text: Related to Cybersecurity Risks consult with a third party for the strategic leadership and direction of our cybersecurity program. The consultant has nearly 15 years of experience as an information technology professional.


text: Our board of directors has oversight over cybersecurity risks. Our management provides periodic presentations to the board of directors on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable. The management provides updates regarding our cybersecurity program to the board of directors when material.

companyName: GLOBAL TECHNOLOGIES LTD

ticker: GTLL

secItem: Item 1C


text: While we have not experienced any material cybersecurity threats or incidents in recent years, there can be no guarantee that we will not be the subject of future threats or incidents


text: Company's Chief Executive Officer assesses risks from cybersecurity threats on an ongoing basis. As the Company grows it plans to develop a more robust and detailed strategy for cybersecurity. The Company has not encountered cybersecurity challenges that have materially impaired operations or financial condition.

companyName: Regen BioPharma Inc

ticker: RGBP


text: Company does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. Governance; Company's sole director and officer provides direct oversight over cybersecurity risk.


text: Our Cybersecurity Risk Management program is an integrated component of the Enterprise Risk Management strategy intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Northfield Bancorp, Inc.

ticker: NFBK


text: We design and assess our program based on industry standards such as the National Institute of Standards and Technology Cybersecurity Framework and the Center for Internet Security Controls. This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is aligned with the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risks. Key elements of our cybersecurity risk management program include: • implementation of policies and procedures in the areas of Information Security, Business Continuity, Disaster Recovery, Privacy, Third-Party Service Provider Risk Management, and Incident Response; • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • an independent second line function, the Information Security Department, is principally responsible for managing our cybersecurity risk assessment processes, testing and monitoring of our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including but not limited to penetration testing; • training and awareness programs for Information Security Department members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • throughout the year, all employees are trained on cybersecurity awareness, confidential information protection and simulated phishing attacks, and all directors engage in interactive training modules; • membership with the Financial Services Information Sharing and Analysis Center (FS-ISAC) and annual participation in the Cyber Attacks against Payment Systems (CAPS) exercises; • cybersecurity metrics and other risk management matters are reported to both management level committees and the CIT Committee; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors that analyses, monitors, reports, and mitigates cyber risks associated with third-party vendors, suppliers, and service providers.


text: In the last three fiscal years, the Company has not experienced any cybersecurity incident that has materially affected or is reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial conditions, and any expenses incurred from cybersecurity incidents have been immaterial. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "Risks Related to Operational Matters".


text: The Board of Directors established its CIT Committee with specific responsibilities for overseeing cybersecurity threats, among other things. Our Chief Information Security Officer provides the CIT Committee with periodic reports on our cybersecurity risks and any material cybersecurity incidents. The CIT Committee retains an independent external cybersecurity consultant who regularly attends all CIT Committee meetings and reports directly to the CIT Committee Chair. In addition, the Chief Information Security Officer provides periodic training and reports to our Board of Directors.


text: Northfield Bank maintains an Information and Cybersecurity Program under the leadership of our Chief Risk Officer, the Chief Information Officer, and the Chief Information Security Officer, with timely Board oversight for identifying and mitigating information security risks. The Information Security Department is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats and overseeing cybersecurity vendors. The Information Security Department is led by our Chief Information Security Officer ("CISO"). Our immediate past CISO had over 15 years of experience in the cybersecurity space and has obtained professional security certifications and advanced training in the field of cybersecurity and technology. Northfield Bank is currently onboarding a new CISO, who comes to us from a money center bank and has a similar background. Our Chief Information Security Officer and our Chief Information Officer, along with key members of their departments, regularly collaborate with peer institutions, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions. Our internal audit team, led by our Chief Internal Auditor, provides independent assurance and evaluation of processes, controls and cybersecurity risk management practices to ensure they are adequate and functioning as intended.


text: The Information Security Department also monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: Our cybersecurity risk management program is an integrated component of the Enterprise Risk Management strategy designed to protect the confidentiality, integrity and availability of our critical systems and information.


text: We design and evaluate our program based on industry recognized standards such as the National Institute of Standards and Technology Cybersecurity Framework and the Center for Internet Security Controls. This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is closely aligned with the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including third-party relationships, legal, compliance, strategic, operational, and financial. Key elements of our enterprise cybersecurity risk management program include: • implementation of policies and procedures in the areas of Information Security, Business Continuity, Disaster Recovery, Privacy, Third-Party Relationship Risk Management, Risk Management, and Incident Response; • risk assessments designed to help identify material cybersecurity risks to our critical systems, data, products, services, and our broader enterprise information technology environment; • an independent second line function, the Information Security Department, which is principally responsible for managing our cybersecurity risk assessment processes, executing our incident response plan, and monitoring of our security controls; • the use of external service providers, where appropriate, to assess, test and enhance our security controls, including penetration testing, training, and table top exercises; • a comprehensive employee training and awareness program which includes periodic security assessments to test knowledge and reinforce adoption of security processes and controls that include simulated phishing attacks; • membership with the Financial Services Information Sharing and Analysis Center (FS-ISAC) and annual participation in the Cyber Attacks against Payment Systems (CAPS) exercises; • regular reporting of cybersecurity metrics and other risk/threat information matters to both the Management Risk and CIT Committees; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party relationships risk management process for service providers, suppliers and vendors which analyses, monitors, reports, and mitigates cyber risks associated with third-party relationships.


text: Risks from cybersecurity threats, including any previous cybersecurity events, have not materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial conditions, and any expenses incurred from cybersecurity incidents have been immaterial. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "Risks Related to Operational Matters".


text: The Board of Directors has established its CIT Committee with specific responsibilities for overseeing the cybersecurity risk management program, among other things. Our Chief Information Security Officer ("CISO") provides the CIT Committee with periodic reports on cybersecurity risks, threats and any material cybersecurity incidents. The CIT Committee also retains an independent external cybersecurity consultant who attends all CIT Committee meetings and reports directly to the CIT Committee Chair. In addition, the external cyber security consultant provides periodic training to the CIT Committee and to our Board of Directors.


text: Northfield Bank maintains a comprehensive Information and Cybersecurity Program led by our Chief Risk Officer, the Chief Information Officer, and the CISO. The program is designed to identify and mitigate information security risks, with timely Board oversight. The Chief Risk Officer briefs the Board of Directors on information security matters during every meeting, ensuring that cybersecurity risks and strategies align with Northfield Bank's risk profile.


text: The Information Security Department is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats and overseeing cybersecurity third-party relationships. The Information Security Department is led by our CISO, who has over 15 years of experience in the cybersecurity space and has obtained professional security certifications and advanced training in the field of cybersecurity and technology. Our CISO and our Chief Information Officer, along with key members of their departments, regularly collaborate with peer institutions, industry groups, policymakers and third-party relationships to discuss cybersecurity trends and issues and identify best practices. The cybersecurity risk management program is periodically reviewed to address changing threats and conditions. Our internal audit team, led by our Chief Internal Auditor, provides independent assurance and evaluation of processes, controls and cybersecurity risk management practices to ensure they are adequate and functioning as intended.


text: The Information Security Department also monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, including briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: We recognize the importance of developing, implementing and maintaining cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity and availability of our data.

companyName: MACOM Technology Solutions Holdings, Inc.

ticker: MTSI


text: Managing Material Risks & Integrated Risk Management In the ordinary course of our business, we and our third-party service providers collect, maintain and transmit sensitive data on our networks and systems, including Company and third-party intellectual property and proprietary or confidential business information (such as research data and personal information). The secure maintenance of this information is critical to our business and reputation. In addition, we are heavily dependent on the functioning of our information technology infrastructure to carry out our business processes. While we have adopted administrative, technical and physical safeguards to protect such systems and data, our systems and those of third-party service providers and customers may be vulnerable to a cyber-attack.


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations, at least annually or whenever there are material changes to our systems or operations.


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our risk management team collaborates with our Head of Information Security to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have processes to detect potential vulnerabilities and anomalies through technical safeguards and have adopted policies and procedures around internal and external notification of cybersecurity incidents.


text: Engaging Third Parties on Risk Management As part of our risk management process, we engage with a range of outside providers, including cybersecurity assessors, consultants, legal advisors and auditors, to conduct periodic internal and external assessments, including, but not limited to, penetration testing. Our collaboration with these third parties also includes regular audits, threat assessments and consultation on security enhancements.


text: Overseeing Third-party Risk We rely on the third parties for various business functions. In certain circumstances, our third-party services providers have access to some of our information systems and data, depending on the nature of their engagements with us, and we rely on such third parties for the continuous operation of our business operations. Because we are aware of the risks associated with third-party service providers, we conduct vendor diligence and security assessments of third-party providers before engagement and maintain ongoing monitoring to oversee compliance with our cybersecurity standards.


text: Monitoring Cybersecurity Incidents The Head of Information Security implements and oversees processes for the monitoring of our information systems. This includes, but is not limited to, the deployment of security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we have implemented an incident response plan, which includes actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Risks from Cybersecurity Threats As of the date of this report, we are not aware of a cybersecurity incident that resulted in a material effect on our business strategy, results of operations or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm or damage to our brand, lost sales, reduced demand, loss of intellectual property rights, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "Our business and operations could suffer in the event of a security breach, cybersecurity incident or disruption of our information technology systems" under Item 1A. Risk Factors. Governance.


text: Our Board of Directors has established oversight mechanisms to manage risks from cybersecurity threats. Our Audit Committee has primary responsibility for oversight of cybersecurity. At least once per year and following any material cybersecurity incidents, the Audit Committee reviews our assessment and management of information security, cybersecurity and technology risks, including the information security and risk management programs and strategies and mitigation strategies. The Audit Committee also reviews the response to data security incidents and breaches as well as the management of third-party cybersecurity risk.


text: Management's Role Managing Risk At the management level, our cybersecurity program is managed by our Head of Information Security, who reports to our Vice President of Information Technology. Our Head of Information Security has over twenty-five years of information technology experience, with five years of experience in the information security space. Our Head of Information Security holds a Bachelor of Science in Computer Science and a Master of Business Administration.


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include regular risk assessments and control testing conducted at least annually or whenever there are material changes to our systems or operations.


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our risk management team collaborates with our Chief Information Security Officer ("CISO") to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have processes designed to detect potential vulnerabilities and anomalies through technical safeguards and have adopted policies and procedures around internal and external notification of cybersecurity incidents.


text: As part of our risk management process, we engage with a range of outside providers, including cybersecurity assessors, consultants, legal advisors and auditors, to conduct periodic internal and external assessments, including, but not limited to, penetration testing. Our collaboration with these third parties also includes regular audits, threat assessments and consultation on security enhancements.


text: Overseeing Third-party Risk We rely on third parties for various business functions. In certain circumstances, our third-party services providers have access to some of our information systems and data, depending on the nature of their engagements with us, and we rely on such third parties for the continuous operation of our business operations. Because of the risks associated with third-party service providers, we conduct vendor diligence and security assessments of certain third-party providers before engagement and maintain ongoing monitoring to oversee compliance with our cybersecurity standards.


text: Monitoring Cybersecurity Incidents The CISO implements and oversees processes for the monitoring of our information systems supported by a security operations center (SOC) and automated monitoring tools. We conduct continuous vulnerability scanning, incident simulations and proactive threat hunting. In the event of a cybersecurity incident, we have implemented an incident response plan, which includes actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Risks from Cybersecurity Threats The semiconductor industry faces heightened cybersecurity risks, and we have experienced and expect to continue to experience cyber-attacks. To-date, we have been successful in defending and protecting against such attacks. However, there is no assurance that we will continue to be able to be successful in protecting and defending against such attacks in the future. As of the date of this report, we are not aware of a cybersecurity incident that resulted in a material effect on our business strategy, results of operations or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm or damage to our brand, lost sales, reduced demand, loss of intellectual property rights, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "Our business and operations could suffer in the event of a security breach, cybersecurity incident or disruption of our information technology systems" under Item 1A. Risk Factors. Governance.


text: Our Board of Directors has established oversight mechanisms to manage risks from cybersecurity threats. Our Audit Committee has primary responsibility for oversight of cybersecurity. At least quarterly and following any material cybersecurity incidents, the Audit Committee reviews management's assessments and management of information security, cybersecurity and technology risks, including the information security and risk management programs and strategies and mitigation strategies. The Audit Committee also reviews the response to data security incidents and breaches as well as the management of third-party cybersecurity risk.


text: At the management level, our cybersecurity program is managed by our CISO, who reports to our Senior Vice President and Chief Financial Officer. Our CISO has over twenty-five years of information security experience.


text: We are increasingly dependent on sophisticated software applications and computing infrastructure to conduct key operations. We depend on both our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: OptiNose, Inc.


text: Given the importance of cybersecurity to our business, we maintain a robust cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of safeguards, such as: complex password protection; multi-factor authentication with geo-location and multi-step confirmation; continuous monitoring and alerting systems for internal and external threats; regular evaluations of our cybersecurity program, including periodic internal and external audits, penetration tests, and incident response planning; and industry benchmarking. We also require cybersecurity training when onboarding new employees and contractors assigned access to Optinose networks, as well as annual, required cybersecurity awareness training for our employees and contractors assigned access to Optinose networks. Our program leverages industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) to strengthen our program effectiveness and reduce cybersecurity risks.


text: We use a risk-based approach with respect to our use and oversight of third-party IT service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party IT service provider and performing additional risk screenings and procedures, as appropriate. We use a number of means to assess cyber risks related to our third-party IT service providers, including conducting due diligence in connection with onboarding new IT service providers and, where appropriate, annual due diligence of such third-party IT service providers. We also collect and assess cybersecurity audit reports and other supporting documentation when available and include appropriate security terms in our IT contracts where applicable as part of our oversight of third-party IT service providers. Because most of our critical IT systems are cloud-based and hosted by third-party IT service provides, we are dependent on the security controls of such vendors.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain a regularly reviewed incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, determining any public disclosure obligations with respect to the incident, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain an Incident Response standard operating procedure ("IRP SOP") and business continuity and disaster recovery plans in the event of a significant cybersecurity incident.


text: We have relationships with a number of third-party service providers to assist with cybersecurity containment and remediation efforts, including forensic investigation firms, insurance providers and various law firms.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Vice President, Information Technology. Our Vice President, Information Technology leverages his over 30 years of experience as CIO/CTO/CISO in companies such as Therakos, Healthtronics IT Solutions, Endo Pharmaceuticals, Johnson and Johnson, and Animas. Our Vice President, Information Technology is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. The Vice President, Information Technology is a member of our senior management team and provides regular briefings for our senior management team on cybersecurity matters, including threats, events, and program enhancements.


text: Our Board of Directors has overall responsibility for risk oversight including oversight of cybersecurity risk matters. The Board is responsible for reviewing, discussing with management, and overseeing the Company's data privacy, information technology and security and cybersecurity risk exposures, including: (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation; (ii) the programs and steps implemented by management to monitor and mitigate any exposures; (iii) the Company's information governance and cybersecurity policies and programs; and (iv) major legislative and regulatory developments that could materially impact the Company's data privacy and cybersecurity risk exposure. On no less than an annual basis, the Vice President, Information Technology reports to the Board on information technology and cybersecurity matters, including a detailed threat assessment relating to information technology risks, the potential impact of those exposures on the Company's business, financial results, operations and reputation, the programs and steps implemented by management to monitor and mitigate exposures, the Company's information governance and cybersecurity policies and programs, and significant legal/regulatory developments that could materially impact the Company's cybersecurity risk exposure.


text: The Audit Committee of our Board is responsible for assisting the Board in performing its oversight of our cybersecurity program, its effectiveness and any breaches or other cybersecurity events. Further our Vice President, Information Technology is responsible for apprising the Audit Committee of the Board of cybersecurity incidents consistent with our IRP SOP, promptly for higher priority incidents and in the aggregate for lower priority incidents. Additionally, we maintain a standing agenda item at our quarterly Audit Committee meetings to report any cybersecurity incidents or risk matters.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management ("ERM") processes. As part of our ERM processes, department leaders identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. Department leaders are asked to consider the severity and likelihood of certain risk factors, drawing upon their company knowledge and past business experience. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors."


text: We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our own systems, networks, and technology or the systems, networks and technology of our contractors, consultants, vendors and other business partners.


text: Given the importance of cybersecurity to our business, we maintain a robust cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of safeguards, such as: complex password protection; multi-factor authentication with geo-location and multi-step confirmation; continuous monitoring and alerting systems for internal and external threats; regular evaluations of our cybersecurity program, including periodic internal and external audits, penetration tests, and incident response planning; and industry benchmarking. We also require cybersecurity training when onboarding new employees and contractors assigned access to Optinose networks, as well as bi-annual, required cybersecurity awareness training for our employees and contractors assigned access to Optinose networks. Our program leverages industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) to strengthen our program effectiveness and reduce cybersecurity risks.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Vice President, Information Technology. Our Vice President, Information Technology leverages her over 25 years of IT Leadership experience in pharmaceutical companies such as Endo Pharmaceuticals and multiple Johnson and Johnson companies. Our Vice President, Information Technology is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. The Vice President, Information Technology provides regular briefings for our senior management team on cybersecurity matters, including threats, events, and program enhancements.


text: As part of our enterprise risk assessment function, which is led jointly by IZEA's President & COO; our Director, Systems & Security; and our Senior Development Operations (DevOps) leader, we have implemented processes to assess, identify and manage the material risks facing the company, including from cyber threats. Our enterprise risk assessment function is part of our overall risk management processes. Our cybersecurity program is built upon internationally recognized frameworks, such as SOC-2 compliance for systems and organization controls related to our software development, and maps to standards published by Center for Internet Security (CIS) for our day to day operational stance. We believe that our processes provide us with a comprehensive assessment of potential cyber threats. We conduct regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage the material risks from cyber threats include the risks arising from threats associated with third party service providers, including cloud-based platforms.

companyName: IZEA Worldwide, Inc.

ticker: IZEA


text: We have developed a robust cyber crisis response plan which provides a documented framework for handling high severity security incidents and facilitates coordination across multiple parts of the company. Our incident response team constantly monitors threat intelligence feeds, handles vulnerability management and responds to incidents. In addition, we routinely perform training, simulations, and drills across company personnel.


text: Internally, we have a security awareness program which includes training that reinforces our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The security awareness program offers training on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all employees on an annual basis, and it is supplemented by testing initiatives, including periodic phishing tests. We also provide specialized security training for certain employee roles, such as application developers. Finally, our privacy program requires all employees to take periodic awareness training on data privacy. This training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.


text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For instance, we have routinely engaged an independent cybersecurity advisor to lead a cybersecurity crisis simulation exercise that has been used by our senior leaders to prepare for a possible cyber crisis. In addition, we have engaged: 7 Layer Solutions, a security auditor and advisor in systems administration and penetration testing; A-LIGN, a systems auditor and advisor for cybersecurity and compliance; Grant Thornton, an IT Systems auditor and assurance vendor; and KnowBe4, an email security and cybersecurity training partner. We also purchase insurance to protect us against the risk of cybersecurity breaches. Our General Counsel and CFO are responsible for our insurance programs and review our cyber insurance policies on an annual basis and assess whether we have appropriate coverage.


text: To date, risks from cybersecurity threats have not previously materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition. However, as discussed more fully under "Item 1A – Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, including security threats that may result from third parties improperly employing AI technologies, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Role of Management IZEA's President & COO, our Director, Systems & Security, and our Senior Development Operations (DevOps) leader, are jointly responsible for the day-to-day management of our cybersecurity risks. We have established a Security Council, which includes our President & COO; Director, Systems & Security; Senior Manager, Systems & Security; Chief Financial Officer; General Counsel and other senior officers, that meets on at least a quarterly basis to review cybersecurity and information security matters. The Security Council has primary management oversight responsibility for assessing and managing information security, fraud, vendor, data protection and privacy, and cybersecurity risks.


text: We have a security incident response framework in place. We use this incident response framework as part of the process we employ to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The framework is a set of coordinated procedures and tasks that our incident response team, under the direction of our President & COO, executes with the goal of ensuring timely and accurate resolution of cybersecurity incidents. Our cybersecurity framework includes regular compliance assessments with our policies and standards and applicable state and federal statutes and regulations. In addition, we validate compliance with our internal data security controls through the use of security monitoring utilities and internal and external audits.


text: Our President & COO and our Director, Systems & Security each have extensive experience in the information technology area. In particular, our Director, Systems & Security has over twenty years of professional experience in the information security area, including as a result of his service as a director of security, a security architect, and a software security engineer at companies such as Squarespace, Verizon Media (Oath), Tumblr, Bridgewater Associates and EMC.


text: Role of the Board of Directors The Audit Committee of the Board of Directors is responsible for the primary oversight of our information security programs, including relating to cybersecurity. The Audit Committee receives regular reports from our President & COO on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our security program, and our views of the emerging threat landscape. Our President & COO is responsible for reporting to the Committee on our company-wide enterprise risk assessment, and that assessment also includes an evaluation of cyber risks and threats. The Chair of the Audit Committee has the opportunity to report to the Board on cybersecurity risks and other matters reviewed by the Committee. Furthermore, all Board members are provided with updates on key points discussed during each Audit Committee meeting and may access the materials for each Audit Committee meeting.


text: As a matter of process, the Audit Committee annually reviews, and recommends to the Board its approval of, our information security policy and information security program. Furthermore, on an annual basis, the Board reviews and discusses our technology strategy with our President & COO and approves our technology strategic plan.


text: We have developed a cybersecurity program based on internationally recognized frameworks, such as SOC-2 compliance for systems and organization controls related to our software development, and maps to standards published by Center for Internet Security (CIS) for our day-to-day operational stance. We conduct regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage the material risks from cyber threats include assessing the risks arising from threats associated with third party service providers, including cloud-based platforms.


text: We have developed a cyber crisis response plan for handling high severity security incidents and coordinating across multiple parts of the company. Our incident response team monitors threat intelligence feeds, handles vulnerability management and responds to incidents. In addition, we routinely perform training, simulations, and drills across company personnel.


text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For instance, we have engaged an independent cybersecurity advisor to lead a cybersecurity crisis simulation exercise that has been used by our senior leaders to prepare for a possible cyber crisis. In addition, we have engaged a security auditor and advisor in systems administration and penetration testing, a systems auditor and advisor for cybersecurity and compliance, an IT Systems auditor and assurance vendor and an email security and cybersecurity training partner. We also purchase insurance to protect us against the risk of cybersecurity breaches.


text: To date, risks from cybersecurity threats have not previously materially affected us, and we currently are not aware of risks from cybersecurity threats that are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition. However, as discussed more fully under "Item 1A – Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Role of Management IZEA's CEO, our Director, Systems & Security, and our Senior Development Operations (DevOps) leader jointly manage of our cybersecurity risks. We have established a Security Council, which includes our CEO, Director, Systems & Security, Senior Manager, Systems & Security, Chief Financial Officer, General Counsel, and other senior officers, that meets quarterly to review cybersecurity and information security matters. The Security Council has primary management oversight responsibility for assessing and managing information security, fraud, vendor, data protection and privacy, and cybersecurity risks.


text: We have a security incident response framework in place. We use this incident response framework as part of our process to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The framework is a set of coordinated procedures and tasks that our incident response team, under our CEO's direction, executes to ensure timely and accurate resolution of cybersecurity incidents. Our cybersecurity framework includes regular compliance assessments with our policies, standards, and applicable state and federal statutes and regulations. In addition, we validate compliance with our internal data security controls through security monitoring utilities and internal and external audits.


text: Our CEO and Director, Systems & Security, have extensive experience in the information technology area. In particular, our Director, Systems & Security has over twenty years of professional experience in the information security area, including as a result of his roles as a director of security, a security architect, and a software security engineer at various companies.


text: Role of the Board of Directors The Board of Directors Audit Committee is responsible for the primary oversight of our information security and cybersecurity programs. The Audit Committee receives periodic reports from our CEO on cyber risks and threats, the status of initiatives to enhance our information security systems, assessments of our security posture, and insights into emerging threats. Additionally, the CEO reports to the Audit Committee on our Company-wide enterprise risk assessment, including evaluating cyber risks and threats. The Chair of the Audit Committee subsequently informs the full Board of these cybersecurity matters and key discussion topics and meeting materials and recommends updates to our information security policies and programs for Board approval.


text: We have implemented ongoing processes that are designed to continually identify, assess, manage, and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our cybersecurity threat risks are identified, assessed, managed, and monitored by our Adviser's and Administrator's resource management and compliance departments, which work in conjunction with an independent third-party information technology service provider ("ISP") engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assists in maintaining our cyber and information security programs. The ISP proposes recommendations to our Adviser's resource management and compliance departments, which are then considered by other officers and employees of our Adviser and Administrator working on our behalf before improvements are implemented to our information technology strategy, cybersecurity, and incident response policies, processes, and procedures.

companyName: GLADSTONE LAND Corp

ticker: LAND


text: In addition, regular ongoing cybersecurity threat risk assessments are performed throughout the year and reported to our officers and Board of Directors by our Chief Compliance Officer ("CCO") no less than quarterly. Cybersecurity risks are assessed in general as a part of the overall enterprise risk management for us, but also specifically between the ISP and our Adviser and Administrator in monitoring and determining not only the risks but also assessing corresponding processes and procedures to mitigate those risks appropriately. Third-party business applications are also incorporated into these risk assessments.


text: As an international service provider, our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected, we, through our Adviser and Administrator, consult with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we then, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: implementation of industry-leading Cloud solutions and business applications which possess integrated cybersecurity safeguards, anti-malware, antivirus, and threat detection software, mobile device management of business applications, regular vulnerability scans and penetration testing.


text: Contractually, we require the ISP to provide us with annually a third-party report on its systems and on the suitability of the design and operating effectiveness of its controls relevant to information and cyber security. In addition to the ongoing dialogue and technology interaction between our Adviser and Administrator and our ISP, any significant findings in these reports are shared with us, including our Board of Directors and other officers, to enhance ongoing monitoring and assessment of our information technology and cybersecurity risk management.


text: While our ISP works to create a hardened information technology systems environment, our Adviser and Administrator also regularly trains employees working on our behalf on the evolving threats and educates them on cybersecurity risks. Whether it is communicating information about the latest cybersecurity threats, assessing employees' awareness through mock fraud exercises, social engineering and phishing campaigns, or providing access to a library of educational material about past and newly-evolving cybersecurity attacks, our Adviser and Administrator work in concert with the ISP on our behalf to keep employees servicing us informed so as to provide an additional protection barrier through end-user knowledge.


text: Notwithstanding our risk management and strategy described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Part I, Item 1A, "Risk Factors—Risks Relating to Our Business and Operations—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations or the operations of businesses in which we invest, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our business, financial condition, and operating results."


text: Our Board of Directors is actively engaged in overseeing our cybersecurity and information security program. Our Board of Directors receives regular reports during board meetings from our CCO on our and our Adviser's and Administrator's efforts concerning information security and addressing information technology and cybersecurity risks no less than quarterly. The reports are distributed to our Board of Directors, and our CCO engages in detailed discussions with the independent board members during the independent members' session. The reports cover all potentially material cybersecurity threats facing us, as well as key risks and mitigation efforts undertaken by us and our Adviser and Administrator. As significant threats or events are identified by management or the ISP between regular reporting periods, our CCO will inform our Board of Directors immediately and keep it informed as to the developments of assessing the risks, mitigating efforts, and potential disclosure. Appropriate members of management and third-party providers will be involved as deemed necessary based on the potential impact.


text: Management personnel most involved with assessing and managing the cybersecurity risks and program with our ISP include our Head of Resources Management, who is also a member of our Board of Directors, and our CCO. Our Head of Resources Management has more than 30 years of overall experience and more than 20 years directly assessing and managing our cyber information technology and human resources systems and the associated security concerns. Our CCO has more than 30 years of overall experience as a CPA, with more than 15 years managing information technology systems and databases, and 15-plus years supporting our Adviser's and Administrator's resource management department. This includes identifying, assessing, mitigating, and monitoring cyber information security risks. These managers, as well as other management personnel, attend various professional continuing education programs that include cybersecurity matters. Certain members of our Board of Directors have, or previously held, positions with other companies, including other public companies, that involved managing risks associated with their cyber and information technology systems. Our Board of Directors regularly receives updates from third parties on various business risks, which include cybersecurity matters.


text: We have implemented ongoing processes that are designed to continually identify, assess, manage, monitor, and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our Adviser's and Administrator's resource management, information technology ("IT"), and compliance departments work in conjunction with an independent third-party information technology service provider ("ISP") engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assists us in maintaining our cyber and information security programs. The ISP proposes recommendations for improvements to our Adviser's Head of Resource Management, Director of IT, and Chief Compliance Officer ("CCO"), which are then considered by other officers and employees of our Adviser and Administrator working on our behalf before improvements are implemented to our information technology strategy, cybersecurity, and incident response policies, processes, and procedures.


text: In addition, regular ongoing cybersecurity threat risk assessments, which also cover third-party business applications, are performed throughout the year and reported to our officers and Board of Directors by our CCO no less than quarterly. Cybersecurity risks are assessed in general as a part of the overall enterprise risk management for us, but also specifically between the ISP and our Adviser and Administrator in monitoring and determining not only the risks but also assessing corresponding processes and procedures to mitigate those risks appropriately. Third-party business applications are also incorporated into these risk assessments.


text: As an international service provider, our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected, the Director of IT, Head of Resource Management, and CCO consult with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we then, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: implementation of industry-leading Cloud solutions and business applications which possess integrated cybersecurity safeguards; anti-malware, antivirus, and threat detection software; ransomware containment and isolation software; enhanced password requirements and multifactor authentication requirements; endpoint encryption; intrusion detection and response system conduct file integrity monitoring; email archiving, firewalls, and quarantine capabilities; mobile device management of business applications; frequent systems backups with recovery capabilities; and regular vulnerability scans and penetration testing.


text: Contractually, we require the ISP to annually provide us with a third-party report on its systems and on the suitability of the design and operating effectiveness of its controls relevant to information and cyber security. In addition to the ongoing dialogue and technology interaction between the Director of IT, our Adviser and Administrator, and the ISP, any significant findings in these reports are shared with us, including our Board of Directors and other officers, to enhance ongoing monitoring and assessment of our information technology and cybersecurity risk management.


text: While our ISP works to create a hardened information technology systems environment, our Adviser and Administrator also regularly trains employees working on our behalf on the evolving threats and educates them on cybersecurity risks to provide an additional protection barrier through end-user knowledge. Whether it is communicating information about the latest cybersecurity threats, assessing employees' awareness through mock fraud exercises, social engineering and phishing campaigns, or providing access to a library of educational material about past and newly-evolving cybersecurity attacks, our Adviser and Administrator work in concert with the ISP on our behalf to keep employees servicing us informed so as to provide an additional protection barrier through end-user knowledge.


text: Notwithstanding our risk management and strategy described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. We are not currently aware of any known cybersecurity risks that may materially impact our operations, though we may not be able to determine the likelihood of such risks. See Part I, Item 1A, "Risk Factors—Risks Relating to Our Business and Operations—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations or the operations of businesses in which we invest, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our business, financial condition, and operating results," for a discussion of risks related to cybersecurity and cyber incidents.


text: Our Board of Directors is actively engaged in overseeing our cybersecurity and information security program. Our Board of Directors receives regular reports during board meetings from our CCO on our and our Adviser's and Administrator's efforts concerning information security and addressing information technology and cybersecurity risks no less than quarterly and regularly receives updates from third parties on various business risks, which include cybersecurity matters. The reports are distributed to our Board of Directors, and our CCO engages in detailed discussions with the independent board members during the independent members' session. The reports cover all potentially material cybersecurity threats facing us, as well as key risks and mitigation efforts undertaken by us and our Adviser and Administrator. As significant threats or events are identified by management or the ISP between regular reporting periods, our CCO will inform our Board of Directors immediately and keep it informed as to the developments of assessing the risks, mitigating efforts, and potential disclosure. Appropriate members of management and third-party providers will be involved as deemed necessary based on the potential impact.


text: Management personnel most involved with assessing and managing the cybersecurity risks and program with our ISP include our Head of Resources Management, who is also a member of our Board of Directors, and our CCO. Our Head of Resources Management has more than 30 years of overall experience and more than 20 years directly assessing and managing our cyber information technology and human resources systems and the associated security concerns. Our CCO has more than 30 years of overall experience as a CPA, with more than 15 years managing information technology systems and databases, and 15-plus years supporting our Adviser's and Administrator's resource management department. This includes identifying, assessing, mitigating, and monitoring cyber information security risks. Our Director of IT has over 20 years of experience in IT, with a focus in the implementation of information security projects to enhance organizations' resilience against emerging threats, and has collaborated closely with security vendors and partners to contain and address cybersecurity incidents. These managers, as well as other management personnel, attend various professional continuing education programs that include cybersecurity matters. Certain members of our Board of Directors have, or previously held, positions with other companies, including other public companies, that involved managing risks associated with their cyber and information technology systems. Our Board of Directors regularly receives updates from third parties on various business risks, which include cybersecurity matters.


text: We have an enterprise risk assessment process which specifically addresses risks associated with cybersecurity. Additionally, we have a cyber security incident response plan that outlines the structure, roles, responsibilities and operating procedures to utilize during potentially significant events that could negatively impact the Company. Our cybersecurity incident response plan provides a documented framework for handling high severity security incidents and includes facilitated coordination across multiple functions of the Company. Our incident response plan also includes identifying and responding to material risks from cybersecurity threats associated with our use of third-party service providers. We invest in threat intelligence and are active participants in industry and government forums to strive to improve our overall capabilities with respect to cybersecurity. We routinely perform reviews of threat intelligence and vulnerability management capabilities, while performing simulations and drills at both technical and management levels. Our formal cybersecurity program is modeled after industry best practice global standards and best practices. We incorporate external expertise in all aspects of our program utilizing best practice guidance from third-party cybersecurity advisors to provide objective assessments of our capabilities. We maintain a cyber liability insurance program, although the coverage may not be sufficient in some circumstances. We also have policies and practices in place to address data privacy regulations. Our cybersecurity program is reviewed and assessed by external information security specialists or by our internal audit group at least annually. Further, we conduct annual cybersecurity awareness training for employees and targeted training for high-risk functions of the Company. We also conduct phishing exercises and correlated education with our employees.

companyName: Vera Bradley, Inc.

ticker: VRA


text: Related to Cybersecurity Risks Our Vice President of Enterprise Technology Solutions is responsible for the strategic leadership and direction of the Company's information technology organization and possesses 25 years of tenure and experience with the Company in matters of privacy assurance, cyber, digital, and data security. As part of its risk oversight role, our Audit Committee of the Board of Directors oversees cyber risk, information security and technology risk, including management's actions to identify, assess, mitigate and remediate material cybersecurity issues and risks. The Audit Committee receives regular reporting from our Vice President of Enterprise Technology Solutions on our technology and cyber risk profile, enterprise cybersecurity program and key enterprise cybersecurity activities. We experienced no material cybersecurity incidents in fiscal 2024.


text: Related to Cybersecurity Risks Our Vice President of Enterprise Technology Solutions is responsible for the strategic leadership and direction of the Company's information technology organization and possesses over 25 years of tenure and experience with the Company in matters of privacy assurance, cyber, digital, and data security. As part of its risk oversight role, our Audit Committee of the Board of Directors oversees cyber risk, information security and technology risk, including management's actions to identify, assess, mitigate and remediate material cybersecurity issues and risks. The Audit Committee receives regular reporting from our Vice President of Enterprise Technology Solutions on our technology and cyber risk profile, enterprise cybersecurity program and key enterprise cybersecurity activities. We experienced no material cybersecurity incidents in fiscal 2025.


text: We rely on the cybersecurity policies and procedures implemented by New Mountain Capital. New Mountain Capital has processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of controls, processes, systems, and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our data. Pursuant to New Mountain Capital's Information Security Program, the New Mountain Capital Information Technology Steering Committee ("ITSC") is responsible for the development, evolution, and implementation of policies and technical measures to reasonably prevent security incidents. At times New Mountain Capital may also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: New Mountain Finance Corp

ticker: NMFC


text: New Mountain Capital uses processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, New Mountain Capital uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, New Mountain Capital also maintains an incident response plan that is utilized when cybersecurity incidents impacting us, our Investment Adviser, or our Administrator are detected. New Mountain Capital also requires that all employees, including employees of the Investment Adviser and Administrator, complete interactive security awareness training on an annual basis.


text: Material Impact of Cybersecurity Risks As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "The failure of cybersecurity protection systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively," which should be read in conjunction with the information above.


text: Our cybersecurity risks and associated mitigations are evaluated by our management and the ITSC as needed, but no less frequently than annually. Management and representatives of the ITSC periodically report to our board of directors on developments to the information security and cybersecurity risks we face. Reports include, among other things, an overview of New Mountain Capital's controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to us.


text: We have no employees and are externally managed by our Advisor, an affiliate of our Sponsor. Our Advisor has responsibility for our day-to-day operations, serving as a consultant in connection with policy decisions to be made by the board of directors.

companyName: CNL Healthcare Properties, Inc.

ticker: CHTH


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to customers, reputational damage adversely affecting customer or investor confidence and violation of data privacy or security laws. Our Sponsor maintains an enterprise-wide cybersecurity program to protect and defend against and manage foreseeable cybersecurity risks and threats, including for the Company. The cybersecurity program is administered by the Sponsor's Chief Technology Officer ("CTO"), who has adopted the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Based on the NIST standards, our cybersecurity program breaks down its efforts to manage cybersecurity risk into five (5) pillars: identify, protect, detect, respond and recover.


text: Identifying and assessing cybersecurity risk as well as protecting us from such risk is integrated into our overall risk management systems and processes as well as specifically addressed in our enterprise-wide cybersecurity program. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including threat intelligence collaboration and advisory mediums, third-party due diligence and risk assessments when determining the selection, oversight and engagement of third-party service providers, application security evaluations and annual penetration tests as well as management risk and compliance reviews. The foregoing combines with periodic review and analysis of third-party service provider system and organizational controls, internal network intrusion prevention systems, vulnerability assessments, access management, data loss prevention, remote access control, mandatory cybersecurity awareness training and random phishing campaigns with additional requisite training, if applicable, to identify and protect against cybersecurity risk.


text: Any potential cybersecurity compromise, whether direct or indirect, is analyzed and documented by the securities operations team (the "SO Team") and escalated to the cybersecurity incident response team ("CSIRT") as necessary. The SO Team is comprised of cybersecurity professionals and the CSIRT is comprised of certain of the Sponsor's and Company's executives from legal, corporate communications, IT, compliance, finance, and risk management.


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact. Materiality is determined by considering qualitative and quantitative factors. The CSIRT team also conducts tabletop exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation and remediation strategies.


text: Recovery and restoration from a cybersecurity incident can vary depending on type of attack and materiality of assets and information affected.


text: As of the date of this filing, we do not believe that our business strategy, results of operations or financial conditions have been materially affected by any risks from cybersecurity threats for the reporting period covered by this report. However, institutions like us, and our service providers, have experienced cybersecurity events and data incidents in the past and will likely continue to be the target of cyberattacks and intrusions. For additional information on the cybersecurity risks we face, see "Part 1, Item 1A. Risk Factors–Cyber security risks and cyber incidents could adversely affect the Company's business and disrupt operations."


text: Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates at least annually from senior management, including leaders from the CTO, internal audit and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our board of directors also engages in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: The cybersecurity risk management and strategy processes are overseen by the Sponsor's cybersecurity committee which consists of the Company's chief financial officer and general counsel, and the CTO, legal, risk management, and compliance teams Such individuals have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, and compliance. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: As of the date of this filing, we do not believe that our business strategy, results of operations or financial conditions have been materially affected by any risks from cybersecurity threats for the reporting period covered by this report. However, institutions like us, and our service providers, have experienced cybersecurity events and data incidents in the past and will likely continue to be the target of cyberattacks and intrusions. For additional information on the cybersecurity risks we face, see "Part 1, Item 1A. Risk Factors–Cybersecurity risks and cyber incidents could adversely affect the Company's business and disrupt operations."


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Summit Hotel Properties, Inc.

ticker: INN


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology ("IT") environment; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes and internal IT and risk management professionals principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan to respond to cybersecurity incidents; and • a third-party risk management process for service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, consolidated financial position, or results of operations. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, consolidated financial position, or results of operations. See "Risk Factors – Risks Related to Our Business."


text: Our Board of Directors (the "Board") considers cybersecurity risk as critical to the enterprise and manages the cybersecurity risk oversight function through the Audit Committee. The Audit Committee oversees management's design, implementation and enforcement of our cybersecurity risk management program.


text: Our Chief Risk Officer ("CRO") periodically reports to the Audit Committee and leads the Company's overall cybersecurity function. The Audit Committee receives regular reports from our CRO on our cybersecurity risks, including briefings on our cyber risk management program. A potentially material cybersecurity incident would be immediately reported to the Audit Committee and management would continue to brief the Audit Committee on management's response to the cybersecurity incident. Audit Committee members also receive periodic presentations on cybersecurity topics from our CRO, supported by our information technology staff, or external experts as part of the Board's continuing education on topics that may affect public companies.


text: Our CRO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in our IT environment.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. We engage third-party cybersecurity and information technology ("IT") experts who work with our Chief Risk Officer and Chief Accounting Officer to review and test our IT environment, and to identify potential risks from cybersecurity threats and proactively mitigate their potential effect; the results of which are presented to management and the audit committee of our board of directors. Our team of IT experts hold various relevant certifications and have extensive experience in assessing, detecting, responding to and mitigating cybersecurity risks.


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes and internal IT and risk management professionals principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan to respond to cybersecurity incidents; and • a third-party risk management process for service providers.


text: Our board of directors (the "Board") considers cybersecurity risk as critical to the enterprise and manages the cybersecurity risk oversight function through the Audit Committee. The Audit Committee oversees management's design, implementation and enforcement of our cybersecurity risk management program.


text: Our Chief Risk Officer ("CRO") periodically reports to the Audit Committee and leads the Company's overall cybersecurity function. The Audit Committee receives regular reports from our CRO on our cybersecurity risks, including briefings on our cyber risk management program. A potentially material cybersecurity incident would be immediately reported to the Audit Committee and management would continue to brief the Audit Committee on management's response to the cybersecurity incident. Audit Committee members also receive periodic presentations on cybersecurity topics from our CRO, supported by our information technology staff, or external experts as part of the Board 's continuing education on topics that may affect public companies.


text: The Company's Cybersecurity Risk Management Approach The Company utilizes and relies on CIM Group for its IT and IT administration. CIM Group's cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. CIM Group's cybersecurity risk management policies and procedures include, among other things: enterprise-wide hardware and software management and security controls; employee training; security assessments;

companyName: CIM REAL ESTATE FINANCE TRUST, INC.

ticker: CMRF


text: penetration testing; security audits and ongoing risk assessments; due diligence on, and monitoring and oversight of, key third-party providers; vulnerability management; and management oversight to assess, identify and manage material risks from cybersecurity threats. CIM Group's controls leverage the National Institute of Standards and Technology Cyber Security Framework. CIM Group also utilizes industry and government associations, the results from regular internal and third-party audits and other similar resources to inform its cybersecurity processes and to allocate resources.


text: In addition, all CIM Group employees receive mandatory training on cybersecurity matters at such employee's new hire and annually thereafter, periodic training and information updates that address new cybersecurity threats and trends, and quarterly "phishing" and social engineering testing to evaluate the effectiveness of the cybersecurity training program and raise employee awareness of cybersecurity threats.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: For further discussion of cybersecurity risks, see "Item 1A. Risk Factors—Risk Related to Our Company - Cybersecurity risks and cyber incidents may adversely affect our business in the event we or our manager, our transfer agent or any other party that provides us with essential services experiences cyber incidents."


text: Management Oversight of Cybersecurity Risk Management CIM Group's internal processes require escalation of material cybersecurity risks to its management and its Cybersecurity Committee (the "Committee") for evaluation. The Committee consists of CIM Group's Chief Technology Officer (the "CTO"), CIM Group's Chief Compliance Officer (the "CCO") as well as representatives from CIM Group's operations, compliance and accounting departments. The Committee is responsible for CIM Group's cybersecurity policy and overseeing the activities of CIM Group's cybersecurity practices, including assessing CIM Group's risks and controls. The Committee is chaired by the CTO who has more than 30 years' experience in the fields of information technology, cybersecurity and adjacent roles, including serving on cybersecurity advisory councils. In addition, members of the Committee have relevant industry experience in enterprise risk management and compliance. The team responsible for developing and implementing our cybersecurity program collectively holds an MS in Cybersecurity and Information Assurance and has multiple cybersecurity certifications, including CRISC, CISM, CISA, NCSP-NIST, CISSP, CASP+, CySA+ and Security+.


text: The Committee has established a Cybersecurity Subcommittee (the "Subcommittee"). The Subcommittee consists of, among others, the CCO, the CTO, the chief financial officers of public companies that are subject to the SEC's cybersecurity rule adopted in 2023 and are managed by CIM Group, including our Chief Financial Officer. The Subcommittee is tasked with assisting CIM Group-managed public companies (that are subject to the SEC's cybersecurity rule adopted in 2023), including us, in complying with such cybersecurity rule.


text: The Committee and Subcommittee each conduct both regular quarterly and as-needed meetings throughout the year during which members of the CIM Group's IT department provide updates and report on meaningful cybersecurity risks, threats, incidents and vulnerabilities in accordance with the Committee's and the Subcommittee's respective reporting frameworks, as well as related priorities, mitigation and remediation activities, financial and employee resource levels, regulatory compliance, technology trends and third-party provider risks. To help inform this reporting framework, CIM Group maintains incident response plans and other policies and procedures designed to respond to, mitigate and remediate cybersecurity incidents based on the potential impact to CIM Group's business, IT systems, network or data, including data held by third parties, or to the IT or other critical services provided by third-party vendors and service providers.


text: CIM Group's personnel responsible for cybersecurity policy is comprised of individuals with either formal education and degrees in IT or cybersecurity, or with experience working in IT and cybersecurity, including relevant industry experience in security related industries.


text: We believe that the processes, policies and procedures established by the Committee and the Subcommittee provide guidance for consistent and effective incident handling and response and set standards for internal notifications and escalations, as well as external notification considerations with respect to a cybersecurity event or incident requiring disclosure or notification in accordance with applicable laws.


text: Board of Directors Oversight of Cybersecurity Risk Management The Audit Committee of our Board has oversight of our cybersecurity risks. The Audit Committee receives quarterly updates from CIM Group with respect to the effectiveness of its cyber readiness and cybersecurity program. This oversight includes briefing and a report by the CTO or CIM Group's Head of Operations, as well as a discussion of any cybersecurity breaches detected by CIM Group and a summary of, among other things, the current cybersecurity threat landscape, defensibility measures implemented by CIM Group, the health of CIM Group's information security system, effectiveness of CIM Group's cybersecurity controls and recoverability and business continuity testing. Pursuant to the Company's cybersecurity policy, the Audit Committee will be promptly notified of any material cybersecurity incident required to be disclosed under Item 105 of Regulation S-K and shall oversee the Company's response to such matter.


text: The Company's Cybersecurity Risk Management Approach The Company utilizes and relies on CIM Group for its IT and IT administration. CIM Group's cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. CIM Group's cybersecurity risk management policies and procedures include, among other things: enterprise-wide hardware and software management and security controls; employee training; security assessments; penetration testing; security audits and ongoing risk assessments; due diligence on, and monitoring and oversight of, key third-party providers; vulnerability management; and management oversight to assess, identify and manage material risks from cybersecurity threats. CIM Group's controls leverage the National Institute of Standards and Technology Cyber Security Framework. CIM Group also utilizes industry and government associations, the results from regular internal and third-party audits and other similar resources to inform its cybersecurity processes and to allocate resources.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: Board of Directors Oversight of Cybersecurity Risk Management The a udit committee of our Board has oversight of our cybersecurity risks. The audit committee receives quarterly updates from CIM Group, including one or more representatives from the Cybersecurity Committee and Subcommittee, with respect to the effectiveness of its cyber readiness and cybersecurity program. This oversight includes briefing and a report by the CTO or CIM Group's Head of Operations, as well as a discussion of any cybersecurity breaches detected by CIM Group and a summary of, among other things, the current cybersecurity threat landscape, defensibility measures implemented by CIM Group, the health of CIM Group's information security system, effectiveness of CIM Group's cybersecurity controls and recoverability and business continuity testing. Pursuant to the Company's cybersecurity policy, the audit committee will be promptly notified of any material cybersecurity incident required to be disclosed under Item 1.05 of Form 8-K and shall oversee the Company's response to such matter.


text: The Company's cybersecurity program is designed to secure the continuity of operations and protect the privacy of company, guest and team member data. The Company uses multiple layers of security controls and unique threat intelligence within the "Center for Internet Security v8 Cybersecurity Framework" across five core security functions: Identify risks and threats, Protect, Detect, Respond and Recover. In addition, the Company requires that its employees complete annual compliance training on cybersecurity and online habits.

companyName: Spirit Aviation Holdings, Inc.

ticker: FLYYQ


text: The Company's cybersecurity program is managed by a dedicated cybersecurity function reporting to the Chief Information Security Officer ("CISO") who reports to the Chief Information Officer ("CIO") and is responsible for the Company's cybersecurity strategy, policies, standards, architecture and process. The CISO has over 20 years of executive experience in IT operations and security, primarily in the airline industry, and maintains several active certifications in Risk and Information Security including CIPPUS, CISSP-ISSMP, CISM, CRISC, and CISSP. The program includes periodic and ad hoc reporting on relevant developments, including monitoring, prevention, detection, mitigation and remediation of the current cybersecurity landscape as well as reporting on any cybersecurity incidents to the Company's CEO and the Safety, Security and Operations Committee of the Board of Directors, which has oversight of management's cybersecurity function. The CISO also engages external government and commercial expertise to continuously evaluate, test and adapt the program. External vendors participate in in-depth security assessments based on the Company's vendor management security policy.


text: Currently, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's operations. However, the nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches could have a material adverse effect on the Company's business strategy, results of operations or financial condition.


text: Currently, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's operations. In addition, the Company successfully completed the first annual cybersecurity audit conducted by TSA under Joint EA 23-01 Cybersecurity-Performance-Based Measures for Airport and Aircraft Operators. However, the nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches could have a material adverse effect on the Company's business strategy, results of operations or financial condition.


text: Cyberattacks represent a potentially significant risk to the Company and our industry. We rely on subsidiaries of Cheniere, through our service agreements with them, as further discussed in Note 12—Related Party Transactions of our Notes to Financial Statements, and the board of directors of CQP's general partner (the "Board"), which has oversight of our operations, to implement policies and procedures that are intended to manage and reduce this risk.

companyName: Sabine Pass Liquefaction, LLC


text: As part of its broader approach to risk management, Cheniere's cybersecurity program is designed to follow an "identify, protect, detect, respond and recover" approach to cybersecurity that is based off of the National Institute of Standards and Technology Cybersecurity Framework ("CSF"). Cheniere's strategy also includes segmentation of corporate and operations networks, defense in depth and the least privileged access principle. Operational networks have fundamentally distinct safety and reliability standards and pose unique threats in comparison to information technology networks. Realizing these differences, Cheniere routinely evaluates opportunities to refine its cybersecurity program in order to mitigate operational network risks. Cheniere includes business continuity planning as a component of its strategy to help ensure critical systems are available to support the Company in the instance of a disruptive event. Cheniere also participates in various industry organizations to stay abreast of recent trends and developments.


text: On an ongoing basis, Cheniere assesses its people, processes and technology and, when necessary, adjusts the overall program in an effort to adapt to the ever-evolving cyber and geopolitical landscapes. Cheniere conducts regular assessments and audits, cross-functional risk mitigation exercises and risk strategy sessions to identify cybersecurity risks, applicable regulatory requirements and industry standards. These engagements are also designed to exercise, assess the maturity of and enhance Cheniere's Cyber Incident Response Plan. To support these efforts, Cheniere has contracted with third parties to perform facility and system penetration tests, compromise assessments of IT systems, and security maturity assessments of its corporate and operational networks. Cheniere maintains a training program to help its personnel identify and assist in mitigating cybersecurity and data security risks. Cheniere's employees and the members of the Board participate in annual training, user awareness campaigns and additional issue-specific training as needed. Cheniere also provides annual training for certain contractors who have access to its information technology networks.


text: With respect to third party service providers, Cheniere's information security program includes conducting risk-based due diligence of certain service providers' information security programs prior to onboarding. Cheniere strives to contractually require third party service providers with access to its information technology systems, sensitive business data or personal information to maintain reasonable security controls and restrict their ability to use Cheniere's data, including personal information, for purposes other than to provide services to them, except as required by applicable law. Cheniere also strives to negotiate contractual requirements which compel its service providers to notify them of information security incidents occurring on their systems which may affect Cheniere's systems or data, including personal information.


text: During the year ended December 31, 2023, cybersecurity incidents and threats did not materially affect our business, results of operations or financial condition.


text: We rely on Cheniere's cybersecurity leadership team, which consists of its Director and Chief Information Security Officer ("CISO"), Vice President and Chief Information Officer and Senior Vice President of Shared Services. These individuals collectively provide the strategic oversight of Cheniere's cybersecurity governance, cyber risk management and security operations and are responsible for maintaining Cheniere's technology defense posture and program. They have decades of experience managing strategic technology operations, including the identification of cybersecurity risk and the defense of information technology assets from global threats. Cheniere's CISO's experience includes assessing risks, implementing governance programs, and responding to threats in oil and gas, electric and natural gas utilities and nuclear power generation companies. He maintains a Certified Information Security Manager certification from ISACA, secret clearance from the Department of Homeland Security and has played an active role in the development of various cybersecurity standards including the CSF.