text: As of the date of this report, no risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. Although the Company has mature processes in place to identify and mitigate potential risks from cybersecurity threats, such risks cannot be completely eliminated. More information on the risks of cybersecurity threats and potential impact to the Company can be found in Item 1A. Risk Factors.


text: Role of Management Dow's Information Systems organization is led by Dow's Chief Information and Digital Officer, who reports to Dow's Chief Operating Officer, and is responsible for administration of the cybersecurity and information security framework and risk management, with oversight by the Audit Committee of the Board.

companyName: DOW INC.

ticker: DOW

secItem: Item 1C


text: The Company's Chief Information and Digital Officer has formal education in information technology and more than 30 years of experience in information systems and technology, including as the vice president of Global Information Technology. Prior to joining Dow, the Chief Information and Digital Officer held a variety of leadership roles including vice president of Information Technology at Cargill, Incorporated. The Chief Information and Digital Officer receives regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation.


text: The Company's management responsible for developing and executing Dow's cybersecurity policies is comprised of individuals with either formal education and degrees in information technology or cybersecurity, or with experience working in information technology and cybersecurity, including relevant experience in security related industries. Additionally, leaders in the Company's information technology function receive periodic training and education on cybersecurity related topics. Certain leaders also obtain industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager.


text: The Company's Cyber Security Operations Center ("CSOC") serves as the central point for all cybersecurity incidents and reporting, including incidents that directly target employees or Dow internal information systems and incidents originating from third parties. The CSOC provides end-to-end operations for purposes of monitoring, detecting, alerting and responding to cybersecurity incidents. The CSOC evaluates each incident in terms of its impact on the Company's operations, ability to conduct business with customers and suppliers, brand reputation and health, safety or the environment, and the speed and degree to which the incident has been contained. The CSOC is also responsible for activating the containment and resolution efforts and third-party service providers are engaged where appropriate to support the Company through the resolution of the incident. The CSOC escalates incidents with significant impact and pervasiveness to the Company's Corporate Crisis Management Team for further action. After initial identification, the CSOC monitors all cybersecurity incidents for changes in degree of impact or pervasiveness.


text: Role of the Board Dow's Board recognizes the importance of cybersecurity in safeguarding the Company's sensitive data. The Board is responsible for overseeing overall risk management for the Company, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess, manage and mitigate risk, at least annually. While the full Board is accountable for cybersecurity and AI risk management, the Board has delegated responsibility for oversight of the Company's cybersecurity and information security framework and risk management to the Audit Committee of the Board. The Audit Committee receives information and updates at least quarterly and actively engages with senior leaders, including the Chief Information and Digital Officer and Chief Information Security Officer, with respect to the effectiveness of the Company's cybersecurity and information security framework, data privacy, and risk management. In addition, the Audit Committee receives reports summarizing threat detection and mitigation plans, audits of internal controls, training and certification, and other cyber priorities and initiatives, as well as timely updates from senior leaders on material incidents relating to information systems security, including cybersecurity incidents. The Audit Committee also reviews external firms' assessments of the Company's security posture and NIST CSF maturity level. Information made available to the Audit Committee is also made available to the full Board. The Audit Committee includes members with significant experience and/or expertise in technology or cybersecurity, including information systems.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes as described below.

companyName: BlackSky Technology Inc.

ticker: BKSY


text: We conduct at least quarterly assessments of risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. In addition to these quarterly risk assessments, we conduct assessments when there is a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and evaluate the effectiveness of our safeguards at least semi-annually. We devote significant resources and designate high-level personnel, including our Chief Information Officer who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with the people operations, IT, compliance, and legal departments, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings at least annually.


text: We engage assessors, consultants, or other third parties for supplemental cyber monitoring and assessment of cybersecurity policies and controls in support of the risk assessment. We contractually require key and/or relevant third-party service providers to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. Depending on the severity of the suspected breach these reports may be among the information supplied to our Chief Information Officer.


text: We, like any technology company operating in the current environment, have previously experienced cybersecurity incidents. However, as of the date of this Annual Report on Form 10-K, we do not believe that any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, are reasonably likely to have a material effect on us, our business strategy, results of operations, or financial condition. For additional information regarding risks related to cybersecurity threats, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factor entitled "Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized disclosure of data, or theft or tampering of intellectual property, and give rise to potential harm to customers, remediation and other expenses under a variety of domestic and international laws or other laws or common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business and operations."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through its strategy committee.


text: Our Chief Information Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Information Officer has nearly four decades of overall information technology experience in secure environments, including eight years of infrastructure and cybersecurity leadership at our Company. Furthermore, our Strategy Committee Chair brings nearly four decades of technical and organizational leadership experience, having previously held senior US government positions as the Principal Deputy Director of National Intelligence and the Senior Advisor to the Director for Cyber and Director of Information Operations for the CIA, where she was responsible for cyber operations, foreign cyber threat assessment, and cybersecurity. She sits on the boards of several public and private technology companies, filling the role of their cybersecurity expert.


text: Our Chief Information Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The process by which our Chief Information Officer is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the review of weekly reports provided by our security team highlighting metrics that relate to potential threats and vulnerabilities as well as status updates on our security initiatives and mitigations. The updates also include a review of emerging cyber risks and other relevant issues identified in our cyber threat intelligence reporting.


text: Our Chief Information Officer presents quarterly briefings to the strategy committee and/or our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, and activities of third parties. The strategy committee provides at least quarterly updates to the board of directors on such reports. In the event of a material cybersecurity incident or series of incidents, our Chief Information Officer will notify the strategy committee and the audit committee of the Company's board of directors and work with legal counsel to ensure appropriate disclosures are made to regulatory agencies.


text: We engage assessors, consultants, or other third parties for supplemental cyber monitoring and assessment of cybersecurity policies and controls in support of the risk assessment. We contractually require key and/or relevant third-party service providers to certify that they have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of their security measures that may affect our company. Depending on the severity of the suspected breach, these reports may be among the information supplied to our Chief Information Officer.


text: Our Chief Information Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Information Officer has nearly four decades of overall information technology experience in secure environments, including nine years of infrastructure and cybersecurity leadership at our Company. Furthermore, our Strategy Committee Chair brings nearly four decades of technical and organizational leadership experience, having previously held senior US government positions as the Principal Deputy Director of National Intelligence and the Senior Advisor to the Director for Cyber and Director of Information Operations for the CIA, where she was responsible for cyber operations, foreign cyber threat assessment, and cybersecurity. She sits on the boards of several public and private technology companies, filling the role of their cybersecurity expert.


text: We maintain a comprehensive process for assessing, identifying, and managing material risks from cybersecurity threats. Our cybersecurity risk management processes include security controls, monitoring systems, employee training, and cybersecurity risk insurance. Our processes include overseeing and identifying risks from cybersecurity threats associated with the use of tools and services from third-party providers.

companyName: Whole Earth Brands, Inc.


text: We conduct quarterly assessments to identify cybersecurity threats. Based on these assessments, we design, implement and maintain risk-based controls to protect our information, our information systems and our business operations, address any identified gaps in existing controls, update existing controls, as necessary, and monitor the effectiveness of our controls. We have allocated adequate resources and have designated appropriate personnel, including our Global IT Senior Director, to manage the cybersecurity risk management process and engage with consultants, auditors, and other third parties in connection with our cybersecurity risk management process. Senior leadership, including our Global IT Senior Director who has extensive cybersecurity knowledge and skills gained from 20 years of work experience, is responsible for our overall enterprise risk management program and has integrated the cybersecurity risk management processes into the overall enterprise risk management program.


text: The Board of Directors, in coordination with the Audit Committee, oversees the Company's enterprise risk management processes, including the management of risks arising from cybersecurity threats. The Audit Committee generally receives quarterly reports from our Global IT Senior Director regarding cybersecurity risks, which may address a range of topics including recent developments, risk assessments, third-party and independent reviews and technology trends. We have protocols in place by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally, and as appropriate, reported to the Audit Committee or Board in a timely manner.


text: The Global IT Senior Director oversees the Company's incident response plan and related processes designed to assess and manage material risks from cybersecurity threats. The Company's Global IT Senior Director also coordinates with internal audit and other third parties to assess and manage material risks from cybersecurity threats and is responsible for informing the Audit Committee of cybersecurity incidents that may be material.


text: In the three year period ending December 31, 2023, we have not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. For additional information regarding whether risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, see Item 1A. Risk Factors — "Risks Related to Our Business," included in this Annual Report on Form 10-K.


text: Cybersecurity for our Company is conducted by our United States based operations and European based operations. For our United States based operations, our Information Technology department ("ITUS") in New York, New York is in charge of our cybersecurity for offices in the United States, Italy, and other remote locations. For our European based operations, our Information Technology department ("ITEU") in Paris, France is in charge of our cybersecurity for offices in France, and other remote locations.

companyName: INTERPARFUMS INC

ticker: IPAR


text: Each of ITUS and ITEU report to their respective segment Chief Executive Officers, Messrs. Madar for ITUS and Benacin for ITEU, who are also directors of our Company. Any material issues of cybersecurity would then be reported to our board of directors. As of the date of this report, we have not had any material cybersecurity incidents.


text: Both departments have established strict security rules for infrastructure, application and limitations on access rights. New employees are instructed on aspects of cybersecurity, and reminders for safe internet access are periodically sent. Access to our networks for former employees and contractors is immediately revoked upon severance of association, and any hardware such as laptops, company phones, access keys are returned. Each department has also installed equipment and tools to protect and update against the risks of intrusions, cyberattacks, and system obsolescence. Various applications and methods to manage our cybersecurity include, but not limited to, use of EDI (electronic digital interface) for receiving orders, fire walls, virtual private network, antivirus software, encryption, and requiring two factor authentication for remote access after business hours. Redundancy is important as data is routinely backed up daily.


text: In addition, Interparfums SA has adopted an IT Charter that defines the rights and obligations of employees and users of their information system, to ensure that the information technology resources are used in a secure environment complying with the procedures of internal control, and regularly performs penetration testing. Beginning in January 2024, Interparfums SA commenced enrolling all employees of Interparfums SA in cybersecurity training. United States based operations provides specific user IDs, and employees are instructed to set up passwords that are not easy to guess, keep passwords confidential, and immediately change such employee's password if such employee believes it has been compromised. All desktop and laptop computers must be password protected and must be changed every 90 days. In addition, employees must not knowingly input erroneous, fraudulent, fictitious or otherwise inappropriate data into any application/system and report any suspicious activity to ITUS. Company employees are prohibited from downloading any files or software for personal use, and not create any independent data connections from Company offices that attempt to sidestep the Company's network security policy or mechanisms.


text: United States based operations nor European based operations sells directly to retail consumers, which diminishes to some degree, but does not preclude, the likelihood of third party access to our data.


text: The Company recognizes the importance of developing, implementing and maintaining cybersecurity measures to better safeguard our information systems and protect the confidentiality, integrity and availability of our data. Our management team will work to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have not been subject to cybersecurity challenges that have materially impaired our operations or financial standing. In the future, the Company will require the Board and employees to complete cybersecurity training related to the physical security of assets, data privacy and other information security policies and procedures.

companyName: CoJax Oil & Gas Corp

ticker: CJAX


text: Risk Management and Strategy rely on information technology systems and data processing that we or our service providers, collaborators, consultants, contractors or partners operate to collect, process, transmit and store electronic information in our day-to-day operations. Our internal computer systems and data processing and those of our third-party vendors, consultants, collaborators, contractors or partners, including future CROs, may be vulnerable to risks from cybersecurity threats. To help manage these risks, we engage and rely on external experts, including an information technology managed services provider. We are also in the process of developing additional cybersecurity policies and procedures, as we continually work to enhance and evolve our program in light of the constantly evolving threat landscape.

companyName: Vivani Medical, Inc.

ticker: VANI


text: Our managed services provider assists us with our technology, infrastructure and risk management through the deployment of a number of security controls and tools, including, but not limited to, endpoint protection tools, phishing protection and access controls.


text: We also take steps to limit third-party vendors' access to our systems, and we are in the process of developing additional vendor risk management procedures.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could affect our information or systems. For more information, please see the section entitled "Risk Factors."


text: Related to Cybersecurity Risks engage a managed services provider, which includes virtual chief information officer (vCIO) services, to assist us with the identification, monitoring and management of risks from cybersecurity threats. Our managed services provider reports on our cybersecurity posture periodically to our management team and audit committee. We have also formed an IT Steering Committee, whose members include cross functional representatives from our management team as well as our managed services provider, to review our cybersecurity program initiatives and related program metrics. The Committee is also charged with identifying and implementing improvements that strengthen our risk mitigation systems.


text: Audit Committee of our Board of Directors oversees our policies and procedures with respect to risk management, including our management of risks from cybersecurity threats. The Audit Committee administers this cybersecurity risk oversight function through the receipt and review of reports from the management team and the vCIO on the Company's information technology systems and the status of the cybersecurity risk management tools.


text: The Company's information technology, communication networks, system applications, accounting and financial reporting platforms and related systems are integral to the operation of the business. The Company utilizes these systems, among others, for financial analysis, management, and reporting, and for various other aspects of the business.

companyName: CLEARONE INC

ticker: CLRO


text: The Company's cybersecurity strategy is focused on detection, protection, incident response, security risk management and mitigation, and resiliency of the cybersecurity infrastructure. The Company relies primarily on its qualified internal team to operate and maintain its information technology infrastructure and systems and to evaluate, test and update various information security processes and to manage material risks from cybersecurity threats to the Company's critical computer networks, third party hosted services, communications systems, hardware and software, and critical data, including confidential information that is proprietary, strategic or competitive in nature, as well as any personally identifiable information related to any tenants' and employees' personal data.


text: The Company's employees identify and assess risks from cybersecurity threats by monitoring and evaluating the cybersecurity threat environment and the Company's risk profile. The Company is not currently aware of any risks from cybersecurity threats nor has the Company had a previously cybersecurity incident that in either case have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations or financial condition.


text: The Company's Audit Committee holds oversight responsibility over the Company's cybersecurity strategy and risk management. The Audit Committee engages in regular discussions with management and, if and when deemed appropriate by management or the Audit Committee, third party service providers, regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats.


text: Management and Strategy have designed and implemented an information security program that is tailored to our operations and infrastructure, the nature of our products and services, and the sensitivity of data. Our information security program consists of processes that are designed to identify, assess, and manage material risks from cybersecurity threats.

companyName: Fintech Scion Ltd


text: We have implemented cybersecurity risk management processes that include, for example, vulnerability assessments, application security assessments, penetration testing, third party security assessments, security audits, and ongoing risk assessments. In addition, we have implemented technical, physical, and organizational safeguards designed to mitigate material risks from cybersecurity threats, including, for example, depending on the environment or system: information security policies and standards, data protection policies and standards, security training and awareness campaigns, information protection processes, and systems monitoring for cybersecurity threats. Further, our assessment and management of material risks from cybersecurity threats are an important element of our overall enterprise risk management program and included in our annual enterprise risk assessment which we provide to senior management and the Board.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional services firms (including legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software and managed service providers, penetration testing firms, and forensic investigators.


text: Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our cybersecurity consultant, regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board retains oversight of cybersecurity because of its importance. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate. Our Cybersecurity consultant has extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks.


text: We believe cybersecurity is critical to advancing our business securely. We face a multitude of cybersecurity threats, have experienced, and will continue to experience, cyber incidents in the normal course of business. Such cybersecurity threats could have a material adverse effect on our business, financial condition, operations, results of operations, performance, cash flows or reputation. Our Sponsor and affiliates and other business contacts may face similar cybersecurity threats, and a cybersecurity incident impacting these persons or entities could materially adversely affect our operations, performance and results of operations.

companyName: OceanTech Acquisitions I Corp.


text: OTEC board of directors oversees our cybersecurity risk exposures and the steps taken by management to identify, monitor and mitigate cybersecurity risks to align our risk exposure with our strategic objectives. With respect to such cybersecurity risk oversight, the OTEC board receives any updates from management on the primary cybersecurity risks facing us, the Sponsor and our affiliates, and the measures we, Sponsor and our affiliates are taking to mitigate such risks. In addition to such, the OTEC board receives updates from management as to any changes management becomes aware of, such as to changes to such cybersecurity risk profile or certain newly identified risks. In the event of an incident, we intend to follow the necessary steps related to incident identification, mitigation, recovery and notification to legal counsel, senior leadership and the OTEC board, as appropriate.


text: While prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Part I, Item 1A, Risk Factors, Risks Related to an Investment in Our Company" for more information regarding cybersecurity risks.


text: management and strategy are an R&D stage pharmaceutical company, with no commercial operations or revenue streams. Since our IPO, our sole business activity has been ongoing research into our drug therapies]. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted a formal cybersecurity risk management program or process for assessing cybersecurity risk currently.

companyName: Pelthos Therapeutics Inc.

ticker: PTHS


text: We assess material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. As our Company grows, we plan to develop a more robust and detailed strategy for cybersecurity in alignment with nationally accepted standards. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, Governance


text: Our management and board of directors recognize the critical importance of maintaining the trust and confidence of our business partners and employees, including the importance of managing cybersecurity risks as part of our larger risk management program. While all of our personnel play a part in managing cybersecurity risks, one of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks that we face. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Assessment and Strategy regularly evaluate cybersecurity risk from computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human error and technological errors. Such risks are reviewed by our management on a periodic basis as deemed appropriate.

companyName: Transit Pro Tech Inc.


text: Our overall strategy in combatting known cybersecurity risks includes a variety of individual tactics, including: use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect data the deployment of updates and patches as they are available and maintaining the current versions of major software to reduce the the use of third-party service to conduct mandatory online training for all employees regarding identifying and avoiding cyber-security the review of the security procedures used by third parties that may host or otherwise have access to Fuel Tech's data.


text: deployment of third-party cyber-security experts to perform penetration testing on our internal and external networks and necessary, the use of third-party security experts if and when an incident is detected are not aware of having experienced any material cybersecurity incidents. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions. For more information, please see "Cybersecurity" under Item 1A "Risk Factors" above.


text: As the Board of Directors has yet to establish any committees, Management regularly updates our Board regarding Management's efforts to minimize cybersecurity risks.


text: Risk Management and Processes is actively working towards the integration of a cybersecurity risk management program into its comprehensive risk management framework to protect the confidentiality, integrity, and availability of its critical systems and information.

companyName: Sensus Healthcare, Inc.

ticker: SRTS


text: Our cybersecurity risk management program is being designed based on various cybersecurity frameworks, including National Institute of Standards and Technology and the Center for Internet Security, as well as information security standards issued by the International Organization for Standardization, including ISO 27001 and ISO 27002. The Company uses these frameworks and information security standards as a guide to identify, assess, and management cybersecurity risks relevant to the business. Formalization and implementation of robust IT security policies; Conducting vulnerability assessments; Revision of user access request documentation to clearly define the roles and permissions assigned to users; of the accuracy and completeness of user listings and access;


text: evidence related to system modifications; and with external specialists to aid in the ongoing evaluation of existing policies and procedures. Establishment of a dedicated cybersecurity governance committee; of cybersecurity incident response procedures and formats; Conducting penetration tests on a quarterly basis; Enhancement of segregation of duties to mitigate the risk of self-review of transactions within the system;


text: Company has not identified any risks from known cybersecurity threats and did not have any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, refer to Item 1A. Risk Factors – "The Company's operations may be impaired if our information technology systems fail to perform adequately or are the subject of a data breach or cyberattack," which is incorporated by reference into this Item 1C.


text: Board of Directors actively collaborates with management to supervise cybersecurity risks. The Chief Technology Officer ("CTO"), with over 10 years' experience in cybersecurity, leads the Company's overall cybersecurity function and monitors cybersecurity risks. The CTO works with internal personnel and third-party consultants to design and implement the controls on the prevention, detection, mitigation, and remediation of cybersecurity risks. The CTO maintains regular communication with the Board on matters related to cybersecurity and provides updates to management on a quarterly basis. In the event of a cybersecurity incident, the Board is to be promptly notified.


text: Management considers cybersecurity risk as part of its risk oversight function and is in the process of establishing a cybersecurity governance committee. The cybersecurity governance committee will oversee the management's implementation of the cybersecurity risk management program.


text: management and strategy are an R&D stage pharmaceutical company, with no commercial operations or revenue streams. Since our IPO, our sole business activity has been ongoing research into our drug therapies. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted a formal cybersecurity risk management program or process for assessing cybersecurity risk currently.


text: We recognize the critical importance of m aintaining the safety and security of our information technology systems and data and maintain a cybersecurity risk management program as a part of our overall risk management strategy that is focused on identifying, assessing and managing cybersecurity risks. We engage an Managed Services Provider ("MSP"), with a highly experienced and responsive staff including a virtual Chief Information Officer ("vCIO"), to assist us with the identification, monitoring and management of risks from cybersecurity threats. They assist us with our technology, infrastructure and risk management through the deployment of a number of security controls and tools. We also take steps to limit third-party vendors' access to our systems, and we are in the process of developing additional vendor risk management procedures.


text: Board Oversight of Cyber Risk The Audit Committee of our Board of Di rectors oversees our policies and procedures with respect to risk management, including our management of risks from cybersecurity threats. The Audit Committee administers this cybersecurity risk oversight function through the receipt and review of reports from the management team and the vCIO on the Company's information technology systems and the status of the cybersecurity risk management tools.


text: We rely on information technology systems and data processing so that we or our service providers, collaborators, consultants, contractors or partners can operate to collect, process, transmit and store electronic information in our day-to-day operations. Our internal computer systems and data processing along with those of our third-party vendors, consultants, collaborators, contractors or partners may be vulnerable to risks from cybersecurity threats. To help manage these risks, we engage and rely on external experts, including an Information Technology MSP. We are also in the process of developing additional cybersecurity policies and procedures, as we continually work to enhance and evolve our program in light of the constantly evolving threats to our environment.


text: Our MSP assists us with our technology, infrastructure and risk management through the deployment of a number of security controls and tools, including, but not limited to, endpoint protection tools, phishing protection and access controls. We also take steps to limit third-party vendors' access to our systems, and we are in the process of developing additional vendor risk management procedures.


text: Aligning with various government and industry standards such as: National Institute of Standards and Technology ("NIST") Cybersecurity Framework, HIPAA, 21 CFR Part 11 and Sarbanes-Oxley ("SOX"), Conducting ongoing Security Awareness Training to keep employees informed of threats and how to spot them, Evaluating the cybersecurity policies of third-party vendors and service providers, Implementing redundant systems for mission critical operations, Developing and implementing Business Continuity/Disaster Recovery plans and procedures, and Ensuring robust protective measures such as: Email security including phishing protection Endpoint Security Perimeter Firewalls Physical Access controls Rapid Ransomware monitoring and recovery Multi-Factor Authentication Non-administrative computer access for typical users


text: Encryption of computing systems To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could affect our information or systems.


text: Related to Cybersecurity Risks In addition to the services provided by our MSP, we have also formed an IT Steering Committee, whose members include representatives from our management team as well as our MSP, to review our cybersecurity program initiatives and related program metrics. Our IT Steering Committee provides cybersecurity updates and reports to our Audit Committee at each quarterly meeting or would report more frequently if there was a need to do so.


text: Recognizing the critical importance of robust cybersecurity measures, the Company is committed to developing, implementing and maintaining measures to better safeguard our information systems and protect the confidentiality, integrity and availability of our data.


text: Our management team actively evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs. To date, our operations or financial standing have not been materially impaired by any cybersecurity challenges. Looking ahead, the Company will mandate comprehensive cybersecurity training for both the Board and employees, covering key areas such as physical security of assets, data privacy and other information security policies and procedures.


text: Assessment and Strategy regularly evaluate cybersecurity risk from computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human error and technological errors. Such risks are reviewed by our management on a periodic basis as deemed appropriate.


text: Utilizing e-mail services and cloud based storage systems offered by well-known reputable software and service providers which incorporate cybersecurity protections in their products.


text: use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect data necessary, the use of third-party security experts if and when an incident is detected.


text: We are not aware of having experienced any material cybersecurity incidents. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions. For more information, please see "Cybersecurity" under Item 1A "Risk Factors" above.


text: As the Board of Directors has yet to establish any committees, Management regularly updates our Board regarding Management's efforts to minimize cybersecurity risks.


text: The company's risk management programs for cybersecurity are integrated into the company's enterprise risk management and general compliance programs and processes.

companyName: Corteva, Inc.

ticker: CTVA


text: Our cybersecurity program utilizes a layered, defense-in-depth strategy to identify and mitigate cybersecurity threats. The company's information security team is responsible for the day-to-day management of the company's global information security program, which includes defining policies and procedures to safeguard our information systems and data, conducting vulnerability, threat and third-party information security assessments, information security event management (i.e., responding to ransomware and other cyber-attacks, business continuity and recovery), evaluating external cyber intelligence, supporting industry cybersecurity efforts and working with governmental agencies. The global information security team also develops training for personnel (e.g., employees and contractors) with access to Corteva's system to support adherence to the company's policies and procedures, along with increasing awareness of cyber-related risk. The personnel training includes, but is not limited to, mandatory onboarding training, phishing simulations with automated remediation training, table-top incident response exercises, and educational intranet posting and email campaigns.


text: Our Enterprise Risk Management Committee, which includes the company's Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), independently assesses and monitors the effectiveness of the company's cybersecurity risk management programs and strategies. The company's internal audit function also performs independent reviews and validation of the various programs, including policies and procedures as determined by their annual risk assessment.


text: The company leverages the U.S. Department of Commerce's National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("Framework") as the foundation of its global information security program. The NIST Framework provides standards, guidelines, and practices for organizations to better manage and reduce cybersecurity risk and is designed to foster risk and cybersecurity management communications amongst both internal and external organizational stakeholders. The company's information security team works with independent, third-party consultants annually to assess the maturity of the company's cybersecurity program within the NIST Framework and to develop strategic areas of focus for the company's programs commensurate with the company's business objectives.


text: As part of the company's global information security program, we leverage both internal and external assessments and partnerships with industry leaders to help approach information security company-wide. Additionally, the company maintains a comprehensive program that defines standards for the planning, sourcing, management, and oversight of third-party relationships and third-party access to its system, facilities, and/or confidential or proprietary data.


text: Cybersecurity incidents may create risk to the company that may impact its reputation, financial performance, ability to operate safely or at all, and the value of its intellectual property. Like most major corporations, the company is the target of industrial espionage, including cyberattacks, from time to time. The company has determined that these incidents have resulted, and could result in the future, in unauthorized parties gaining access to certain confidential business information. However, to date, Corteva has not experienced any known cybersecurity incidents that have materially affected the company, including the company's results of operations and financial condition, changes in the competitive environment, business operations and strategy. Although management does not believe that Corteva has experienced any material losses to date related to cybersecurity incidents, there can be no assurance that Corteva will not suffer such losses in the future. For more information on potential risk related to cybersecurity incidents, including intellectual property theft and operational disruption, please see "Item 1A – Risk Factors" of this report.


text: The company's Audit Committee and Governance and Compliance Committee provide board oversight of company cybersecurity risks. The Audit Committee conducts a minimum of two cybersecurity program updates per year, including a review of capital spend, budget, and staffing, as well as quarterly reports on cybersecurity threats and key risk indicators related to the company's progress on risk mitigation activities. The Governance and Compliance Committee, as part of its oversight for the enterprise risk management program company-wide, reviews and ensures that the company's oversight and governance structure related to company risks, including cybersecurity risks, remains appropriate and that risks are appropriately managed.


text: The company's CIO oversees the company's information technology programs and investments. The company's CISO reports to the CIO and oversees the company's information security programs. The company's CIO has over 30 years of information technology experience, including nine years in various information technology leadership roles. Our CIO holds a bachelor of science and master of science degrees in organizational communications as well as an M.B.A. in information technology. The company's CISO has over thirty years of experience in information security and is a Certified Information Security Manager (CISM), a Certified Data Privacy Solutions Engineer (CDPSE), as well as being Certified in Risk and Information Systems Control (CRISC). Our CISO holds a bachelor of science degree in electric engineering as well as an M.B.A. in operations, technology.


text: Both the CIO and CISO regularly report to the Audit Committee, Board and Governance and Compliance Committee, on the company's identification, prevention, detection, mitigation and remediation of cybersecurity risks and incidents. In 2023, the Board reviewed the company's cybersecurity program and maturity assessment, while the Audit Committee provided regular oversight of cybersecurity risks, with cybersecurity discussions and dashboard reviews of key performance indicators and risks at five committee meetings during the course of the year. With respect to specific incidents, the company leverages an incident response framework to elevate and evaluate specific incidents to the CIO and CISO, along with the company's senior leadership, including the finance and legal functions. In the event of a potentially material cybersecurity incident, the Audit Committee would be immediately notified and briefed.


text: Both the CIO and CISO regularly report to the Audit Committee, Board and Governance and Compliance Committee, on the company's identification, prevention, detection, mitigation and remediation of cybersecurity risks and incidents. In 2024, the Board reviewed the company's cybersecurity program and maturity assessment, while the Audit Committee provided regular oversight of cybersecurity risks, with cybersecurity discussions and dashboard reviews of key performance indicators and risks at five committee meetings during the course of the year. With respect to specific incidents, the company leverages an incident response framework to elevate and evaluate specific incidents to the CIO and CISO, along with the company's senior leadership, including the finance and legal functions. In the event of a potentially material cybersecurity incident, the Audit Committee would be immediately notified and briefed.


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. As the historic external property manager of the VineBrook Portfolio and a current subsidiary that engages in property management functions and employes the majority of our employees, we maintain cybersecurity policies, standards, processes and practices at the Manager that cover our 24 office locations and over 550 employees. In general, we seek to address cybersecurity risks of the Company through a comprehensive, cross-functional approach that is focused on continually assessing our information systems to detect, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.

companyName: VINEBROOK HOMES TRUST, INC.


text: As one of the critical elements of our overall risk management, our cybersecurity program is focused on the following key areas:


text: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with our management and the Chief Technology Officer of the Manager that implement and oversee our cybersecurity program.


text: Risk Assessment: No less frequently than annually, we complete an assessment to identify potential cybersecurity threats and vulnerabilities to better prioritize and mitigate our cybersecurity risk. The assessment includes, among other things, evaluating the nature, sensitivity and location of information the Company collects, processes and stores and the resiliency of the underlying technologies, the validity and effectiveness of the Company's security policies, controls and processes and the cybersecurity preparedness of the third-party vendors used by the Company. We complete internally managed weekly vulnerability testing. To supplement our internal assessment, we also engage third-party consultants to assess system configurations through configuration review and annual penetration testing.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, multi-factor single-sign on authentication for all employees into line of business applications, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: We have established and maintains comprehensive business continuity plans that address potential impacts should the information or technology systems become compromised, and such plans are tested and evaluated on a regular basis.


text: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including key vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. This includes robust reviews with our technology partners who provide the commercial off the shelf software applications we rely on from, among others, Yardi, SalesForce and UKG.


text: We provide regular, mandatory training for our employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. In addition, we provide end user education on various cybersecurity related topics through a partnership with our human resources team.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address the Company's cybersecurity threats and incidents. These efforts include a wide range of activities, including third-party annual penetration testing, internally managed weekly vulnerability testing, third-party compliance testing and ongoing internal testing and creation and modification of policies and procedures. The results of these assessments are reported at least annually to the Audit Committee and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and ongoing testing.


text: The Audit Committee oversees the Company's risk management policies, including the management of risks arising from cybersecurity threats. The Audit Committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including annual assessments of internal and third-party policies, vulnerability assessments, technological trends and information security considerations arising with respect to the Company. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with our management, including the Chief Technology Officer of the Manager.


text: The Chief Technology Officer of the Manager, in coordination with relevant senior management, which includes the Director of IT Operations and General Counsel of the Manager, work to conceive, implement, and monitor the effectiveness of a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any security incidents in accordance with the Company's business continuity plan. To ensure the effectiveness of these controls, our technology team continually monitors, hardens, and evolves systems' security postures to model and mirror various security frameworks. The Chief Technology Officer of the Manager will promptly notify the General Counsel of the Manager, the General Counsel of the Adviser and senior management, including our President, Senior Vice President of Acquisition & Dispositions and Senior Vice President of Asset Management, of any cybersecurity events, with material cybersecurity events promptly communicated to the Audit Committee and publicly disclosed as deemed necessary.


text: The Chief Technology Officer of the Manager has served in various roles in information technology and information security for over 30 years, including as one of the original architects of the business, operations, systems and information technology infrastructure in the institutional SFR homes sector with large investors in the VineBrook Companies since 2010. The Chief Technology Officer of the Manager holds an undergraduate degree in computer science/programming and a masters degree in business administration (MBA). In addition, he has been an educator, speaker, and published author on several technology related topics including cybersecurity, artificial intelligence, machine learning, geographic information systems, database architecture, and business intelligence. The Director of IT Operations of the Manager has over 25 years of experience in network designs, information technology operations management and cybersecurity and has completed various certifications from Microsoft, Fortinet, Qualys, Agile, Kaseya, Veeam, and CompTIA. In addition to our cybersecurity policies, standards, processes and practices, our Adviser maintains cybersecurity policies, standards, processes and practices that are based on recognized security frameworks such as the National Institute of Standards and Technology cybersecurity framework and the Azure Security Benchmark. Our Adviser deploys technical safeguards that are designed to protect our Adviser's information systems from cybersecurity threats and completes internal and external assessments to identify potential cybersecurity threats and vulnerabilities and to identify and oversee cybersecurity risks presented by third parties. The Adviser's Director of Information Technology, in coordination with relevant personnel of the Adviser, work to conceive, implement, and monitor the effectiveness of a program designed to protect their information systems from cybersecurity threats and to promptly respond to any security incidents. The Adviser's Director of Information Technology will promptly notify the Adviser's General Counsel and senior management, including our President, of any cybersecurity events, with material cybersecurity events promptly communicated to the Audit Committee and publicly disclosed as deemed necessary.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. See Item 1A. "Risk Factors—Risks Related to Our Business and the Single-Family Rental Housing Market—We are highly dependent on information systems and systems failures could significantly disrupt our business" and "Security breaches and other disruptions could compromise our information systems and expose us to liability, which would cause our business and reputation to suffer."


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. As the historic external property manager of the VineBrook Portfolio and a current subsidiary that engages in property management functions and employs the majority of our employees, we maintain cybersecurity policies, standards, processes and practices at the Manager that cover our 20 physical office locations and over 525 employees. In general, we seek to address cybersecurity risks of the Company through a comprehensive, cross-functional approach that is focused on continually assessing our information systems to detect, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.


text: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with our Adviser's Director of Information Technology, our management and the Interim Chief Technology Officer of the Manager that implement and oversee our cybersecurity program.


text: Risk Assessment: No less frequently than annually, we complete an assessment to identify potential cybersecurity threats and vulnerabilities to better prioritize and mitigate our cybersecurity risk. The assessment includes, among other things, evaluating the nature, sensitivity and location of information the Company collects, processes and stores and the resiliency of the underlying technologies, the validity and effectiveness of the Company's security policies, controls and processes and the cybersecurity preparedness of the third-party vendors used by the Company. We complete internally managed weekly vulnerability testing and monthly penetration testing. To supplement our internal assessment, we also engage third-party consultants to assess system configurations through configuration review and annual penetration testing.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, multi-factor authentication, and single-sign on for all employees required to access line of business applications, intrusion prevention and detection systems, anti-malware functionality and access controls. Our technical safeguards are evaluated and improved through the use of first and third party vulnerability assessment tools and cybersecurity threat intelligence.


text: We have established and maintained an incident response process and have associated policies in place. As of the date of this filing, we are undertaking an update to our network and system and as such our incident response plan is being updated.


text: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including key vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. This includes reviews with our technology partners who provide the commercial off the shelf software applications we rely on to deliver business services.


text: We work in partnership with our human resources team to provide mandatory training for our employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address the Company's cybersecurity threats and incidents. These efforts include a wide range of activities, including third-party annual penetration testing, internally managed weekly vulnerability testing and monthly penetration testing, third-party compliance testing and ongoing internal testing and creation and modification of policies and procedures. The results of these assessments are reported at least annually to the Audit Committee and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and ongoing testing.


text: The Audit Committee oversees the Company's risk management policies, including the management of risks arising from cybersecurity threats. The Audit Committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including annual assessments of internal and third-party policies, vulnerability assessments, technological trends and information security considerations arising with respect to the Company. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with our management and the Director of Information Technology of our Adviser.


text: The Interim Chief Technology Officer of the Manager, in coordination with relevant senior management, including but not limited to the Director of IT Operations, Information Security Manager, and General Counsel of the Manager and the Director of Information Technology of the Adviser, work to define, implement, and monitor the effectiveness of a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any security incidents in accordance with the Company's incident response plan. To ensure the effectiveness of the relevant controls, our technology team monitors, updates, and evolves systems' security postures to align to controls defined in the NIST Cybersecurity Framework. The Interim Chief Technology Officer of the Manager will promptly notify the Director of Information Technology of our Adviser, who will then notify the General Counsel of the Adviser and our President and Chief Executive Officer, of any cybersecurity events, with material cybersecurity events promptly communicated to the Audit Committee and publicly disclosed as deemed necessary.


text: The Interim Chief Technology Officer of the Manager has served in various roles in information technology and information security over the previous 30 years, holding company officer roles for both private and publicly traded companies including Chief Information Officer, Chief Security Officer, Chief Information Security Officer and Chief Technology Officer. The Chief Technology Officer of the Manager holds numerous security and technology credentials maintained in good standing including Certified Information Systems Security Professional (CISSP), as well as holding in good standing specialized security operations and data privacy credentials including ISACA Certified Information Security Manager (CISM) and IAPP Certified Information Privacy Manager (IAPP CIPM).


text: The Adviser's Director of Information Technology has served in various roles in information technology and information security for 25 years, including serving as Global Technology Manager at a multi-national publicly traded broker-dealer, and 15 years as the Director of Information Technology at a privately held financial services firm. The Adviser's Director of Information Technology holds an undergraduate degree in biochemistry and has attained numerous information technology certifications over the years including Microsoft Certified Systems Engineer (MCSE) and Cisco Certified network Professional (CCNP). The Adviser's Senior Infrastructure Engineer has over 20 years industry experience, holds an undergraduate degree in radiology, and has completed various Microsoft related information technology certifications. Combined, our Adviser's information technology team has over 50 years of experience covering all major aspects of network architecture and management. In addition to our cybersecurity policies, standards, processes and practices, our Adviser maintains cybersecurity policies, standards, processes and practices that are based on recognized security frameworks such as the National Institute of Standards and Technology cybersecurity framework and the Azure Security Benchmark. Our Adviser deploys technical safeguards that are designed to protect our Adviser's information systems from cybersecurity threats and completes internal and external assessments to identify potential cybersecurity threats and vulnerabilities and to identify and oversee cybersecurity risks presented by third parties. The Adviser's Director of Information Technology, in coordination with relevant personnel of the Adviser, works to conceive, implement, and monitor the effectiveness of a program designed to protect their information systems from cybersecurity threats and to promptly respond to any security incidents.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and we do not believe are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. See Item 1A. "Risk Factors, Risks Related to Our Business and the Single-Family Rental Housing Market, We are highly dependent on information technology and security breaches or systems failures could significantly disrupt our business" and "Breaches of our data security could materially harm our business and reputation."


text: Cyber threats are considered one of the most significant risks facing financial institutions. Since our company is externally managed, we rely upon the operational and investment risk oversight functions of our Adviser and its affiliates. To mitigate risk from cyber threats, our Adviser has a designated Global Chief Security Officer ("GCSO") who leads the global security department that is responsible for identifying, assessing and managing cybersecurity threats. The GCSO has experience in the public and private sectors, specializing in security, investigations and incident response. The global security department oversees the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, and Corporate Security. This converged security structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees and critical assets safe, upholding privacy rights, while enabling a secure and resilient business.

companyName: Invesco Real Estate Income Trust Inc.


text: Our Adviser's information security program is led by its Chief Information Security Officer ("CISO") who reports directly to the GCSO and has extensive experience in specializing in information security and risk management. Our Adviser's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets.


text: Our Adviser's cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or third-party incident. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness against cyber phishing threats.


text: Important to these programs is our Adviser's investment in threat-intelligence, its active engagement in industry and government security-related forums, and its utilization of external experts to challenge its program maturity, assess its controls and routinely test its capabilities.


text: Our board of directors oversees cybersecurity risk and receives updates, at a minimum, twice a year from the CISO (or designee) regarding cybersecurity, which updates include a review of our Adviser's global security program and cybersecurity, including risks and protections for us and our Adviser. The Global Operational Risk Management Committee, one of our Adviser's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. In addition, the CISO provides quarterly updates to our company's enterprise risk management committee, which in turn provides quarterly updates to our board of directors, and members of our management team are included in our Adviser's incident response process in the event a cyber security incident occurs that could materially impact us.


text: As of December 31, 2023, we have not experienced any cyber incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Cyber threats are considered one of the most significant risks facing financial institutions. Since our company is externally managed, we rely upon the operational and investment risk oversight functions of our Adviser and its affiliates. To mitigate risk from cyber threats, our Adviser has a designated Global Chief Security Officer ("GCSO") who leads its global security department, which is responsible for identifying, assessing and managing cybersecurity threats. The GCSO has experience in the public and private sectors, specializing in security, investigations and incident response. The global security department oversees, among other things, the following groups across Invesco: Information Security, Strategic Intelligence, Corporate Security, Business Continuity, Crisis Management, Global Privacy Office, Business Security, Projects and Strategy This structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees and critical assets safe, upholding privacy rights, and enabling a secure and resilient business.


text: Our Adviser's information security program is led by its Chief Information Security Officer ("CISO") who reports directly to the GCSO and has extensive experience in information security and risk management. Our Adviser's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets.


text: Our Adviser's cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or a third-party. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness of cyber phishing threats.


text: Our board of directors oversees cybersecurity risk and receives updates, at a minimum, twice a year from the CISO (or designee) regarding cybersecurity, which updates include a review of our Adviser's global security program and cybersecurity, including risks and protections for us and our Adviser. The Global Operational Risk Management Committee, one of our Adviser's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. In addition, the CISO provides quarterly updates to our enterprise risk management committee, which in turn provides quarterly updates to our board of directors, and members of our management team are included in our Adviser's incident response process in the event a cybersecurity incident occurs that could materially impact us.


text: As of December 31, 2024, we have not experienced any cyber incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: We are committed to protecting our information assets and systems. We have an enterprise-wide information security program designed to identify, protect against, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. We have installed privacy/security protection systems and devices on our network in an attempt to prevent cyberthreats and other unauthorized access to information.

companyName: Envista Holdings Corp

ticker: NVST


text: We have adopted a comprehensive Information Security Policy applicable to all of our employees and business partners. We also maintain a Global Security Incident Response Plan ("GSIRP") to ensure we remain prepared in the event of a cyberattack or other form of network penetration. Our GSIRP is a cross functional plan that documents the details and decision-making process required during a response to a security incident, as well as the reporting protocol with clear escalation timelines and responsibilities. We test our GSIRP with tabletop exercises administered by a third party security consultant. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cyber issues.


text: Like most multinational corporations, our information technology systems have been subject to computer viruses, malicious codes, unauthorized access and other cyberattacks, and we expect the sophistication and frequency of such attacks to continue to increase. To date, no attempted cyberattack or other attempted intrusion on our information technology networks has resulted in a material adverse impact on our business strategy, results of operations or financial condition. There can be no assurance that future incidents will not materially affect us, including our business strategy, results of operations or financial condition. Please refer to "Item 1A. Risk Factors—Risks Related to Our Business" for further detail about the material cybersecurity risks we face.


text: Our Senior Director of Information Security reports to our Chief Information Officer and is responsible for leading our enterprise-wide information security team. The team focuses on developing and implementing strategies, processes and response plans to protect the confidentiality, integrity, and availability of our assets. Our Senior Director of Information Security has prior experience as a chief information security officer and over 25 years of experience in Technology and Security. Our security team also includes members who maintain industry security certificates. Our team is additionally supported by third parties to assist in the operations of our program, compliance audits and security penetration testing.


text: We evaluate and manage risks relating to cybersecurity as part of our overall enterprise risk management program. We perform an annual assessment across the Company to identify and review potential risks. Risks are prioritized based on threat models to improve cybersecurity throughout the Company. Our Board of Directors oversees our enterprise risk management program.


text: The Audit Committee of our Board of Directors has the responsibility of exercising oversight with respect to our cybersecurity risk management and risk controls. Our Chief Information Officer provides periodic reports to the Audit Committee regarding our cybersecurity program, including our information risk management and oversight, security education and training, cyber threat detection and response processes, and relevant internal and industry cybersecurity attacks. The Board also receives a report out on cybersecurity issues and governance at least annually, with periodic updates as needed.


text: We are committed to taking action to protect our information assets and systems. We have an enterprise-wide information security program designed to identify, protect against, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats, including those associated with our use of third-party service providers. We have installed privacy/security protection systems and devices on our network in an attempt to prevent cyberthreats and other unauthorized access to information. Additionally, we conduct security risk assessments prior to engaging third party suppliers and other vendors and business partners to validate that they maintain appropriate safeguards to protect our and their information systems in connection with services they provide. This risk assessment is heightened with respect to vendors or business partners that have access to our critical systems and information.


text: We have adopted an Information Security Policy applicable to all of our employees and business partners. We provide security awareness education and training for our employees annually, conduct regular internal "phishing" testing and mandatory training for "clickers," and publish internal alerts to highlight any emerging or urgent security threats. We also maintain a Global Security Incident Response Plan ("GSIRP") to guide our response in the event of a cyberattack or other form of network penetration. Our GSIRP is a cross functional plan that documents the details and decision-making processes required during a response to a security incident, as well as the reporting protocol with escalation timelines and responsibilities. We test our GSIRP with tabletop exercises administered by a third party security consultant. We leverage the standards set by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as well as industry best practices to measure our security posture and manage risk. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cyber issues, although our insurer may deny coverage for a future claim or our insurance coverage may be insufficient to cover all losses from a cyberattack.


text: We evaluate and manage risks relating to cybersecurity as part of our overall enterprise risk management program. We perform an annual assessment across the Company to identify and review potential risks. Risks are prioritized based on threat models to improve cybersecurity throughout the Company.


text: Our Board of Directors oversees our enterprise risk management program. The Audit Committee of our Board of Directors has the responsibility of exercising oversight with respect to our cybersecurity risk management and risk controls. Our Chief Information Officer provides periodic reports to the Audit Committee regarding our cybersecurity program, including our information risk management and oversight, security education and training, cyber threat detection and response processes, and relevant internal and industry cybersecurity attacks. The Board also receives a report out on cybersecurity issues and governance at least annually, with periodic updates as needed. Board members receive periodic presentations on cybersecurity topics from our Chief Information Officer and external experts as part of the Board's continuing education on topics that impact public companies.


text: Material Cybersecurity Risks, Threats, and Incidents Like most multinational corporations, our information technology systems have been subject to computer viruses, malicious codes, unauthorized access and other cyberattacks, and we expect the sophistication and frequency of such attacks to continue to increase. For example, during the second half of 2023, one of our largest distributors experienced a cybersecurity incident which impacted their ability to place orders and consequently impacted the timing of orders received. This incident, however, as well as other cyberattacks to date, did not have a material impact on our business strategy, results of operations or financial condition. There can be no assurance that future incidents will not materially affect us, including our business strategy, results of operations or financial condition. Please refer to "Item 1A. Risk Factors—Risks Related to Our Business" for further detail about the material cybersecurity risks we face.


text: At STERIS, the enterprise risk management ("ERM") program is designed to identify, assess, and manage risks across STERIS's enterprise. Cybersecurity risk management is integrated into STERIS's ERM program, under which we regularly assess cybersecurity risks in accordance with what we believe are industry cybersecurity best practices. Further, we implement controls to protect the confidentiality, integrity and availability of STERIS's information systems and information. We maintain cybersecurity and incident response procedures to address our security standards and requirements and provide a framework for assessing and responding to cybersecurity threats and incidents. Additionally, as part of our ERM program, STERIS oversees and identifies risks associated with third-party service providers with whom we do business, which process includes due diligence, risk management assessments and contractual safeguards. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cybersecurity issues.

companyName: STERIS plc

ticker: STE


text: STERIS has an Executive Cybersecurity Steering Committee consisting of the Senior Vice President & Chief Financial Officer, the Vice President, Chief Accounting Officer, the Vice President, Investor Relations & Corporate Communications, the Vice President & Chief Information Officer ("CIO"), the Vice President, Chief Compliance Officer, the Senior Vice President, General Counsel & Company Secretary, and the Chief Information Security Officer ("CISO") that is responsible for providing governance, risk and compliance oversight for STERIS's incident response program, providing guidance and support for cybersecurity non-technical initiatives, and for verifying that appropriate actions are taken following an incident occurrence. We have adopted and maintain an incident response policy that covers our incident response program and the duties and responsibilities of our Incident Response Team ("IRT") responsible for managing and responding to cybersecurity incidents, including data breaches. Our IRT is led by the CISO and is comprised of senior management and others, including external resources, as required. Our incident response policy includes steps for detecting and investigating cybersecurity incidents, assessing the nature, scope, and severity of cybersecurity threats, identifying the impact of cybersecurity incidents, communicating cybersecurity incident disclosures, and implementing cybersecurity countermeasures and mitigation strategies.


text: A subcommittee of our IRT reviews and assesses associated public reporting implications of cybersecurity incidents. Our process also includes informing the Board of Directors and the Audit Committee following a material cybersecurity incident.


text: We engage third-party security experts to support our risk assessment activities and to provide system security enhancements. Our program includes regular vulnerability and penetration testing (internal and external) of our enterprise systems by independent external security experts.


text: Education and awareness training on information security and data protection is conducted regularly for Associates. Members of the IRT, the Executive Cybersecurity Steering Committee and the Board of Directors receive additional training on responding to cybersecurity incidents.


text: Our Board of Directors has oversight responsibility for the ERM program, and delegates the risk management assessment and risk management approach, including risks related to cybersecurity, to its Audit Committee. Among other responsibilities, the Audit Committee is responsible for monitoring internal controls, including those related to cybersecurity risk.


text: Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to monitor such potential cybersecurity risk exposures, putting in place appropriate mitigation measures and maintaining the cybersecurity program. Our cybersecurity program for our information systems is directed by our CIO and, with the cybersecurity team, our CIO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO is CISSP-ISSMP and CISM certified and is part of a team of experienced information system security professionals with diverse certifications, including CISSP, CISM, CNSS, CEH, CySA+, CompTIA - Security+, CySA+, PenTest+, and CASP+ and others. Management, including the CIO and CISO, update the Audit Committee on a regular basis on our cybersecurity program, material cybersecurity risks, mitigation strategies, cybersecurity metrics, developments in cybersecurity and proposed updates to our cybersecurity program.


text: In fiscal year 2024, STERIS did not experience any cyberattack or other attempted intrusion or other incident with respect to our information systems that materially affected or was likely to materially affect our business strategy, results of operations, financial condition or cash flows. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced or will not experience in the future undetected cybersecurity incidents. For more information about these risks, please see "Item 1A Risk Factors" in this annual report on Form 10-K.


text: At STERIS, the ERM program is designed to identify, assess, and manage risks across STERIS's enterprise. Cybersecurity risk management is integrated into STERIS's ERM program, under which we regularly assess cybersecurity risks in accordance with what we believe are industry cybersecurity best practices. Further, we implement controls to protect the confidentiality, integrity and availability of STERIS's information systems and information. We maintain cybersecurity and incident response procedures to address our security standards and requirements and provide a framework for assessing and responding to cybersecurity threats and incidents. Additionally, as part of our ERM program, STERIS oversees and identifies risks associated with third-party service providers with whom we do business, which process includes due diligence, risk management assessments and contractual safeguards. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cybersecurity issues.


text: STERIS has an Executive Cybersecurity Steering Committee consisting of the Senior Vice President & Chief Financial Officer, the Vice President, Chief Accounting Officer, the Vice President, Investor Relations & Corporate Communications, the Vice President & Chief Information Officer ("CIO"), the Vice President, Chief Compliance Officer, the Senior Vice President, General Counsel & Company Secretary, and the Vice President, Chief Information Security Officer ("CISO") that is responsible for providing governance, risk and compliance oversight for STERIS's incident response program, providing guidance and support for cybersecurity non-technical initiatives, and for verifying that appropriate actions are taken following an incident occurrence. We have adopted and maintain an incident response policy that covers our incident response program and the duties and responsibilities of our Incident Response Team ("IRT") responsible for managing and responding to cybersecurity incidents, including data breaches. Our IRT is led by the CISO and is comprised of senior management and others, including external resources, as required. Our incident response policy includes steps for detecting and investigating cybersecurity incidents, assessing the nature, scope, and severity of cybersecurity threats, identifying the impact of cybersecurity incidents, communicating cybersecurity incident disclosures, and implementing cybersecurity countermeasures and mitigation strategies. A subcommittee of our IRT reviews and assesses associated public reporting implications of cybersecurity incidents. Our process also includes informing the Board of Directors and the Audit Committee following a material cybersecurity incident.


text: Education and awareness training on information security and data protection is conducted regularly for employees. Members of the IRT, the Executive Cybersecurity Steering Committee and the Board of Directors receive additional training on responding to cybersecurity incidents.


text: Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to monitor such potential cybersecurity risk exposures, putting in place appropriate mitigation measures and maintaining the cybersecurity program. Our cybersecurity program for our information systems is directed by our CIO and, with the cybersecurity team, our CIO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CIO has a Bachelor of Science in Computer Engineering, a Master of Business Administration, and over 35 years of experience working in the information technology field, including approximately 20 years of CIO positions. Our CISO is CISSP-ISSMP and CISM certified and is part of a team of experienced information system security professionals with diverse certifications, including CISSP, CISM, CNSS, CEH, CySA+, CompTIA - Security+, CySA+, PenTest+, and CASP+ and others. Management, including the CIO and CISO, update the Audit Committee on a regular basis on our cybersecurity program, material cybersecurity risks, mitigation strategies, cybersecurity metrics, developments in cybersecurity and proposed updates to our cybersecurity program.


text: In fiscal year 2025, STERIS did not experience any cyberattack or other attempted intrusion or other incident with respect to our information systems that materially affected or was likely to materially affect our business strategy, results of operations, financial condition or cash flows. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced or will not experience in the future undetected cybersecurity incidents. For more information about these risks, please see "Item 1A Risk Factors" in this annual report on Form 10-K.


text: As a leader in building and operating electronic marketplaces, we face a broad set of cybersecurity risks stemming from managing complex technology systems, handling sensitive data, and the digital nature of our business. Managing cybersecurity risk is critically important to our business. We have comprehensive cybersecurity risk management and governance systems in place across our global operations designed to support successful operation of our systems.

companyName: Tradeweb Markets Inc.

ticker: TW


text: We operate in an environment where cybersecurity risks is a dynamic and evolving factor. We are committed to appropriately managing and minimizing the impact of cybersecurity risk on the achievement of our business objectives. We view cybersecurity risk management as a fundamental business process essential to our overall success. As such, we have integrated our cybersecurity program into our comprehensive Risk Framework, which is in place to support the management and oversight of risk across our organization. The Risk Framework establishes a consistent approach for identifying, assessing, measuring, mitigating, and reporting on material risks, including cybersecurity risks. The Risk Framework is composed of process components such as risk governance, risk identification and assessment, risk measurement, risk response and remediation and risk analysis and reporting.