text: We prioritize risk management as a core component of our overall cybersecurity program. We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and tests those systems pursuant to our cybersecurity policies, processes and practices. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. These efforts include: • an internal governance structure to identify, assess, and manage cybersecurity risks across the company in an integrated manner.; • cybersecurity incident management procedures designed to address the monitoring of systems for anomalous activity; identification of threats; assessment, prioritization, and escalation of incidents; response and recovery of systems; and continuous improvement; • technical controls to help ensure systems are protected from security threats and unauthorized or inappropriate access; • a vulnerability management and threat intelligence program that is designed to provide threat intelligence information to leadership and impacted business units; • monitoring and tracking key cybersecurity metrics; • a third-party risk management program designed to assess and mitigate risks associated with vendors, and other service provider organizations; and • cybersecurity awareness training for all employees, including additional training for specialized functions.

companyName: Aspen Technology, Inc.


text: We partner with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes, including through the use of cybersecurity consultants, to conduct evaluations of our security controls and provide certifications for industry-standard security frameworks, such as ISO 27001.

secItem: Item 1C


text: To date, we are not aware of cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Refer to the risk factors captioned "Security or data privacy breaches, or disruptions of our information technology systems, and an increasingly complex regulatory landscape could adversely affect our business" and "Our software products are highly sophisticated and specialized, and a major product failure or similar event caused by defects, cybersecurity incidents or other failures, could adversely affect our business" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on us.


text: The Audit Committee of our Board reviews and oversees the implementation of our policies and procedures related to cybersecurity risk assessment and management.


text: Our Chief Security Officer ("CSO") reports to the Audit Committee periodically on significant cybersecurity incidents and risks, as well as progress made on cybersecurity roadmap initiatives. The CSO also presents to the Board at least annually to address the current threat landscape, our readiness to meet those threats, and cybersecurity priorities and focus areas for the upcoming fiscal year.


text: The CSO may provide more frequent updates to the Board or the Audit Committee if necessitated by a security incident or other developments. The Audit Committee reports regularly to the Board regarding the committee's oversight of cybersecurity risk matters.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. In particular, the interim Chief Legal Officer and the CSO co-chair a periodic Cybersecurity Steering Committee (the "Steering Committee") meeting to help ensure a strategic approach to assessing and mitigating cybersecurity risks. The Steering Committee is charged with: • providing ownership, oversight, and review of current and future information security risks; • reviewing, approving, and communicating information security policies, exceptions, standards, and processes to the relevant teams and employees and helping ensure business requirements are represented in Steering Committee discussions; • reviewing our approach to security initiatives to assess whether it is designed to meet appropriate risk thresholds and regulatory guidelines; and • providing strategic direction and sponsorship for cybersecurity investments, projects, and services.


text: The CSO, the interim Chief Legal Officer and the Chief Research & Software Development Officer are responsible for leading the assessment and management of cybersecurity risks. The current CSO has over 20 years of experience in information security.


text: Risk Management Strategy The Company has implemented a cybersecurity program intended to assess, identify, manage and reduce cybersecurity risk. Through our partnership with Harley-Davidson we maintain an IT incident response plan that is designed to protect against, identify, evaluate, respond to, and recover from an incident. The plan is designed to be flexible so it may be adapted to an array of potential scenarios and includes a cybersecurity incident response team in the event of a cyber incident. The incident response team is a cross-functional group that is composed of both Company and Harley-Davidson personnel and external service providers, and which is tailored to a particular incident so that individuals with appropriate experience and expertise are available. Currently the Company contracts for such cybersecurity services through the Master Services Agreement with Harley-Davidson, in addition to leveraging its own information technology and security tools and teams.

companyName: LiveWire Group, Inc.

ticker: LVWR


text: We have invested in tools and technologies intended to protect our data and business systems, and we monitor our computing environment on an ongoing basis to help identify and assess risk. In addition, we have implemented a cybersecurity training program designed to educate and train employees how to identify, potentially avoid and report cybersecurity threats. It is focused on helping our workforce recognize, avoid falling victim to and raise the visibility of potential cyber threats and scams. In addition, periodic cybersecurity awareness messages are posted to employees on the Company portal as new threats and scams develop throughout the year.


text: Through the Master Services Agreement with Harley-Davidson, we take measures to regularly update and improve our cybersecurity program, including conducting assessments, performing penetration testing and scanning of our systems for vulnerabilities using external third-party tools and techniques to test security controls, auditing applicable data policies, and monitoring emerging laws and regulations related to information security. We design our program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework. However, this does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST Cybersecurity Framework as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. In addition, we periodically engage third-party advisors to assess the effectiveness of our cybersecurity program, policies and practices. We rely on Harley-Davidson to regularly consult with external advisors and cybersecurity providers regarding opportunities and enhancements to strengthen our policies and practices.


text: With respect to third-party service providers, our cybersecurity program includes conducting due diligence of relevant and material service providers' information security programs prior to onboarding. In general we also contractually require material third-party service providers with access to our information technology systems, sensitive business data or personal information to implement and maintain reasonably appropriate security controls and to use our personal information only to provide services to us, except as required by law.


text: While the Company has experienced, and may in the future experience, cybersecurity incidents, prior incidents have not materially affected the Company's business, results of operations or financial condition. Although the Company has invested in the protection of its data and information technology and monitors its systems on an ongoing basis, there can be no assurance that such efforts will in the future prevent material compromises to Company information technology systems that could have a material adverse effect on the Company's business. See Item 1A. Risk Factors, which are incorporated by reference into this Item 1C.


text: Our Board of Directors has risk oversight responsibility for the Company and administers this responsibility both directly and with assistance from the Audit and Finance Committee, which periodically reports to the Board of Directors on its risk oversight activities. Cybersecurity is a critical component of our overall risk management program. Our Board of Directors is actively involved in reviewing our information security and technology risks and opportunities (including cybersecurity) and discusses these topics on a regular basis.


text: The Audit and Finance Committee, comprised solely of independent directors, oversees our enterprise risk management program and assists the Board of Directors in fulfilling its oversight responsibility with respect to our information security and technology risks (including cybersecurity), which are fully integrated into our enterprise risk management systems. The Audit and Finance Committee reviews and discusses our information security and technology risks (such as cybersecurity), including our information security and risk management programs.


text: Our cybersecurity program is contracted through and led by Harley-Davidson's Chief Information Security Officer (CISO) who is responsible for assessing and managing the Company's information security and technology risks (including cybersecurity). On December 15, 2023, the Harley-Davidson CISO announced his retirement from Harley-Davidson, and since that time, Harley-Davidson's Chief Digital and Operations Officer is serving as the acting Harley-Davidson CISO, executing all of the responsibilities of the CISO while Harley-Davidson conducts a search to fill the position. Harley-Davidson's Chief Digital and Operations Officer has extensive experience in leading information systems management, strategy and operational execution, including information security and incident management, prevention and response.


text: The Harley-Davidson CISO meets regularly with our Head of Digital to review and discuss our cybersecurity and other information technology risks and opportunities. Our cybersecurity incident response plan sets forth a security incident management and reporting protocol, with escalation timelines and responsibilities.


text: The Audit and Finance Committee receives periodic updates from the Harley-Davidson CISO or his designee on our cybersecurity program, including industry trends, the current state of our business systems, and any current known risks or concerns related thereto. The Audit and Finance Committee is involved in reviewing our information security and technology risks, including with respect to cybersecurity and reports on such matters to the Board as necessary, and at least annually.


text: Our cybersecurity program is contracted through and led by Harley-Davidson's Chief Information Security and Privacy Officer (CISO) who is responsible for assessing and managing the Company's data privacy function and information security and technology risks (including cybersecurity). The CISO has over 20 years of cyber industry and compliance experience, serving in a CISO capacity for over ten of those years. The CISO reports to Harley Davidson's Chief Digital and Operations Officer, who has extensive experience in leading information systems management, strategy and operational execution, including information security and incident management, prevention and response.


text: The Harley-Davidson CISO meets regularly with the appropriate management to review and discuss our cybersecurity and other information technology risks and opportunities. Our cybersecurity incident response plan sets forth a security incident management and reporting protocol, with escalation timelines and responsibilities.


text: The Company's cybersecurity is overseen by the Chief Executive Officer, who receives reports directly from other officers and individuals who perform services for the Company, including, but not limited to, the Manager's Information Security Steering Committee ("ISSC"), employing a risk-based methodology designed to safeguard the security, confidentiality, integrity, and availability of its information. The ISSC is tasked with developing an effective cyber strategy, establishing policies, and managing cyber risks within the organization. The Manager's Chief Financial Officer and General Counsel, along with the Chief Operating Officer, Chief Human Resources Officer, Chief Compliance Officer, Chief Technology Officer, Chief Information Security Officer and Chief of Intelligence collaborate with Company management to formulate, implement, and enforce these policies. They help ensure that the ISSC considers best practices in its decision-making, and convenes quarterly or as needed to assess cybersecurity issues and supervise matters related to information security, fraud, vendors, data protection, and privacy risks.

companyName: FTAI Infrastructure Inc.

ticker: FIP


text: To help identify and assess risks, we and our Manager engage third-party advisors to conduct assessments, which leverage standards such as the National Institute of Standards and Technology security framework ("NIST"). The results of these assessments inform the development of cybersecurity controls and risk mitigation strategies, which are then implemented throughout the Company.


text: We have taken proactive measures intended to minimize the likelihood of successful cyberattacks, including the establishment of incident response procedures designed to address potential cyber threats that may arise. These response procedures are structured with the aim to identify, analyze, contain, and remediate any cyber incidents that occur. We also have risk management processes to oversee and help identify risks from cybersecurity threats associated with our use of third-party providers.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "A cyberattack that bypasses our information technology ("IT") security systems or the IT security systems of our third-party providers, causing an IT security breach or cybersecurity incident, may lead to a disruption of our IT systems and the loss of business information which may hinder our ability to conduct our business effectively and may result in lost revenues and additional costs." in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: Material risks are identified and prioritized by management, and material risks are discussed periodically or as needed with the Board of Directors. The Board of Directors regularly reviews information regarding the Company's credit, liquidity and operations, including risks and contingencies associated with each area, including cybersecurity. In addition to the formal compliance program, the Board of Directors encourages management to promote a corporate culture that incorporates risk management into the Company's corporate strategy and day-to-day business operations.


text: The Company's cybersecurity is overseen by the Chief Executive Officer, who receives reports directly from other officers and individuals who perform services for the Company, including, but not limited to, the Manager's Information Security Steering Committee ("ISSC"), employing a risk-based methodology designed to safeguard the security, confidentiality, integrity, and availability of its information. The ISSC is tasked with developing an effective cyber strategy, establishing policies, and managing cyber risks within the organization. The Manager's Chief Financial Officer and General Counsel, along with the Chief Operating Officer, Chief Human Resources Officer, Chief Compliance Officer, Chief Technology Officer, Chief Information Security Officer and Chief of Intelligence collaborate with Company management to formulate, implement, and enforce these policies. They help ensure that the ISSC considers best practices in its decision-making, and convenes quarterly or as needed to assess cybersecurity issues and supervise matters related to information security, fraud, vendors, data protection, and privacy risks. The Manager's Chief Technology Officer and Chief Information Security Officer have extensive knowledge and skills, and collectively bring decades of experience in the cybersecurity industry.


text: We have taken proactive measures intended to minimize the likelihood of successful cyberattacks, including the establishment of incident response procedures designed to address potential cyber threats that may arise. These response procedures are structured with the aim to identify, analyze, contain, and remediate any cyber incidents that occur. We also have risk management processes to oversee and help identify risks from cybersecurity threats associated with our use of third-party providers. The Company's cybersecurity risk management processes are an integrated and key component of the Company's overall risk management strategy.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "A cyberattack that bypasses our information technology ("IT") security systems or the IT security systems of our third-party providers, causing an IT security breach or cybersecurity incident, may lead to a disruption of our IT systems and the loss of business information which may hinder our ability to conduct our business effectively and may result in lost revenues and additional costs." in Part I, Item 1A, "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of GC Advisors and other third-party service providers. GC Advisors manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Golub Capital Direct Lending Unlevered Corp


text: Cybersecurity Program Overview GC Advisors has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. GC Advisors' cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. GC Advisors actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on GC Advisors to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on GC Advisors' risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of GC Advisors when identifying and overseeing risks from cybersecurity threats associated with the Company's use of such entities.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Financial Officer ("CFO") and Chief Compliance Officer ("CCO") regarding the overall state of GC Advisors' cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management GC Advisors' internal cybersecurity team, headed by GC Advisors' Chief Information Officer ("CIO"), are responsible for the cybersecurity program applicable to the Company (including enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture, and processes), and along with the Company's CCO and a Disclosure Committee that is headed by the Company's CFO (the "Disclosure Committee"), are responsible for assessing and managing material risks from cybersecurity threats that impact the Company.


text: The CFO and CCO of the Company oversee the Company's oversight function generally and rely on GC Advisors' CIO and cybersecurity team to assist with assessing and managing material risks from cybersecurity threats. The Company's CFO has been responsible for this oversight function as CFO to the Company since the Company commenced operations on April 1, 2022 and has worked in the financial services industry for more than eighteen years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The Company's CCO has been responsible for this oversight function as CCO to the Company since the Company commenced operations on April 1, 2022 and has worked in the financial services industry for more than twenty years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company. The Advisors' CIO has been responsible for her function for over four years and has worked in the financial services industry for more than fifteen years, during which time the CIO has gained expertise in assessing and managing risk applicable to the Company.


text: Management of the Company, including the CCO and the Company's Disclosure Committee, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of GC Advisors.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on a regular basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of GC Advisors and other third- party service providers. GC Advisors manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.


text: The CFO and CCO of the Company oversee the Company's oversight function generally and rely on GC Advisors' CIO and cybersecurity team to assist with assessing and managing material risks from cybersecurity threats. The Company's CFO has been responsible for this oversight function as CFO to the Company since the Company commenced operations on April 1, 2022 and has worked in the financial services industry for more than nineteen years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The Company's CCO has been responsible for this oversight function since assuming her role as CCO to the Company and has worked in the financial services industry for more than 15 years, during which time the CCO has gained expertise in assessing and managing risk, including those applicable to the Company. The Advisors' CIO has been responsible for her function for over five years and has worked in the financial services industry for more than sixteen years, during which time the CIO has gained expertise in assessing and managing risk applicable to the Company.


companyName: Golub Capital BDC 4, Inc.


text: nCino's Enterprise Risk Management Program includes a cybersecurity risk management process and a formal Information Security Management System ("ISMS") as foundational components of the program. We routinely assess risks that could affect the organization's ability to meet its business objectives and provide reliable services to our customers. nCino's Chief Information Security Officer ("CISO") is responsible for identifying, assessing, and managing material cybersecurity risks. nCino's CISO brings over 25 years of experience in security and risk management to the company and takes the lead on reporting risk to senior management and nCino's Board of Directors.

companyName: nCino, Inc.

ticker: NCNO


text: nCino conducts annual cybersecurity risk and threat assessments which include detailed control analyses for measuring both inherent and residual risk factors. These assessments are performed by nCino Information Security as part of the ISO 27001 ISMS requirements. Our annual risk assessment is performed by using the nCino ISO 27001 risk assessment as a basis for risk identification, with additional assessments to address risks that threaten the achievement of the control objectives as appropriate. Threats to security, confidentiality, and availability are identified and assessed as part of our annual and routine risk assessments.


text: nCino's CISO reports cyber security risk assessment results at Disclosure Committee Meetings, Board and Audit Committee Meetings, and executive subcommittees specializing in cyber security risk management (Risk Information Security Committee). nCino maintains a documented process for when and by whom senior management is informed of a cybersecurity incident and when such information will be reported to affected parties. These processes are detailed within our Incident Response Plan which is regularly reviewed and updated by the information security team.


text: nCino has implemented a variety of cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess and manage material risks. Our approach includes (i) nCino's Enterprise Risk Management Program, as managed by the Internal Audit & Enterprise Risk Management Department and overseen by the Audit Committee of the Board; (ii) cybersecurity risk and threat assessments; (iii) vulnerability management programs designed to identify hardware and software vulnerabilities; (iv) variety of tools designed to monitor our networks and systems for suspicious activity; and (v) incident response plans and trainings. The Enterprise Risk Management Program includes a cybersecurity risk management process and a formal Information Security Management System ("ISMS") as foundational components of the program covering cybersecurity. Within this process, we routinely assess risks that could affect the organization's ability to meet its business objectives and provide reliable services to our customers. nCino's Chief Information Security Officer ("CISO") is responsible for identifying, assessing, and managing material cybersecurity risks. nCino's CISO brings over 25 years of experience in security and risk management to the Company, reporting to executive leadership, cybersecurity-focused committees, and nCino's Board of Directors.


text: nCino conducts annual cybersecurity risk and threat assessments which include detailed control analyses for measuring both inherent and residual risk factors. These assessments are performed by nCino Information Security as part of ISO 27001 ISMS requirements, framework and certification. Our annual risk assessment, aligned to ISO 27001 and National Institute of Standards and Technology ("NIST"), is the basis for security risk identification, with additional assessments to address risks that threaten the achievement of established control objectives. Threats to security, confidentiality, and availability are identified and assessed as part of our annual and routine risk assessments. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A of this Annual Report on Form 10-K, "Risk Factors."


text: nCino's CISO reports cyber security risk assessment results at the Enterprise Risk Management Committee, Information Security, and Board and Audit Committee Meetings. nCino uses formal and informal education and training efforts to identify and mitigate cybersecurity risk, which includes external collaboration with peers and industry groups. nCino maintains a documented process for when and by whom senior management is informed of a cybersecurity incident and when such information will be reported to affected parties. These processes are detailed within our Incident Response Plan which is regularly reviewed and updated by the information security team.


text: We maintain an information security and cybersecurity program, as well as a cybersecurity governance framework, which are designed to protect our information systems against operational risks related to cybersecurity.

companyName: Expion360 Inc.

ticker: XPON


text: Risk Management and Strategy recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats which include, among other things, operational risks, intellectual property theft, fraud or extortion, harm to employees or customers, violation of privacy or security laws and related litigation and legal risk, and reputational risks.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, and detect and contain any cybersecurity incidents that impact us. We regularly engage with third-party consultants in connection with our cybersecurity risk management program, which is overseen by our Chief Operating Officer.


text: The program is integrated into our overall risk management systems and processes, and includes a cybersecurity risk assessment process that routinely evaluates potential impacts of cybersecurity risks on our business, including our operations, financial stability, and reputation. These assessments inform our cybersecurity risk mitigation strategies. The results are regularly shared with management and the Audit Committee of our Board as part of the committee's involvement in managing and overseeing cybersecurity risks.


text: Our cybersecurity risk management program also includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: If a cybersecurity incident is determined to be a potentially material cybersecurity incident, our disclosure controls and procedures define the steps to determine materiality and disclose such a material cybersecurity incident.


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive and, similar to other global financial institutions, we, as well as our employees, customers, regulators, service providers, and other third parties have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber attacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. For more information on risks to us from cybersecurity threats, see the section entitled " Risk Factors — If our electronic data is compromised, or we experience a failure in our information technology or storage systems, our business could be significantly harmed. " included within this Annual Report.


text: Board is actively involved in overseeing risks from cybersecurity threats. At least once a year, our Board discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of our business strategy. Our Audit Committee has the authority to oversee and review the adequacy of our cybersecurity, information and technology security, and data privacy programs, procedures, and policies.


text: Audit Committee regularly receives updates from management with respect to our efforts to manage data protection, cybersecurity, and information and technology risks, and assesses the results of reviews from internal audits. Materials presented to our Audit Committee include updates on our data security posture, results from internal audit and third-party assessments, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Audit Committee also regularly engages with Management on technology risk-related topics.


text: Our processes also allow for our Board and the Audit Committee to be informed of key cybersecurity risks outside the regular reporting schedule.


text: While regular meetings of the Audit Committee are scheduled on a quarterly cadence, the Audit Committee is authorized to meet with management or individual directors at any time it deems appropriate to discuss matters relevant to the committee. Our policy is for the Board and the Audit Committee to receive prompt and timely information regarding any cybersecurity risk (including any incident) that meets reporting thresholds, as well as ongoing updates regarding any such risk.


text: Our information systems consist of computer systems used by the Company's Chief Executive Officer and chief financial officer. They actively monitor our threat environment for cybersecurity threats using various methods, including automated detection tools, scans of the threat environment, investigations of potential threats they discover or that are reported to them, and reports and services that identify threats. They monitor our information systems for vulnerabilities using internal and third-party penetration testing, intelligence feeds, and vulnerability databases.

companyName: CAPSTONE COMPANIES, INC.

ticker: CAPC


text: Company's computer systems involve the use of third-party technology or service providers, or vendors, such as hosting platforms, open-source software, and application providers. Employees are provided specific guidance to mitigate the risk of a cybersecurity attack. This guidance includes safeguards over confidential data, being aware of suspicious emails, choosing passwords, protection of Company issued and use of personal devices, managing large data transfers. Employees are directed to immediately contact the Chief Executive Officer if they encounter any suspicious activity.


text: If a cybersecurity risk is identified, Company's policy is to use vendors to assist the Company to identify, assess, and manage material risks from cybersecurity threats to corporate systems, which consulting firms may include consulting firms, external legal counsel, incident response vendors, auditors, monitoring technology, and cybersecurity data providers.


text: The Company's Chief Executive Officer is tasked with reporting on cybersecurity measures and issues to the entire board of directors. In the event of a cybersecurity incident, Company policy is for the Company Chief Executive Officer to report the cybersecurity incident to the Company's board of directors and take remedial actions to mitigate and remediate cybersecurity incidents.


text: As of and for the year ended December 31, 2023, there have been no cybersecurity incidents that have materially affected the Company's business strategy, results of operations, or financial condition.


text: In the normal course of business, we may collect and store personal information and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, patient information, sensitive third-party information and employee information. To protect this information, our existing cybersecurity policies require continuous monitoring and detection programs, network security precautions, encryption of critical data and in-depth security assessments of vendors. We maintain various protections designed to safeguard against cyberattacks, including firewalls and virus detection software. Our information technology (" IT ") team (In-house and outside consultants) s responsible for these ongoing monitoring and detection activities.

companyName: Kaya Holdings, Inc.

ticker: KAYS


text: The governance of our cybersecurity risks involves active and informed participation from our management team, our IT team and our board of directors. This oversight includes briefings by our IT team on the nature of the risks we face and the steps we are taking to mitigate these risks, as well as immediately reporting any significant cybersecurity incident that occurs to management and the board of directors.


text: We have not experienced a cybersecurity incident that had a material impact on our business strategy, results of operations, or financial condition. We continue to monitor potential cybersecurity threats and incorporate findings into our risk management strategies.


text: We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats, including by engaging a third-party cybersecurity service provider, which communicates directly with our management and compliance personnel. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities.

companyName: Clean Vision Corp

ticker: CLNV


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Board of Directors oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Management reports to our Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: One of the key functions of our Board of Directors is informed oversight of our various processes for managing risk. An overall review of risk is inherent in our Board of Directors ongoing consideration of our long-term strategies, transactions and other matters presented to and discussed by the Board of Directors. This includes a discussion of the likelihood and potential magnitude of various risks, including cybersecurity risks, and any actions management has taken to limit, monitor or control those risks.


text: Management and Strategy Our information systems consist of computer systems used by the Company's Chief Executive Officer and Chief Financial Officer. They actively monitor our threat environment for cybersecurity threats using various methods, including automated detection tools, scans of the threat environment, investigations of potential threats they discover or that are reported to them, and reports and services that identify threats. They monitor our information systems for vulnerabilities using internal and third-party penetration testing, intelligence feeds, and vulnerability databases.


text: Company's Chairman of the Board of Directors is tasked with reporting on cybersecurity measures and issues to the entire board of directors. In the event of a cybersecurity incident, Company policy is for the Company Chairman of the Board of Directors to report the cybersecurity incident to the Company's Board of Directors and take remedial actions to mitigate and remediate cybersecurity incidents.


text: As of and for the year ended December 31, 2024, there have been no cybersecurity incidents that have materially affected the Company's business strategy, results of operations, or financial condition.


text: We maintain an information security and cybersecurity program, as well as a cybersecurity governance framework, which are designed to protect our information systems against operational risks related to cybersecurity.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats which include, among other things, operational risks, intellectual property theft, fraud or extortion, harm to employees or customers, violation of privacy or security laws and related litigation and legal risk, and reputational risks.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, and detect and contain any cybersecurity incidents that impact us. We regularly engage with third-party consultants in connection with our cybersecurity risk management program, which is overseen by our Chief Operating Officer. The program is integrated into our overall risk management systems and processes, and includes a cybersecurity risk assessment process that routinely evaluates potential impacts of cybersecurity risks on our business, including our operations, financial stability, and reputation. The Audit Committee also reviews with management the implementation and effectiveness of the Company's controls to monitor and mitigate cybersecurity risks.


text: Our cybersecurity risk management program also includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. If a cybersecurity incident is determined to be a potentially material cybersecurity incident, our disclosure controls and procedures define the steps to determine materiality and disclose such a material cybersecurity incident.


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive and, similar to other global financial institutions, we, as well as our employees, customers, regulators, service providers, and other third parties have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber attacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. For more information on risks to us from cybersecurity threats, see the section titled " Risk Factors—If our electronic data is compromised, or we experience a failure in our information technology or storage systems, our business could be significantly harmed " included within this Annual Report.


text: Our Board is actively involved in overseeing risks from cybersecurity threats. At least once a year, our Board discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of our business strategy. Our Audit Committee has the authority to oversee and review the adequacy of our cybersecurity, information and technology security, and data privacy programs, procedures, and policies.


text: The Audit Committee regularly receives updates from management with respect to our efforts to manage data protection, cybersecurity, and information and technology risks, and assesses the results of reviews from internal audits. Materials presented to our Audit Committee include updates on our data security posture, results from internal audit and third-party assessments, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Audit Committee also regularly engages with Management on technology risk-related topics.


text: Our processes also allow for our Board and the Audit Committee to be informed of key cybersecurity risks outside the regular reporting schedule. While regular meetings of the Audit Committee are scheduled on a quarterly cadence, the Audit Committee is authorized to meet with management or individual directors at any time it deems appropriate to discuss matters relevant to the committee. Our policy is for the Board and the Audit Committee to receive prompt and timely information regarding any significant cybersecurity incidents, as well as ongoing updates regarding any such incidents.


text: Our Board of Directors oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Management reports to our Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: In the normal course of business, we may collect and store personal information and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, patient information, sensitive third-party information and employee information. To protect this information, our existing cybersecurity policies require continuous monitoring and detection programs, network security precautions, encryption of critical data and in-depth security assessments of vendors. We maintain various protections designed to safeguard against cyberattacks, including firewalls and virus detection software. Our information technology (" IT ") team (In-house and outside consultants) s responsible for these ongoing monitoring and detection activities.


text: The governance of our cybersecurity risks involves active and informed participation from our management team, our IT team and our board of directors. This oversight includes briefings by our IT team on the nature of the risks we face and the steps we are taking to mitigate these risks, as well as immediately reporting any significant cybersecurity incident that occurs to management and the board of directors.


text: We have not experienced a cybersecurity incident that had a material impact on our business strategy, results of operations, or financial condition. We continue to monitor potential cybersecurity threats and incorporate findings into our risk management strategies.


text: Company has implemented several measures to protect against cybersecurity threats, while recognizing the importance of continuing to strengthen its overall security framework. Threat Detection & Response: Active monitoring for account takeover attempts and identity-based threats. Detection & Response: Continuous monitoring, detection, and response to potential endpoint threats. Authentication: Enforced across Office 365 accounts, which comprise the majority of the Company's infrastructure. Device Security: Company devices are centrally managed for patching, antivirus, monitoring, and security enforcement. Scanning & Remediation: Regular scanning of systems to identify potential weaknesses, with remediation measures applied to reduce risk.

companyName: Genvor Inc

ticker: GNVR


text: of a Third-Party MSSP: The Company consults with an external Managed Security Services Provider for continuous support, monitoring, and guidance. Security Practices: Baseline controls such as password policies and antivirus software provide foundational protection. a Comprehensive Cybersecurity Framework: Establishing a formal risk assessment process to better identify and manage vulnerabilities. Cybersecurity Governance: Reviewing and formalizing Board-level oversight and considering additional training or expertise at the management level.


text: Board of Directors currently does not have a formal structure for cybersecurity oversight. The Company intends to review and establish appropriate oversight in the near future.


text: Role: Day-to-day cybersecurity responsibilities are managed by our Chief Executive Officer ("CEO"), with the support of an external Managed Security Services Provider. The Company is evaluating options to enhance management's cybersecurity role through additional training or external expertise.


text: While current management and the Board do not have in-depth cybersecurity expertise, the Company is considering educational opportunities and consulting resources to address this gap. from Cybersecurity Threats cybersecurity incidents have materially affected the Company's business strategy, results of operations, or financial condition.


text: However, as with all companies, we remain exposed to the risk of cybersecurity threats. The controls currently in place provide a meaningful level of protection, and the Company is committed to continuing to strengthen its cybersecurity posture as resources allow.


text: We are committed to maintaining effective governance and oversight of cybersecurity risks. Our cybersecurity strategy focuses on implementing effective and efficient mechanisms, controls, technologies, systems and other processes across our global IT networks and systems to assess, identify and manage material risks from potential unauthorized occurrences on or through our IT systems that may result in adverse effects on the confidentiality, integrity or availability of our IT systems and the data residing therein. These processes are designed to promote (i) strong controls across our entire IT ecosystem, (ii) transparency across our IT infrastructure so that our information security team can detect, identify and escalate anomalies for further analysis and action, and (iii) a sound enterprise security architecture with security integrated into each phase of system implementation. We believe that the processes and controls we have established to protect our stakeholders' interests, including with respect to our current regulated products and internal systems, are robust and aligned with applicable cybersecurity regulations and certain identified industry best practices. This includes security by design, regular penetration testing, vulnerability scanning and standardization where possible of cybersecurity architecture principles.

companyName: QuidelOrtho Corp

ticker: QDEL


text: Our cybersecurity risk management is part of our broader enterprise risk management process, which is managed by our internal audit team with oversight from our executive leadership, and ultimately, the Audit Committee and the Board. Supported by a global team of information security professionals, we have in place a variety of tools, processes and services designed to identify the impacts of changing cybersecurity threats within our IT networks and systems and those networks and systems managed by key vendors or third parties. Cybersecurity risks are identified, quantified and mitigated by leveraging detection and preventive technologies, including security monitoring, intrusion detection and prevention systems, routine risk assessments, a vulnerability management infrastructure and a global incident response program. In addition, we also periodically consult with outside advisors and experts to anticipate future trends, such as threats and issues within the healthcare industry as well as updates on key regulatory changes, including evolving cybersecurity policies and mandates from the FDA and the Cybersecurity and Infrastructure Security Agency.


text: We identify and address cybersecurity risks associated with key third-party service providers through security and privacy assessments prior to engaging these third parties, the breadth of which is determined by factors such as the type of data, if any, the third party will have access to, whether the third party will have access to our networks and systems, and whether the third party will provide hardware or software to be used in our products or elsewhere in our organization. Depending on the results of these assessments, we may conduct further assessments prior to or periodically throughout the course of our engagement limit or cease plans to engage the third party, or negotiate specific contractual protections or remediation provisions.


text: We also aim to improve our identity and access management by limiting individuals' access to information only to that which is necessary to conduct their official duties and granting individuals access privileges only to user accounts or processes that are essential to perform their intended functions. Multi-factor authentication and role-based access controls are also core elements of our identity and access management processes. Additionally, we periodically offer training and education to our employees on cyber risks and remind our employees of critical end-user best practices, such as current phishing trends. Information security risk is managed by a cross-functional team, which includes our procurement, compliance, privacy and legal teams, allowing for a holistic view of risks related to the safety and privacy of critical data, such as customer account details, financial data and intellectual property. We aim to secure our data and information throughout their lifecycle – from creation, collection and processing to dissemination, use, storage and disposition.


text: While we have not identified any material cybersecurity threats or incidents during the last fiscal year, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks Relating to Our IT Systems."


text: Oversight of cybersecurity risk involves a three-tiered hierarchy designed to leverage the appropriate level of expertise to assess and manage such risks. This consists of our Chief Information Security Officer ("CISO"), Security Governance Committee ("SGC") and the Audit Committee of the Board. Our CISO is primarily responsible for our global information security program. In this role, the CISO is responsible for the effective operations of information security controls and management of information security and cybersecurity risks across the enterprise, including within our products and operations. The CISO also aligns our information security strategy with our business and technical strategies and integrates, where possible, security initiatives into roadmaps of other functions to promote accountability and awareness. The CISO is also responsible for developing and implementing our information security policies and standards in accordance with applicable global regulatory requirements and facilitating updates to these policies and standards at least annually. Our CISO has 20 years of global information security leadership experience across financial services, legal and medical device industries and over 35 years of broader IT experience.


text: The SGC is comprised of members of our executive leadership team, including the Chief Financial Officer, Chief Operating Officer, General Counsel, Chief Administrative Officer, Chief Information Officer ("CIO") and CISO. The CISO reports to the SGC on a regular basis, and informs the committee of critical risks that could potentially affect our information security and cybersecurity posture, as well as regulatory compliance; the status of key projects designed to evolve our information security programs; and any significant cybersecurity issues, incidents and patterns of events. The SGC has the authority to (i) investigate any matter brought to its attention that may impact our ability to adequately protect our information assets and (ii) to involve its members, the Board, other steering committees, government agencies and law enforcement, as it deems appropriate to respond to and remediate such matters. The CISO provides updates to the SGC during the course of significant cybersecurity incidents and in parallel, response teams partner with our IT and legal teams, law enforcement and others as needed to triage and remediate such incidents. Following such events, we implement changes as appropriate to improve our risk mitigation and remediation capabilities as cyber threats evolve.


text: The Audit Committee of the Board oversees our cybersecurity risk management and strategy and has an oversight role that involves reviewing, establishing policies for, and assessing the efficacy of processes used to evaluate significant risk exposures and the measures management implements to mitigate these risks. The Audit Committee is informed about cybersecurity risks through regular management reports on the performance of internal and/or external cybersecurity audits and assessments and the effectiveness of existing cybersecurity practices. The CIO, CISO, other members of the SGC, and other personnel also periodically update the Audit Committee on material cybersecurity risks, significant cybersecurity incidents, mitigation measures and impacts to the Company. The Board receives updates from management, including the CIO, and the Audit Committee on cybersecurity risks on at least an annual basis.


text: We are committed to maintaining effective governance and oversight of cybersecurity risks. Our cybersecurity strategy focuses on implementing effective and efficient mechanisms, controls, technologies, systems and other processes across our global IT networks and systems to assess, identify and manage material risks from potential unauthorized occurrences on or through our IT systems that may result in adverse effects on the confidentiality, integrity or availability of our IT systems and the data residing therein. These processes are designed to promote (i) robust controls across our IT ecosystem, (ii) transparency across our IT infrastructure so that our information security team can detect, identify and escalate anomalies for further analysis and action, and (iii) a sound enterprise security architecture with security integrated into each phase of system implementation. We believe that the processes and controls we have established to protect our stakeholders' interests, including with respect to our current regulated products and internal systems, are robust and generally aligned with applicable cybersecurity regulations and informed in part by certain industry standards, principles and frameworks, such as those set by the National Institute of Standards and Technology. This includes security by design, regular penetration testing, vulnerability scanning and standardization where possible of cybersecurity architecture principles.


text: Our cybersecurity risk management is part of our broader enterprise risk management process, which is managed by our internal audit team with oversight from our executive leadership, and ultimately, the Audit Committee and the Board. Supported by a global team of information security professionals, we have in place a variety of tools, processes and services designed to identify the impacts of changing cybersecurity threats within our IT networks and systems and those networks and systems managed by key vendors or third parties. Cybersecurity risks are identified, quantified and mitigated by leveraging detection and preventive technologies, including security monitoring, intrusion detection and prevention systems, routine risk assessments, a vulnerability management infrastructure and a global incident response program. In addition, we also periodically consult with outside advisors and experts on security controls of our products and manufacturing sites and to anticipate future trends, such as threats and issues within the healthcare industry as well as updates on key regulatory changes, including evolving cybersecurity policies and mandates from the FDA and the Cybersecurity and Infrastructure Security Agency. Components of our cybersecurity program are also evaluated by third parties such as our customers, external auditors and government agencies.


text: We identify and address cybersecurity risks associated with key third-party service providers through security and privacy assessments prior to engaging these third parties, the breadth of which is determined by factors such as the type of data, if any, the third party will have access to, whether the third party will have access to our networks and systems, and whether the third party will provide hardware or software to be used in our products or elsewhere in our organization. Depending on the results of these assessments, we may conduct further assessments prior to or periodically throughout the course of our engagement, limit or cease plans to engage the third party, or negotiate specific contractual protections or remediation provisions.


text: While we have not identified any cybersecurity threats or incidents that have materially affected us since the beginning of the last fiscal year, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents that could materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks Relating to Our IT Systems."


text: Oversight of cybersecurity risk involves a three-tiered hierarchy designed to leverage the appropriate level of expertise to assess and manage such risks. This consists of our CISO, SGC and the Audit Committee. Our CISO is primarily responsible for our global information security program. In this role, the CISO is responsible for the effective operation of our information security controls and management of information security and cybersecurity risks across the enterprise, including within our products and operations. The CISO also aligns our information security strategy with our business and technical strategies and integrates, where possible, security initiatives into roadmaps of other functions to promote accountability and awareness. The CISO is also responsible for developing and implementing our information security policies and standards in accordance with applicable global regulatory requirements and facilitating updates to these policies and standards at least annually. Our CISO has over 20 years of global information security leadership experience across financial services, legal and medical device industries and over 35 years of broader IT experience.


text: The SGC is comprised of members of our executive leadership team, including the CEO; CFO; Chief Operations Officer; Chief Legal Officer; Vice President, Information Technology; and CISO. The CISO reports to the SGC on a regular basis, and informs the committee of critical risks that could potentially affect our information security and cybersecurity posture, as well as regulatory compliance; the status of key projects designed to evolve our information security programs; and any significant cybersecurity issues, incidents and patterns of events. The SGC has the authority to (i) investigate any matter brought to its attention that may impact our ability to adequately protect our information assets and (ii) involve its members, the Board, other steering committees, government agencies and law enforcement, as it deems appropriate, to respond to and remediate such matters. The CISO provides updates to the SGC during the course of significant cybersecurity incidents and in parallel, response teams partner with our IT and legal teams, law enforcement and others as needed to triage and remediate such incidents. Following such events, we implement changes as appropriate to improve our risk mitigation and remediation capabilities as cyber threats evolve.


text: The Audit Committee oversees our cybersecurity risk management and strategy and has an oversight role that involves reviewing, establishing policies for, and assessing the efficacy of processes used to evaluate significant risk exposures and the measures management implements to mitigate these risks. The Audit Committee is informed about cybersecurity risks through regular management reports on the performance of internal and/or external cybersecurity audits and assessments and the effectiveness of existing cybersecurity practices. The Vice President, Information Technology, CISO, additional members of the SGC, and other personnel also annually update the Audit Committee on material cybersecurity risks, significant cybersecurity incidents, mitigation measures and impacts to the Company. The Board receives updates from management, including the Vice President, Information Technology, and the Audit Committee on cybersecurity risks on at least an annual basis.


text: We have implemented policies and procedures to evaluate, identify, and handle material risks associated with cybersecurity threats. These protocols are integrated into a comprehensive risk register dedicated to our cloud-based platform and internal systems access. The register undergoes an annual review conducted by the internal information technology (IT) department, overseeing cybersecurity protection for our on-premises systems, and the DevOps department, responsible for cybersecurity protection in the cloud. We also conduct regular risk assessments to identify threats to our information security systems. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. We assess the risks facing the Company after our controls are accounted for, and then determine mitigation measures for each such risk. Our risk management processes also assess third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners.

companyName: D-Wave Quantum Inc.

ticker: QBTS


text: Following these risk assessments, we re-examine our systems and processes to ensure that reasonable safeguards are in place to minimize identified risks and address any issues that arise. The head of our IT department, who reports to our Chief Financial Officer, works with management to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels receive regular mandatory training on our cybersecurity policies and practices.


text: We enlist third-party service providers to support us in conducting information security reviews of our infrastructure, and the evaluation of our company policies. These providers furnish comprehensive reports that delineate potential risks, categorized by criticality and associated level of effort. Subsequently, the Company will undertake a meticulous examination of the internal risk register to potentially recalibrate the likelihood of identified risks, taking into consideration the vulnerabilities unearthed by the third-party assessment. Depending on the type of services required, the sensitivity of the relevant IT systems and data, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: Upon identifying vulnerabilities, we commit to addressing them promptly, prioritizing based on their criticality. High-priority remediation efforts will be coordinated with the collaboration of Enterprise IT and DevOps teams to ensure swift and effective resolution. While the Company's LeapTM quantum cloud system holds SOC 2 Type 2 compliance, it's noteworthy that the correlation extends to all our IT systems, even though they are not explicitly within the defined scope. As a result, these interconnected IT systems align with SOC 2 Type 2 standards. Similarly, our policies regarding cybersecurity and IT systems are relevant for SOC 2 Type 2 compliance, but also apply to everyone in the entire organization.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. Specifically, the board of directors' audit committee, is responsible for overseeing management's risk assessment and risk management policies, which include management of cybersecurity risk management processes.


text: Our Chief Financial Officer and the head of our IT department are primarily responsible for managing our cybersecurity risks, mitigation strategies and responses to any such issues that may arise. Our Chief Financial Officer oversees the Company's IT department and has extensive experience in managing IT organizations and securing cybersecurity insurance coverages. The head of our IT department drives our strategic IT initiatives and cybersecurity risks assessments, drawing upon over two decades of enterprise technology management expertise.


text: Our Chief Financial Officer and the head of our IT department oversee our cybersecurity policies and processes, including those described above. The Company's overall risks and assessments are monitored by a cross functional team composed of members of senior management, security, legal, information technology and financial reporting. A partnership exists between these aforementioned individuals and departments so that identified issues are addressed in a timely manner and incidents are escalated to the appropriate parties as required.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels receive regular mandatory training on our cybersecurity policies and practices, no less than once per quarter. Key safeguards include, but are not limited to, access controls, authentication, third-party security obligations, and other technical and organizational measures. In addition, the Company maintains policies and procedures for backups, business continuity, and disaster recovery, and regularly tests its policies and procedures to ensure they allow for timely recovery and restoration of backups and the availability of critical resources..


text: We enlist third-party service providers to support us in conducting information security reviews of our infrastructure, and the evaluation of our company policies. These providers undertake comprehensive evaluations that delineate potential risks, categorized by criticality and associated level of effort. Subsequently, the Company will undertake a meticulous examination of the internal risk register to potentially recalibrate the likelihood of identified risks, taking into consideration the vulnerabilities unearthed by the third-party assessment.


text: Depending on the type of services required, the sensitivity of the relevant IT systems and data, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. The Company conducts due diligence prior to engaging a vendor to provide services and requires the vendor to contractually commit to appropriate data protection measures, depending on the nature of the services provided. As part of the software request and vendor evaluation process, we ensure there is a secure method for transmitting data. This includes verifying that encryption is in place both in transit and at rest. Additionally, we require vendors to provide a SOC 2 Type 2 report, which we review to confirm that security controls have been audited and validated. These measures help ensure that third-party vendors maintain appropriate safeguards for handling and sharing confidential information.


text: We have not currently identified any cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Form 10-K.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. While the board of directors' audit committee is responsible for overseeing management's risk assessment and risk management policies generally, to enhance oversight and governance in this area, the board of directors has recently established a standing committee (the "Cybersecurity Committee"), that will advise on cybersecurity matters and provide strategic guidance and direction for our cybersecurity program. The Cybersecurity Committee will convene as necessary to address critical or emerging cybersecurity concerns and to ensure alignment on approach. In the event of an incident, the Company has developed an incident response plan, which sets forth the steps to be followed from incident detection and assessment to mitigation, recovery and notification and reporting, including notifying functional areas (e.g. legal), as well as senior leadership and the Board, as appropriate.


text: Our Chief Financial Officer and the head of our IT department, both of whom are primarily responsible for managing our cybersecurity risks, mitigation strategies and responses to any such issues that may arise, collaborate with the Cybersecurity Committee and report to the entire Board on a quarterly basis, or more frequently as needed. Our Chief Financial Officer oversees the Company's IT department and has extensive experience in managing IT organizations and securing cybersecurity insurance coverages, which we currently maintain. The head of our IT department drives our strategic IT initiatives and cybersecurity risks assessments, drawing upon over two decades of enterprise technology management expertise.


text: Our Chief Financial Officer and the head of our IT department oversee our cybersecurity policies and processes, including those described above. The Company's overall risks and assessments are monitored by a cross functional team composed of members of senior management, security, legal, information technology and financial reporting, which evaluates risks associated with assets such as infrastructure, software, people, processes, and data. A partnership exists between these aforementioned individuals and departments so that identified issues are addressed in a timely manner and incidents are escalated to the appropriate parties as required. The Company's incident response plan is tested and adjusted regularly or in response to a particular incident or significant threats where appropriate.


text: The Company's business is highly dependent on the communications and information systems of the Adviser, its affiliates and third-party service providers. The Adviser is an affiliate of TPG Inc. ("TPG"), a leading global alternative asset management firm. We, in conjunction with the Adviser and its affiliates, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. These processes include responses to and assessments of internal and external threats to the security, confidentiality, integrity and availability of the Company's data and systems along with other material risks to its operations, at least annually or whenever there are material changes to our systems or operations. As part of the risk management process, TPG engages outside providers to conduct periodic internal and external penetration testing. TPG has informed us that it uses the National Institute of Standards and Technology (or "NIST") Cybersecurity Framework and the Center for Internet Security (or "CIS") Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity relevant to our business. This does not imply that TPG, its affiliates or we meet any particular technical standards, specifications, or requirements. TPG stores data, including the Company's data, in cloud environments with security that we believe is appropriate for the data involved and has adopted controls around, among other things, vendor risk assessment, access and acceptable use and backup and recovery.

companyName: TPG Twin Brook Capital Income Fund


text: The Company utilizes certain third-party service providers to perform a variety of functions in the operation of its business. TPG has processes to oversee and identify material risks associated with the use of third-party service providers, taking into account the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "Risks Related to our Business and Structure—We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information.", for additional discussion about cybersecurity-related risks.


text: Our Board of Trustees holds oversight responsibility over the Company's strategy and risk management processes employed by the Adviser, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Trustees and through its committees. The Board of Trustees regularly engages in discussions with management regarding the Adviser's risk assessment and risk management policies. In addition, the Audit Committee of our Board of Trustees (the "Audit Committee") oversees the management of systemic risks, including cybersecurity. The Audit Committee is briefed on the Adviser's information security program and cybersecurity risks at least once each year and as needed in connection with any potentially material cybersecurity incidents. The Chief Information Security Officer reports periodically to the Audit Committee, and such report may address overall assessment of the Company's compliance with this and other cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.


text: As an externally managed company, we rely on the Adviser and its affiliates' information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by TPG. TPG has established an Enterprise Risk Committee ("ERC") to manage overall risk across the organization including cybersecurity risks identified by TPG's cybersecurity team; the ERC includes representatives from relevant functions and is led by TPG's Chief Executive Officer. TPG has also established an Operational Risk Committee ("ORC") responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of the Adviser's risk management, control and governance processes is assigned to TPG's Chief Information Security Officer, who periodically reports, among others, potentially material cybersecurity incidents to the ORC and, in coordination with the Chief Information Officer and Head of Operations, reports to the ERC at least annually. The Chief Information Security Officer leads TPG's cybersecurity team, which includes individuals dedicated to incident detection and response. This team is responsible for identifying threats that can impact the organization, including the Company, and designing controls to mitigate vulnerabilities before they are exploited and to detect and neutralize any threats that do materialize. The Chief Information Security Officer and Chief Information Officer each have more than 20 years of experience in their fields. The Chief Information Security Officer and senior members of the cybersecurity team hold industry standard certifications.


text: The Company's business is highly dependent on the communications and information systems of the Adviser, its affiliates and third-party service providers. The Adviser is an affiliate of TPG Inc. ("TPG"), a leading global alternative asset management firm. We, in conjunction with the Adviser and its affiliates, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. These processes include assessments of internal and external threats to the confidentiality, integrity and availability of the Company's data and systems along with other material risks to its operations. These risk assessments inform our cybersecurity program and the continued development of a layered set of controls aimed at preventing, detecting, and responding to threats. TPG's administrative, organizational, technical and physical security controls include, but are not limited to, policies and procedures, system hardening vulnerability scanning, and patching, employee training and awareness, third-party risk management processes, backup and recovery processes, access controls, data encryption in transit and at rest, network perimeter controls, and identity verification. TPG also has policies and controls in place designed to detect and respond to cybersecurity events, including an incident response plan, an incident response team with dedicated roles and responsibilities for assessing and responding to a cybersecurity event, system logging and ongoing monitoring, and periodic training exercises simulating cybersecurity events that are designed to raise awareness and test the team's response readiness capabilities.


text: The nature, scope and effectiveness of these controls are regularly reviewed through a series of internal and external processes. TPG's cybersecurity team itself performs both automated monitoring on a continuous basis and manual reviews of key controls. TPG has informed us that it also conducts annual assessments of our cybersecurity program using industry standard cybersecurity frameworks, such as the NIST Cybersecurity Framework, as benchmarks to perform its evaluation. This does not imply that TPG, its affiliates or we fully meet any particular industry standards, specifications, or requirements. In addition, independent reviews of our cybersecurity control effectiveness are conducted by TPG's internal audit team on a periodic basis. We also engage external providers to conduct periodic external assessments, including penetration testing.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "Risks Related to our Business and Structure—We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information. ", for additional discussion about cybersecurity-related risks.


text: As an externally managed company, we rely on the Adviser and its affiliates' information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by TPG. TPG has established an Enterprise Risk Committee ("ERC") to manage overall risk across the organization including cybersecurity risks identified by TPG's cybersecurity team; the ERC includes representatives from relevant functions and is led by TPG's Chief Executive Officer. TPG has also established an Operational Risk Committee ("ORC") which is responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of the Adviser's risk management, control and governance processes is assigned to TPG's Chief Information Security Officer ("CISO"), who periodically reports, among other things, potentially material cybersecurity incidents to the ORC and reports to the ERC at least annually. TPG's cybersecurity team also regularly coordinates with other key stakeholders within the organization, including compliance, human resources, internal audit and legal. The CISO leads TPG's cybersecurity team, which is responsible for implementing, maintaining and enforcing our cybersecurity program. TPG's CISO previously held various leadership roles within the Technology Risk department of one of the world's largest banking institutions over a 17-year period. TPG has informed us that the CISO holds a Bachelor of Science in Electrical Engineering and Mathematics from the University of Texas at Arlington and is a Certified Information Systems Security Professional (CISSP). TPG's cybersecurity team possesses a variety of cybersecurity skill sets and extensive expertise obtained through decades of experience, numerous industry certifications, and advanced degrees. TPG's cybersecurity team continues to take steps to maintain up-to-date knowledge of evolving cybersecurity threats and countermeasures.


text: Assessment, Identification and Management of Material Risks from Cybersecurity We rely on the cybersecurity strategy and policies implemented by Sculptor, our sponsor and an affiliate of the Adviser. Sculptor's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Sculptor's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Sculptor has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: Sculptor Diversified Real Estate Income Trust, Inc.


text: Sculptor's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help Sculptor prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us, our Adviser or Sculptor. Sculptor's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us, our Adviser or Sculptor, is integrated into Sculptor's risk management program. In addition, Sculptor periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs and responding to incidents.


text: Sculptor's cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness training, including for all of the employees of Sculptor. Sculptor undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of Sculptor's and our critical third-party vendors and other partners. Sculptor also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.


text: In the event of a cybersecurity incident impacting us, our Adviser or Sculptor, Sculptor has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational functions of Sculptor, including coordinating with the relevant members of our Adviser. The incident response plan includes notification to the applicable members of cybersecurity leadership, and, as appropriate, escalation to the full Sculptor risk management team and/or an internal ad-hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on their nature, incidents may also be reported to the audit committee of our board of directors and to our full board of directors, if appropriate.


text: Oversight of Cybersecurity Risks Our board of directors and audit committee have primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Certain members of the Sculptor cybersecurity team periodically report to our audit committee as well as our full board of directors, as appropriate, on cybersecurity matters. Such reporting includes updates on Sculptor's cybersecurity program as it impacts us, the external threat environment, and Sculptor's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our and Sculptor's preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.


text: Material Impact of Cybersecurity Risks As of the date of this filing, we have not experienced a material information security breach incident and the expenses we have incurred from information security incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors-Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and/or damage to our business relationships."


text: We are focusing on cybersecurity risk, particularly as our operations become increasingly dependent on digital technologies for controlling our plants and pipelines, processing transactions and summarizing and reporting results of operations. Globally, as cybersecurity incidents are occurring more often and using increasingly sophisticated methods, we are at risk for interruptions, outages and breaches of operational systems, including business, financial, accounting, product development, data processing or manufacturing processes, owned by us or our third-party vendors or suppliers, or data that we process or that our third-party service providers process on our behalf. Any such cyber incidents have the potential to materially disrupt or shut down operational systems; result in loss of, unauthorized access to, or copying or transfer of intellectual property assets, trade secrets or other proprietary or competitively sensitive information; compromise certain information of customers, employees, suppliers or others; and/or jeopardize the security of our facilities. We collect and store sensitive data in the ordinary course of our business, including certain personally identifiable information and proprietary business information for our business and our customers, suppliers, contractors, investors and other stakeholders. We also work with third-party service providers that may in the course of their business relationship with us collect, store, process and transmit such data on our behalf.

companyName: HF Sinclair Corp

ticker: DINO


text: As further described in Item 1A. "Risk Factors – Risks Related to Cybersecurity, Data Security, and Privacy, Information Technology and Intellectual Property," the Department of Homeland Security's Transportation Safety Administration has issued a series of security directives that require us to take a number of actions, including among other things, to appoint personnel, report confirmed and potential cybersecurity incidents to the DHS Cybersecurity and Infrastructure Security Agency and provide vulnerability assessments. We have adopted a cybersecurity program, which uses technology and processes designed to help mitigate cybersecurity risks, with our information technology ("IT") and operational technology ("OT") teams working together to protect, identify, detect, mitigate and respond to potential cybersecurity incidents that threaten our Company.


text: We have made efforts to implement the National Institute of Standards and Technology (NIST) Cybersecurity Framework as well as supplemental guidance for information and operational technologies. We seek to follow federal and state statutory and regulatory guidance and have adopted internal policies and standards designed to align with these requirements.


text: We regularly engage independent third-party security consultants to help assess and monitor our IT and OT environments for vulnerabilities, to conduct penetration testing and to recommend mitigation strategies. In addition, we use third-party tools for vulnerability scans to identify external and internal risks. Our cybersecurity program includes a process for overseeing and identifying cybersecurity risks associated with our third-party service providers.


text: Each employee's and contractor's ability to recognize and report cybersecurity threats is an important component of our cybersecurity program. On an annual basis, all Company employees are required to complete cybersecurity training. In addition, we regularly utilize employee exercises and communications designed to reinforce key cybersecurity training messages.


text: The above cybersecurity risk management processes are integrated into our overall risk management program. In addition to our efforts to continually evaluate our cybersecurity program and cybersecurity risks based upon emerging threats as a part of our risk management processes, cybersecurity risks to the Company are evaluated periodically through internal audits and annually by independent consultants, and we seek to incorporate learnings into our overall risk matrices.


text: We continue to make investments in new cybersecurity technologies to protect our facilities, users, and stakeholders, and to protect the personally identifiable information we maintain.