infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. The Company also maintains a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and its supply chain. The Company leverages internal and external auditors and independent external partners to periodically review its processes, systems, and controls, including with respect to its information security program, to assess their design and operating effectiveness and make recommendations to strengthen its risk management program.


text: The Company maintains an Information Security Incident Response Policy ("Incident Response Policy") and related procedures that provide a documented framework for responding to actual or potential cybersecurity incidents, including timely escalation of incidents to the Crisis Management Team and notification to the appropriate regulatory and governmental authorities. As needed, the notification may include the CEO and/or the Company's and Bank's Board of Directors. The Incident Response Policy and related procedures are coordinated through the Chief Risk Officer and key members of management, including but not limited to representatives from the information security, information technology and legal teams that are embedded into the procedures by design. The Incident Response Policy facilitates coordination across multiple parts of the organization and is evaluated at least annually.


text: To date, the Company has not experienced a cybersecurity incident that has materially impacted its business strategy, results of operations, or financial condition. Despite the Company's efforts, there can be no assurance that its cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in protecting its systems and information. The Company faces risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect its business strategy, results of operations or financial condition. See Item 1A. "Risk Factors" in this document for further discussion of the risks associated with an interruption or breach in the Company's information systems or infrastructure.


text: The Bank's Board of Directors is responsible for overseeing the risks associated with cybersecurity threats. The Strategic Technology Oversight Committee ("STOC") of the Board has primary responsibility for overseeing the technology program, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The CISO and the CIO provide quarterly reports to the STOC regarding the information security and technology programs, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The CISO also reports summaries of key issues, including significant cybersecurity and/or privacy incidents. In addition to the STOC, the management-level Operations Committee and the Enterprise Risk Management Committee ("ERM Committee") focus on and provide oversight of the information security program. The ERM Committee reviews and, as appropriate, approves the broad objectives, strategies and policies governing the Company's protection of data assets and information security framework. The ERM Committee additionally assesses the adequacy of information security practices and reports on cyber risk to the Risk Committee of the Company's Board of Directors. The Operations Committee is chaired by the Chief Operating Officer and includes the CISO, CIO and other key departmental managers from throughout the Company. This committee generally meets bi-weekly to discuss various operational strategy and issues, including information technology and information security policies, practices, controls, and mitigation and prevention efforts.


text: The CISO is accountable for managing the enterprise information security department and delivering the information security program. The responsibilities of the information security department include threat detection and prevention, cybersecurity risk assessment, a portion of defense operations, incident management, vulnerability assessment, threat intelligence, and third-party risk management. The department also provides security awareness training. The Company's information technology department works together with information security in defense operations and is responsible for business resilience, including identity management.


text: Cyber Risk Management and Strategy As a part of the overall risk management system for the Company, processes are in place to assess, identify and manage material risks from cybersecurity threats. The Investment Adviser manages the Company's day-to-day operations and has implemented a cybersecurity policy that applies to the Company and its operations. With respect to cybersecurity, the Company and the Investment Adviser rely on the systems of Goldman Sachs, its third-party service providers and the Company's service providers.

companyName: Goldman Sachs BDC, Inc.

ticker: GSBD


text: Goldman Sachs' cybersecurity risk management processes are integrated into its overall risk management processes. Goldman Sachs has established an Information Security and Cybersecurity Program (the "Cybersecurity Program"), administered by Technology Risk within its Engineering organization, and overseen by its chief information security officer. This program is designed to identify, assess, document and mitigate threats, establish and evaluate compliance with information security mandates, adopt and apply our security control framework, and prevent, detect and respond to security incidents. The Cybersecurity Program is periodically reviewed and modified to respond to changing threats and conditions. A dedicated Operational Risk team, which reports to the chief risk officer of Goldman Sachs, provides oversight and challenge of the Cybersecurity Program, independent of Technology Risk, and assesses the operating effectiveness of the program against industry standard frameworks and risk appetite-approved operational risk limits and thresholds.


text: Goldman Sachs' process for managing cybersecurity risk includes the critical components of its risk management framework, as well as the following: • Training and education, to enable Goldman Sachs employees to recognize information and cybersecurity concerns and respond accordingly; • Identity and access management, including entitlement management and production access; • Application and software security, including software change management, open source software, and backup and restoration; • Infrastructure security, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems; • Mobile security, through the use of mobile applications; • Data security, including cryptography and encryption, database security, data erasure and media disposal; • Cloud computing, including governance and security of cloud applications, and software-as-a-service data; • Onboarding protocols; • Technology operations, including change management, incident management, capacity and resilience; and • Third-party risk management, including vendor management and governance, and cybersecurity and business resiliency diligence in vendor assessments.


text: In conjunction with third-party vendors and consultants, Goldman Sachs performs risk assessments to gauge the performance of the Cybersecurity Program, to estimate its risk profile and to assess compliance with relevant regulatory requirements. Goldman Sachs performs periodic assessments of control efficacy through its internal risk and control self-assessment process, as well as a variety of external technical assessments, including external penetration tests and "red team" engagements where third parties test its defenses. The results of these risk assessments, together with control performance findings, are used to establish priorities, allocate resources, and identify and improve controls. Goldman Sachs uses third parties, such as outside forensics firms, to augment its cyber incident response capabilities. Goldman Sachs and its third-party service providers have a vendor management program that documents a risk-based framework for managing third-party vendor relationships (including those of the Company). Information security risk management is built into our vendor management process, which covers vendor selection, onboarding, performance monitoring and risk management.


text: Cyber Risk Governance The Board provides strategic oversight on cybersecurity matters generally, including oversight of material risks associated with cybersecurity threats. The Board receives periodic reports and updates from Goldman Sachs which generally include the overall state of the Cybersecurity Program, the current cybersecurity threat landscape, material risks from cybersecurity threats, cybersecurity incidents, risk management policies and/or risk assessment initiatives.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are evaluated. However, despite these efforts, we cannot eliminate all cybersecurity risks or provide assurance that we have not had occurrences of undetected cybersecurity incidents. During the reporting period, the Company did not identify any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: We use the CIS benchmarks as a guideline to strengthen our cybersecurity practices. This is intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our adoption of the CIS benchmarks is a helpful baseline for potential future alignment with internationally recognized frameworks such as NIST Cybersecurity Framework, or ISO 27001.

companyName: AIRGAIN INC

ticker: AIRG


text: Integration with Enterprise Risk Management Our cybersecurity risk management program is integrated into our enterprise risk management framework. It shares methodologies, reporting channels, and governance processes applied across other risk domains, including legal, compliance, strategic, operational, and financial risks.


text: Our program includes the following: • Risk Assessments: Conducting risk capacity evaluations, pressure tests, and gap analyses while formalizing risk tolerance. • Security Team: A team dedicated to managing cybersecurity risks, implementing security controls, and responding to incidents. • External Expertise: Engaging third-party providers to evaluate, test, and enhance aspects of our security controls. • Cybersecurity Awareness Training: Ongoing training for employees, incident response personnel, and senior leadership. • Third-Party Risk Management: Assessing and monitoring vendors, suppliers, and service providers to mitigate risks to our organization.


text: Material Cybersecurity Risk Assessment We have recently completed an IT Audit of our China Office as part of our broader cybersecurity risk management efforts. This audit identified certain gaps in our systems, processes, and controls specific to our operations in China. These gaps do not indicate the presence of any known cybersecurity threats or incidents, but they highlight areas for improvement to strengthen our overall cybersecurity posture.


text: We are actively and diligently working to address and mitigate these gaps by enhancing our security controls and aligning them with our enterprise-wide cybersecurity strategy. This proactive approach ensures that our systems remain resilient and secure in an evolving regulatory and operational environment.


text: At this time, no cybersecurity threats or incidents have been identified that have materially affected or are reasonably likely to materially affect our operations, business strategy, results, or financial condition.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee of our board of directors (Audit Committee) oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Management updates the Audit Committee and executives as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team, including the CTO and IT Manager, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our management team has several years of experience and has been trained for various roles in information technology and cybersecurity at numerous technology companies. The team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: • Briefings from internal security personnel; • Threat intelligence and information obtained from governmental, public, or private sources, including external consultants engaged by us; and • Alerts and reports produced by security tools deployed in our IT environment.


text: We have implemented procedures for assessing, identifying and managing significant risks from cybersecurity threats and have incorporated these procedures into our overall risk management systems and processes. We regularly evaluate significant risks from cybersecurity attacks, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information stored there. The program to manage cybersecurity risks has tools and activities designed to identify, examine and manage current and potential cybersecurity threats, as well as plans and strategies designed to deal with threats and incidents.

companyName: 89bio, Inc.


text: We regularly evaluate the cybersecurity risks that could affect our information systems, as well as on an ad hoc basis when there is a significant change in how we do business that may increase the exposure of our information systems to such risks. These evaluations include identifying the possible internal and external risks, how likely and harmful they are, and whether our current policies, procedures, systems, and safeguards are adequate to handle them.


text: We use these risk assessments to design, implement, and maintain appropriate safeguards that are intended to mitigate identified risks, address any shortcomings in our existing safeguards, and regularly check how well our safeguards work. Our information technology ("IT") department is primarily responsible for evaluating, overseeing, and handling our cybersecurity risks to manage the process of risk assessment and mitigation. We have established a cross-functional IT Security Steering Committee that oversees the management of our cybersecurity risks and execution of any mitigation efforts.


text: Our IT department and Company management work together to check and improve our safeguards as part of our overall risk management system. We also periodically provide training to our employees on these safeguards and keep them informed of our cybersecurity policies through regular communications across the Company.


text: We work with consultants or other third parties as part of our risk assessment processes, when appropriate. They help us create and execute our cybersecurity policies and procedures and check and test our safeguards. We ask key third-party service providers to confirm that it can apply and keep appropriate cybersecurity measures in line with all relevant laws, to apply and keep reasonable cybersecurity measures when they work with us, and to promptly report any possible breach of their cybersecurity measures that could impact our company.


text: Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. For additional information regarding these risks, please refer to Item 1A, "Risk Factors," " We depend on our information technology systems and those of our third-party collaborators, service providers, contractors or consultants. Our internal computer systems, or those of our third-party collaborators, service providers, contractors or consultants, may fail or suffer security breaches, disruptions, or incidents, which could result in a material disruption of our development programs or loss of data or compromise the privacy, security, integrity or confidentiality of sensitive information related to our business and have a material adverse effect on our reputation, business, financial condition or results of operations" in this Annual Report on Form 10-K.


text: Our board of directors oversees our overall risk management process and significant risks facing us, including cybersecurity risks. The audit committee, which is comprised solely of independent directors, has been designated by our board of directors to oversee cybersecurity risks. Our board of directors oversees and evaluates strategic risk exposure, while our executive officers manage the significant risks we encounter on a daily basis.


text: The audit committee receives periodic briefings from our Chief Financial Officer, the Chair of the IT Security Steering Committee, regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, and activities of third parties. Our audit committee provides periodic updates to the board of directors on such reports.


text: The IT Security Steering Committee, which is in charge of our cybersecurity policies and procedures, including the ones discussed in "Risk Management and Strategy" above, is led by our Chief Financial Officer, who has nine years of senior leadership experience at public biotechnology companies, including six years with 89bio. The IT Security Steering committee also includes our Director of IT, who is an experienced Information Technology professional and has over 20 years of experience managing information technology, of which more than 10 years pertain to cybersecurity related experience.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Ventyx Biosciences, Inc.

ticker: VTYX


text: We conduct risk assessments on a recurring basis to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Compliance Officer and Chief Operating Officer who both report to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with other members of senior management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage consultants and other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: As of December 31, 2024, and through the date of this filing, we are not aware of any material cybersecurity incidents that have impacted the Company. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Operating Officer and other members of senior management are primarily responsible to assess and manage our material risks from cybersecurity threats. We have engaged a third party, who authored security manuals and holds multiple industry certifications, as our Virtual Chief Information Security Officer (VCISO) to support our Head of IT in Cyber related architecture and assessment.


text: Our Chief Operating Officer and other members of senior management oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Operating Officer and other members of senior management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: rollout and expansion of cyber security tools, cyber industry awareness, trends, and simulated tabletop exercise with incident response plan.


text: Our Chief Operating Officer and other members of senior management provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our Chief Operating Officer provides annual briefings to the board of directors on cybersecurity risks and activities.


text: We recognize the critical importance of maintaining the trust and confidence of customers, suppliers, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our Board of Directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology (NIST) the International Organization for Standardization and other applicable industry standards. Our customers' requirements for their suppliers to have certain cybersecurity policies, standards and processes in place also drives and guides some of our policies and practices. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: ASPEN AEROGELS INC

ticker: ASPN


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks. The program includes regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our Audit Committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Director of Information Security, our Chief Financial Officer and our Chief Legal Officer.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the NIST, International Organization for Standardization and the Center for Internet Security, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; • provide regular, mandatory training for our employees, Board members and certain contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats and incident response preparedness, and to communicate our evolving information security policies, standards, processes and practices; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct annual cybersecurity management and incident training for current employees involved in our systems and processes that handle sensitive data; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry cybersecurity risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: As part of the above processes, we periodically engage with consultants, auditors and other third parties, including having independent third-party consultants review our cybersecurity program to help identify areas for continued focus, improvement and compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers who have access to customer, supplier and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we endeavor to require those third parties that could introduce significant cybersecurity risk to us to agree to manage their cybersecurity risks in specified ways.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Risks Related to Our Business and Strategy" which disclosures are incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. The Audit Committee of our Board of Directors is responsible for the oversight of risks from cybersecurity threats.


text: At least quarterly, our Audit Committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Our Audit Committee receives prompt and timely information regarding any known or suspected cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. In addition, our Audit Committee has established a Cybersecurity Subcommittee, comprised of four Audit Committee members and members of management, including the Director of Information Security, Chief Financial Officer, and Chief Legal Officer, which meets quarterly to review materials concerning the ongoing maturation of the Company's cybersecurity program, the effectiveness of its information security controls, and current and emerging material cybersecurity threat risks. Our Audit Committee, and its Cybersecurity Subcommittee receive materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties.


text: Members of our Audit Committee and Board of Directors are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Members of our Audit Committee and Board of Directors continue to receive updates around the cybersecurity threat landscape and ongoing best practices as a means of continuing education in the area. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning and disaster recovery, product management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Director of Information Security, Chief Financial Officer and Chief Legal Officer. Such individuals have collectively over 30 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications, including Certified Information Security Manager, Certified Information Systems Auditor, Certified Information Systems Security Professional, Global Information Assurance Certification, Certified Professional Hacker. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members and other relevant subject matter experts report to the Audit Committee of our Board of Directors, as well as the Cybersecurity Subcommittee of the Audit Committee, about material cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and products (Information Systems and Data).

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: Our information security function, our Chief Information Officer (CIO), and our Chief Compliance Officer (CCO) help identify, assess and manage the Company's cybersecurity threats and risks. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods in certain contexts, including, for example, manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threat actors, conducting scans of certain environments, evaluating certain threats reported to us, conducting threat and vulnerability assessments, using external intelligence feeds, and using third parties to conduct tabletop incident response exercises and other tests.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response policies, disaster recovery/business continuity policies, a vulnerability management policy, a vendor risk management program, risk assessments, encryption of certain data, network security controls and data segmentation for certain systems, access controls, physical security, asset management and tracking, systems monitoring, employee training, penetration testing, cybersecurity insurance, and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) the information security department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; and (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, outside legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, penetration testing firms, managed cybersecurity service providers, darkweb monitoring services, and forensic investigators.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. We have vendor management processes designed to help manage cybersecurity risks associated with our use of certain of these providers. For certain vendors, these processes include vendor risk assessments, security questionnaires, review of vendors' written security program, and imposition of contractual obligations related to information security on certain vendors.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors, including: "We and the third parties with whom we work are subject to stringent and evolving U.S. and foreign laws, regulations and rules, contractual obligations, industry standards, policies and other obligations related to data privacy and security. Our (or the third parties with whom we work) actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse business consequences."; and "If our information technology systems or data, or those of third parties with whom we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, interruptions to operations or clinical trials, reputational harm, litigation, fines and penalties, disruptions of our business operations, and a loss of customers or sales."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of Information Security, who has managed the Security Operations Center for a Fortune 500 company, and led cybersecurity efforts as the Director of IT at another organization.


text: T he Director of Information Security, along with management, including the CIO and CCO, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CIO, Senior Vice President of Finance, CCO, Senior Vice President of People and Performance, and Director of Information Security. This team works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from senior management concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them.