text: We use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations (CROs), contract manufacturing organizations (CMOs), cloud hosting and other SaaS providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, we take various measures designed to help manage risk associated with our use of certain of these providers. These measures include, for example, obtaining confirmation of certain cybersecurity certifications, information security questionnaires, and imposition of certain contractual obligations.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including If our information technology systems or sensitive information, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, and other adverse consequences.

companyName: DBV Technologies S.A.

ticker: DBVT

secItem: Item 1C


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including Cyril Guyardeau, our Director of Information Systems Security, who had previously spent 15 years as an IT infrastructure engineer in the healthcare industry, and Cecile Delansorne, our Vice President for Information Systems, who has held similar executive positions overseeing information systems in other pharmaceutical companies for over 7years. Our Vice President for Information Systems reports to our CFO.


text: The Vice President for Information Systems is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Vice President for Information Systems is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management procedures are designed to escalate certain cybersecurity incidents to members of management depending on the impact of the incident, including the CFO, Data Privacy Officer, Company Legal department, and Executive Committee, who work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified.


text: The audit committee may receive periodic reports from our CFO concerning the Company's significant threats and risk, including, if applicable, those related to cybersecurity threats, and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: The Company is externally managed by the Adviser and has no employees or internal information systems. Therefore, we rely on the cybersecurity strategy, expertise and policies provided and implemented by 26North, the indirect parent company of our Adviser and affiliate of our Administrator, as well as other service providers.

companyName: 26North BDC, Inc.


text: Each of the Company, 26North and our industry generally is highly dependent on information systems and technology and as a result, could be prone to cybersecurity threats and attacks. In response, 26North maintains a cybersecurity program that includes policies and controls designed to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated.


text: As part of its overall risk management efforts, 26North has developed and implemented a cybersecurity risk management program (the "RMP") that applies to our business and operations. The RMP is designed to protect the confidentiality, integrity and availability of the critical systems involved in our business and the information stored in those systems. The RMP leverages a combination of standards and best practices from the National Institute of Standards and Technology Cybersecurity Framework, the International Organization for Standardization, and the Center for Internet Security, among others.


text: 26North utilizes technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, including from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. In addition, 26North has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats. Such controls help us and 26North protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.


text: 26North conducts annual cybersecurity awareness training for all employees and conducts quarterly phishing exercises to assess employee cybersecurity recovery tests to simulate a response to a cybersecurity incident, and uses the findings therefrom to improve practices, procedures, and technologies. 26North also assesses the risks from cybersecurity threats that impact our third-party service providers and has established oversight processes to identify and manage cybersecurity risks associated with the products or services we or 26North procure from such suppliers.


text: An independent third-party also assesses and reports on 26North's internal incident response preparedness, adherence to best practices and industry frameworks, and compliance with applicable laws and regulations. The external independent third-party helps identify areas for continued focus and improvement. Finally, 26North carries cyber security insurance that provides a level of financial protection against the potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover or be sufficient to cover all losses or claims that may result from a cybersecurity incident.


text: 26North has also developed an incident response plan that provides guidelines for preparing for, responding to and recovering from cybersecurity incidents, and facilitates coordination across multiple operational functions. The incident response plan includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response plan includes notification to the applicable members of 26North's technology leadership team, including 26North's Chief Financial Officer ("CFO") and Chief Technology Officer ("CTO"), and, as appropriate, escalation to an internal ad-hoc group of senior employees, tasked with helping to manage the cybersecurity incident.


text: Depending on their nature, incidents may also be reported to the Risk Committee (as defined below) or the board of directors of 26North, as well as to our Chief Compliance Officer, the Audit Committee of our Board of Directors and to our full Board of Directors, if appropriate.


text: Since our commencement of operations, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. Past or future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional information about these risks, see "Item 1A. Risk Factors" in this Annual Report.


text: Our Board of Directors has overall responsibility for risk oversight and has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. The leadership team at 26North has delegated oversight of cybersecurity and related risks to a committee (the "Risk Committee"). The Risk Committee is a cross-functional committee that governs and oversees the RMP. The Risk Committee includes members of 26North's senior executive team, including its CFO, CTO, Chief Compliance Officer and senior partners from 26North's legal, operations, finance, investment and strategy teams. The Risk Committee, will, through regular consultation with 26North's internal cybersecurity team assess, discuss, and prioritize the approach to high-level risks, mitigative controls, and ongoing cybersecurity efforts. Further, our Chief Compliance Officer works closely with 26North's CTO to monitor ongoing cybersecurity threats and provide regular updates to our Board of Directors.


text: 26North's CTO regularly updates the full Risk Committee and oversees a team of dedicated professionals responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The CTO has a Bachelor of Science in Computer Engineering from the University of Virginia and 25 years of experience leading technology teams, maintaining IT infrastructure within financial services firms, and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures to mitigate these threats.


text: Cybersecurity risks and data protection are key components of our long-term strategy and enterprise risk management program and are integrated into our overall risk management systems and processes. We maintain processes for assessing, identifying and managing material risks from cybersecurity threats, and we routinely invest in the development and implementation of essential cybersecurity systems, infrastructures and processes to protect the security and integrity of our systems, networks, databases and proprietary information. Key areas of our cybersecurity risk management processes and strategy currently include:

companyName: MAGNACHIP SEMICONDUCTOR Corp

ticker: MX


text: Compliance with industry standards and regulatory frameworks : Our information security management system is ISO 27001 certified. In addition, we align our standards to comply with South Korea's industrial technology protection law (Act on Prevention of Divulgence and Protection of Industrial Technology), which prevents technologies vital to South Korean national security or economic competitiveness from being divulged to or shared with foreign countries or corporations without the government's approval.


text: Ongoing Evaluation and Assessment of Systems and Procedure : We monitor compliance with regulatory, industry and evolving data privacy requirements and update our cybersecurity risk management program from time to time as appropriate. We also continuously monitor our information security systems and processes on an ongoing basis to identify and remediate cybersecurity threats and vulnerabilities that could be exploited to adversely impact our business operations. To better preemptively identify risks and vulnerabilities in our security systems, we perform penetration testing for security controls using external third-party tools and encourage vulnerability reporting within our organization,


text: Cross-Collaboration and Coordination : Cybersecurity risks related to our business, privacy and compliance issues are identified and managed through a multifaceted approach, including third-party monitoring, internal and external IT security audits and reviews by relevant committees.


text: Third-Party Service Providers : We engage leading third-party product and service providers to assist us with our cybersecurity risk management. We use an Information Prevention and Data Loss Prevention System on networks and endpoints, which is designed to prevent unauthorized access to or transfer of sensitive data. We also use centrally managed antivirus systems for blocking illegal software to detect and remove malware and illegal software from devices in real time. In particular, we use a Managed Security Service provider for Security Information and Event Management services for matters such as firewall management, intrusion detection and prevention, vulnerability management and incident response.


text: Cyber Incident Response Plan : We maintain a comprehensive cyber incident response plan that sets forth the applicable processes, roles, engagements, escalations and notifications to promptly respond to a cybersecurity incident. This plan covers steps to be taken upon the detection of a cybersecurity incident detection, review by relevant committees, identification of damages, recovery process, post-incident analysis and the introduction of improvement measures. Such incident responses are managed in a timely manner by a dedicated team and overseen by relevant organizations, including IT, finance, legal and compliance.


text: Security Awareness Training for Personnel : We provide comprehensive employee training on cybersecurity awareness, confidential information protection and simulated phishing attacks.


text: Review of Third-Party Risks : We routinely conduct risk and compliance assessments of third-party service providers prior to exchanging any sensitive data or integrating with any key third-party provider.


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats, including any previous cybersecurity incidents, that have materially affected the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats (including any previous cybersecurity incidents) that could be reasonably likely to materially affect us, please refer to our Risk Factors discussion under the heading 'We may be subject to disruptions, breaches or cyber-attacks of our secured networks and information technology systems that could damage our reputation, harm our business, expose us to liability and materially adversely affect our results of operations' in Item 1A of this Annual Report on Form 10-K.


text: In line with our overall risk management governance structure, management is responsible for the day-to-day management of cybersecurity risks while the Company's Board of Directors and its Risk Committee actively and continuously provide oversight.


text: Our Risk Committee oversees the Company's management of key risks including those arising from cybersecurity threats. Our management team reports to the Risk Committee on a quarterly basis, presenting their assessment of key enterprise risks, including cybersecurity. The topics include trends in cyber threats and the initiatives designed to strengthen our security systems and enhance the cyber readiness of our organization. Additionally, at least annually, our management team and our Chief Information Security Officer ("CISO") update the members of the Risk Committee and the Board of Directors on existing and new cybersecurity risks, status of risk mitigation efforts, cybersecurity incidents, if any, and the progress of key information security initiatives.


text: In 2020, we established the Information Security Steering Committee (the "IS Steering Committee"), a management-level and cross-functional committee, led by our Chief Executive Officer, and comprised of our Chief Compliance Officer, Chief Financial Officer, CISO, Chief Privacy Officer and relevant teams including Information Security, HR, Compliance & Internal Audit and Legal. The IS Steering Committee holds quarterly meetings, during which they review and take action on a wide range of topics, including cybersecurity threat matters such as prevention monitoring, detection mitigation and remediation of cybersecurity incidents.


text: Our CISO leads a dedicated Information Security team in charge of cybersecurity matters. Collectively, the members of our Information Security team have over 35 years of relevant experience in various roles involving information technology, information security, compliance and systems. Also, our Information Security team oversees compliance with our cybersecurity framework, facilitates cybersecurity risk management activities, assists with the review and approval of policies, and oversees the security awareness program. At least annually, our Information Security team and CISO update the members of the Risk Committee and the Board of Directors on compliance and risk matters. The Information Security team also reports to the IS Steering Committee on a quarterly basis. We invest in ongoing cybersecurity training for our Information Security team.


text: The Company's management, including the Company's Chief Compliance Officer and the investment manager's Global Chief Information Security Officer, are responsible for conducting a regulatory risk assessment which includes cybersecurity threats. Members of Company management possess relevant experience in various disciplines that are important to effectively managing cybersecurity related risks including Security Operations, Vulnerability Management, Network Security, Application and Cloud Security, and cybersecurity risk management. Management of the Company and the investment manager maintain compliance programs which include policies and procedures that are reasonably designed to address regulatory risks related to cybersecurity. The compliance programs include controls to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents impacting the Company; in addition to the compliance programs, a vendor oversight program is leveraged to monitor risks associated with relevant service providers including cybersecurity.

companyName: PIMCO Capital Solutions BDC Corp.


text: The Adviser has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and internal auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Adviser's risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: The Board provides oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Global Chief Information Security officer or their designee regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's Chief Compliance Officer ("CCO"), is responsible for assessing and managing material risks from cybersecurity threats. Members of Company management possess relevant expertise in various disciplines that are key to effectively managing such risks. Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: As a financial institution, our business depends on the continuous operation of its information and data processing systems and the security of information received from customers, employees and others. We have developed and implemented a cybersecurity program intended to protect the reliability of our critical systems and the confidentiality of nonpublic information.

companyName: California BanCorp


text: Our cybersecurity program is designed to assess, identify and manage the material risks from cybersecurity threats, including threats associated with third-party service providers, such as technology providers and cloud-based platforms. Our program is based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and the guidance of banking and other regulatory agencies. As part of the program, we have adopted a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and facilitates coordination and communication across multiple parts of our organization.


text: Our cybersecurity risk management process is integrated as part of our overall risk management program. Our information security professionals have primary responsibility for overall cybersecurity risk management. Our cybersecurity professionals are led by our Chief Technology Officer, who has over 30 years of experience in the information technology field, including over 20 years of experience focusing solely in the cybersecurity space. Our Chief Technology Officer, works in conjunction with the Compliance Manager, Information Security Manager/Information Security Officer and Enterprise Risk Manager to develop and maintain the cybersecurity program. In addition to our own employees, we engage third parties to provide security products and services as needed, using their technology and expertise to evaluate and enhance its cybersecurity program and to inform employees regarding evolving threats, risks and defensive measures. Generally, these third-party service providers are managed by the Information Security Manager/Officer.


text: We periodically review, test and assess our cybersecurity systems, using both internal resources and third-party service providers with cybersecurity expertise. We periodically (at least once per year) review and test our incident response plan through simulations and assessments.


text: We require periodic cybersecurity training for our employees to learn about data security, how to identify and mitigate potential cybersecurity risks and how to protect our resources and information. Members of the risk management, cybersecurity and technology teams receive specialized training about evolving cybersecurity threats and new risk mitigation and detection technologies.


text: We have developed processes to identify and oversee risks from cybersecurity threats associated with third-party service providers, which includes the Information Security Manager/Officer assisting with and evaluating cybersecurity readiness during vendor selection and onboarding as well as risk-based monitoring of vendors on an ongoing basis.


text: Our Board of Directors and its Audit Committee are responsible for overseeing the cybersecurity program and policies. The Company's management, led by the Chief Technology Officer, is responsible for designing and implementing the program. The Information Security Manager/Officer and Chief Technology Officer regularly report to the Audit Committee regarding management's implementation of the cybersecurity program, cybersecurity risks and threats, assessments of our cybersecurity systems and the planning and status project to strength our information security. Our cybersecurity incident response plan requires that management promptly advise the Audit Committee of any material cybersecurity incident. The Chair of the Audit Committee regularly reports to the Board on cybersecurity risks and other matters reviewed by the Committee. Board members may attend Audit Committee meetings where cybersecurity issues are discussed and have access to the materials for management's Risk and Technology and Enterprise Risk Management Committee meetings.


text: Cybersecurity Incidents Like many financial institutions, we have experienced cyber-based attacks and other attempts to compromise our information systems and we expect that we will continue to experience these attacks and attempts in the future. While we have not identified cybersecurity threats that have materially affected or are reasonably likely to materially affect us, like all financial institutions, we face ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our business, results of operations, or financial condition. See Item 1A – Risk Factors – "Risks Related to Technology—System failure or breaches of our network security, including as a result of cyber-attacks or data security breaches, could subject us to increased operating costs as well as litigation and other liabilities."


text: The Partnership has no directors or executive officers and its affairs are managed by its General Partner. The General Partner is a wholly-owned subsidiary of MSCM. MSCM is ultimately owned by Morgan Stanley. Morgan Stanley, its businesses, the General Partner, the Partnership, and the broader financial services industry face an increasingly complex and evolving threat environment. Morgan Stanley has made and continues to make substantial investments in cybersecurity and fraud prevention technology, and employ experienced talent to lead its Cybersecurity and Information Security organizations and program under the oversight of the Morgan Stanley Board of Directors (the "Board") and the Operations and Technology Committee of the Board (the "BOTC"). See "Risk Factors – The General Partner, the Partnership, the Funds and their respective service providers (including the Advisors) and operations are potentially vulnerable to cyber-security attacks or incidents" for information on risks to the Partnership from cybersecurity threats.

companyName: Ceres Tactical Commodity L.P.


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify and manage risks arising from the cybersecurity threats (the "Cybersecurity Program"). The Cybersecurity Program has been adopted by the General Partner, and applies to its business, as relevant. The Cybersecurity Program helps protect Morgan Stanley's clients, customers, employees, property, products, services and reputation by seeking to preserve the confidentiality, integrity and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of Morgan Stanley's technology systems. Morgan Stanley continually adjusts the Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.


text: Processes for assessing, identifying and managing material risks from cybersecurity threats The Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to Morgan Stanley's network, infrastructure, computing environment and the third parties that Morgan Stanley, and its affiliates rely on. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity, as well as global cybersecurity regulations, and develops improvements to those controls in response to that assessment. The Cybersecurity Program also includes cybersecurity and information security policies, procedures and technologies that are designed to address regulatory requirements and to protect clients', employees' and Morgan Stanley's own data against unauthorized disclosure, modification and misuse. These policies, procedures and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.


text: The threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs the cybersecurity risk assessments and strategy. This information is also provided to an internal forensics team, which develops and implements technologies designed to help detect these cybersecurity threats. Where a potential threat is identified, an incident response team evaluates the potential impact, and coordinates remediation where required. These groups, as well as Morgan Stanley's Operational Risk Department (the "Operational Risk Department"), review external cybersecurity incidents that may be relevant to Morgan Stanley and its affiliates, and the outcomes of these incidents further inform the design of the Cybersecurity Program. In addition, Morgan Stanley maintains a robust global training program on cybersecurity risks and requirements and conducts regular phishing email simulations for its employees and consultants.


text: The cybersecurity processes are designed to help oversee, identify and mitigate risks associated with Morgan Stanley's use of third-party vendors. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors. Prior to engaging third-party vendors to provide services, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity programs to identify the impact of their services on the cybersecurity risks to Morgan Stanley. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or an audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk, are subject to review, challenge and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.


text: The Cybersecurity Program is regularly assessed by Morgan Stanley's Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the Board ("BAC") and the BOTC. Annually, certain elements of the Cybersecurity Program are subject to an audit by an independent consultant, as well as an assessment by a separate, independent third party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by Morgan Stanley's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley Management's role in assessing and managing material risks from cybersecurity threats The Cybersecurity Program is operated and maintained by management, including Morgan Stanley's Chief Information Officer of Cyber, Data, Risk and Resilience ("CIO") and Morgan Stanley's Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks. The General Partner adheres to the Cybersecurity Program's policies and participates in periodic testing. The Cybersecurity Program strategy, which is set by the CISO and overseen by the Head of the Operational Risk Department, is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. The Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact Morgan Stanley and its affiliates, including escalation to senior management and the Board, which are periodically tested through tabletop exercises.


text: The members of management that lead the Cybersecurity Program and strategy have extensive experience in technology, cybersecurity and information security. The CIO has over 30 years of experience in various engineering, IT, operations and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management and information security. The Head of the Operational Risk Department has over 20 years of experience in technology, security and compliance roles, including experience in government security agencies.


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees. These committees include representatives from management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to its policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's non-financial risk committee. The CIO and the Head of the Operational Risk Department report on the status of the Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to Morgan Stanley's non-financial risk committee, the BOTC and the Board, as appropriate.


text: We recognize the importance of assessing, identifying, and managing risk associated with cybersecurity threats. Our external advisor has implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such risks. Our advisor has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. As we are fully externally managed, we are reliant on our external advisor's network and risk management program.

companyName: LUB LIQUIDATING TRUST


text: This cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, and financial risk areas.


text: As we are fully externally managed, we are reliant on our external manager's network and risk management program. Our external advisor has elected to engage third-party managed service providers to maintain its network and to manage the monitoring, detection, mitigation, and prevention of cybersecurity threats. These service providers are responsible for managing our advisor's hosted services, all of the computer and computer-related hardware and software they use, and for managing the backup process. Our manager's primary managed service provider supplies management with monthly updates and activity reports related to network alerts, connectivity issues and help desk tickets.


text: We are subject to risks from cybersecurity threats and incidents. As of December 31, 2023, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition. However, there can be no assurance that the Company will not be materially affected in the future.


text: December 31, 2023 Our Trustees consider cybersecurity risk as part of its risk oversight function. Our Trustees oversee management's implementation of our cybersecurity risk management program. Our Trustees will receive periodic reports from management on our cybersecurity risks as well as updates, as necessary, regarding any significant cybersecurity incidents impacting our advisor's information systems.


companyName: CERES ORION L.P.


companyName: CERES TACTICAL SYSTEMATIC L.P.


companyName: Ceres Classic L.P.


text: In 2023, we were a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. We identified an acquisition transaction candidate in the Fall of 2022, entered into a Business Combination Agreement in December 2022, and consummated the Business Combination on March 4, 2024. Prior to the consummation of the Business Combination, we did not consider that we faced significant cybersecurity risk and did not adopt any formal processes for assessing cybersecurity risk, however, we did maintain certain cybersecurity risk procedures, including utilization of two-factor authentication for accessing the Company's servers which were maintained by a third party IT service provider, and controls for disbursement of funds in the Company's bank account that held the Company's working capital, which included the Company's Chief Financial Officer receiving authorization from either the Company's Chief Executive Officer or Executive Chairman of the Board followed by callback confirmation from the Company's bank in order for funds to be disbursed. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our Offering through the time of the consummation of the Business Combination.

companyName: QT IMAGING HOLDINGS, INC.

ticker: QTI


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking, and accounting systems, use their own information systems and electronic resources. Any of these systems can be compromised, including through the employees, customers, and other individuals who are authorized to use them, and bad actors who use a sophisticated and constantly evolving set of software, tools, and strategies to do so. Moreover, the nature of our business as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue. For additional information see "Item 1A. Risk Factors—Operational Risks."

companyName: Princeton Bancorp, Inc.

ticker: BPRN


text: Accordingly, we have long devoted significant resources to assessing, identifying, and managing risks associated with cybersecurity threats, including: an in-house team dedicated to information and cybersecurity, responsible for conducting regular evaluations of our information systems, existing controls, vulnerabilities, and potential enhancements; tools for continuous monitoring capable of detecting and aiding in the response to cybersecurity threats in real-time;


text: conducting thorough due diligence on our third-party service providers, evaluating their cybersecurity practices, and requiring contractual commitments from them to implement specific cybersecurity measures;


text: collaboration with third-party cybersecurity experts who perform periodic penetration testing, vulnerability assessments, and other procedures to pinpoint potential weaknesses in our systems and processes; and regular cybersecurity training sessions for our staff.


text: This information security program is a key part of our overall risk management system, which is administered by our Information Security Officer. The program includes administrative, technical and physical safeguards to help ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of our businesses and geographic locations.


text: We face a number of cybersecurity risks in connection with our business. From time-to-time, we have identified cybersecurity threats and cybersecurity incidents that require us to make changes to our processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, results of operations, and financial condition.


text: Our management team is responsible for the day-to-day management of risks we face, including our Chief Information Officer ("CIO"). Our CIO has been in the role since May 2021, and has 30 years of experience in technology risk management and cybersecurity, primarily within the financial services sector.


text: In addition, our board of directors is responsible for the oversight of risk management. In that role, our board of directors, with support from our cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, our board of directors receives quarterly reports from our management team regarding cybersecurity risks, and our efforts to prevent, detect, mitigate, and remediate any cybersecurity incidents.


text: The Company, the Advisor and StepStone Group are affiliates of StepStone Group Inc., a Delaware corporation listed on the Nasdaq Stock Market LLC and whose securities are registered with the SEC pursuant to Section 12(b) of the Exchange Act. In general, the Company relies upon the information systems and other enterprise services provided by StepStone Group Inc. and its subsidiaries, including StepStone Group and the Advisor (together, "STEP").

companyName: Stepstone Private Credit Fund LLC


text: STEP maintains a cybersecurity program that is reasonably designed to protect the Company's information, and that of the Company's portfolio companies and investors, against cybersecurity threats that may result in significant adverse effects on the confidentiality, integrity, and availability of the information systems of STEP and its affiliates. Governance.


text: Board of Directors The Board of Directors of StepStone Group Inc. ("STEP Board") oversees STEP's processes for assessing and managing risk. The STEP Board's Audit Committee is responsible for reviewing and discussing STEP's practices with respect to risk assessment and risk management, and risks related to matters, including information technology and cybersecurity. The STEP Board and Audit Committee regularly review the measures implemented by STEP to identify and mitigate risks from cybersecurity threats. As part of such reviews, the STEP Board and Audit Committee receive reports and presentations from those responsible for overseeing STEP's cybersecurity risk management, including the Managing Director, Head of Information Technology ("Head of IT") and STEP's Legal team, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to STEP's peers, industry participants, service providers and other third parties. The Head of IT also periodically presents to the STEP Board and its Audit Committee, including to describe STEP's information security infrastructure and improvements made, and to report on any significant developments in respect to STEP. From time to time, external legal advisers provide education to the STEP Board and/or Audit Committee in respect of information security related developments and to provide training in respect of directors' responsibilities.


text: At the Company level, the Company's Board oversees and monitors enterprise risk management at the Company, including with respect to cybersecurity and information security risk. The Company's Board and disclosure review team are expected to receive periodic reports and updates from the Head of IT, as applicable in the context of risks from cybersecurity threats that may impact the Company. STEP has a framework under which certain cybersecurity incidents are escalated within the Company and STEP and, where appropriate, reported to the Company Board, STEP Board or Audit Committee in a timely manner.


text: STEP has a cybersecurity working group composed of members of the Information Technology (including Information Security), Legal and Compliance departments, including the Head of IT, the Chief Legal Officer of STEP, the Chief Compliance Officer of STEP, and a number of their respective team members. The working group meets regularly to identify and mitigate data protection and cybersecurity risks, implement information security governance mechanisms, discuss developments in information security, and discuss and action any significant cyber incidents relevant to STEP, and its affiliates, including the Company. The working group is expected to escalate matters of significance to STEP's Incident Response Team, ERMC (defined below) and/or the STEP Disclosure Committee, as well as to the Company's disclosure review team, as appropriate.


text: STEP has adopted an Incident Response Plan ("IRP") that applies in the event of a cybersecurity threat or incident, including those that impact the Company, to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate, including stakeholders at the Company, as relevant. In general, STEP's incident response process leverages the NIST framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all STEP personnel and STEP networks and systems, third-party systems and end-user devices, including those of the Advisor and those relied upon by the Company.


text: In addition, STEP has an Enterprise Risk Management Committee ("ERMC") composed of a number of members of senior management from operations across STEP's businesses, legal, compliance, information technology, finance, human resources and internal audit and risk. The ERMC was established to oversee and ensure the efficient and effective management of STEP's enterprise risks. Cybersecurity and significant information security matters are to be brought before the ERMC or certain of its members, and matters of primary significance are to be further escalated and reported to the StepStone Global Executive Committee and the Audit Committee of the STEP Board and the Company's Board, as appropriate.


text: At the management level, the STEP Head of IT, who has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at STEP and elsewhere, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices and reports directly to the President and Co-Chief Operating Officer of STEP. The Head of IT receives reports on cybersecurity threats from his team and external service providers on an ongoing basis and, in conjunction with management, reviews risk management measures implemented by STEP to identify and mitigate data protection and cybersecurity risks, including those applicable to the Company and the Advisor. The Head of IT works closely with the STEP Legal and Compliance departments to oversee compliance with legal, regulatory and contractual security requirements and in developing reports and presentations to the STEP Board and its Audit Committee, as well as to the Company's Board. The Head of IT is responsible for providing regular training to STEP employees, including employees of the Advisor, in respect of information security. Risk Management and Strategy.


text: STEP takes a multifaceted approach to managing risk from cybersecurity threats. STEP's cybersecurity program leverages people, processes, and technology to identify and respond to cybersecurity threats in a timely manner. STEP's information security program, and supporting policies apply to all employees, contractors and vendors servicing the firm, including employees of the Advisor. The program outlines the development, maintenance, and distribution of information security policies and procedures that detail the implementation and maintenance of the information security program and its safeguards, and cover various areas such as information handling, user access management, encryption, data retention and backups, computer and network security and monitoring, physical security, incident reporting and response, service provider oversight, and employee and contractor use of technology. STEP also undergoes annual SOC 1 Type 2 testing of its financial processes and supporting technical controls. In addition to the foregoing, STEP conducts regular employee trainings on cybersecurity, which trainings apply to the Company's officers and employees of the Advisor, and performs phishing exercises to test employees' understanding of how to identify social engineering attacks. STEP performs diligence, including in respect of information security, of vendors and third parties with significant access to confidential information and personal data, and periodically monitors such vendors, including such vendors relied upon by the Company and the Advisor. STEP also employs systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems STEP and its affiliates use. STEP conducts annual penetration testing performed by a rotating group of third-party security firms to test STEP's technical controls and security response. STEP's internal audit team has also conducted a cybersecurity assessment to evaluate STEP's preparedness against potential cyber risks and threats. In addition to its internal cybersecurity capabilities and third-party penetration testing, STEP also, at times, engages consultants or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: Material Cybersecurity Risks, Threats & Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. To date, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition, but the Company faces certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an effect. Additional information on cybersecurity risks the Company faces can be found in Part I, Item 1A "Risk Factors" of this Report under the heading "Cybersecurity risks and cyber incidents could adversely affect our business by causing a disruption to our operations, which could adversely affect our financial condition and results of operations.", which should be read in conjunction with the foregoing information.


text: Since our IPO, our sole business activities have been identifying and evaluating suitable acquisition transaction candidates. We do not operate any enterprise information technology systems of our own and have only a limited number of personnel. Our cybersecurity risk is assessed and managed by our management team, who limit the persons who have authorized access to our online accounts and limit the vendors whose services we utilize to a small number of reputable service providers. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Zapata Quantum, Inc.

ticker: ZPTA


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: CHICAGO RIVET & MACHINE CO

ticker: CVR


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Responsibility for assessing, monitoring and managing our cybersecurity risks rests with third party expert consultants in conjunction with our IT Director, both reporting to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our IT Director and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us with designing and implementing our cybersecurity policies and procedures, as well as monitoring and testing our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: Cyber Risk Management and Strategy We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of the Adviser, AB and other third-party service providers. The Adviser manages our day-to-day operations and has implemented AB's Information Security Program ("ISP") that applies to the Fund and its operations.

companyName: AB Private Credit Investors Corp


text: We rely on the digital technology of AB and the Adviser to conduct our business operations and engage with our clients and business partners. The technology that AB, the Adviser, clients, and business partners rely upon becomes more complex over time as do threats to our business operations from cyber intrusions, denial of service attacks, manipulation and other cyber misconduct. Information Security is an ongoing process of exercising due care that is designed to protect corporate, client and employee information and systems from unauthorized access, destruction, disclosure, disruption and modification of use.


text: Through a combination of security, risk and compliance resources, AB implements information security through a dedicated ISP that is intended to identify, assess and manage material risks from cybersecurity threats applicable to the Fund, and which includes a focus on safeguarding information and assets from cyber threats, engaging in cyber threat monitoring and responding to actual or potential cyber incidents. Our ISP is led by AB's Chief Information Security Officer ("CISO") who actively partners with AB's Chief Compliance Officer and Chief Risk Officer and, in turn, the Fund's Adviser, Board and Chief Compliance Officer. Ultimately, we rely on AB's full enterprise risk framework, which includes the ISP, information technology, business continuity, resiliency and cybersecurity risk, in combination with a broader risk management team, including AB's Chief Security Officer.


text: AB's CISO, with assistance from internal and external resources, is responsible for implementing and providing oversight of the ISP that applies to the Fund. The ISP employs a defense-in-depth strategy: an information assurance concept in which multiple layers of security controls are distributed throughout an operating environment. The concept manages risk with diverse defensive strategies, so that if one layer of defense fails, another layer of defense will attempt to compensate. The ISP features cybersecurity policies, standards and guidelines, committee governance, training, access controls and data controls.


text: The ISP, together with related risk and compliance resources, is designed to proactively manage the risk of threat from cybersecurity incidents through (i) implementing protocols to take cybersecurity considerations into account in adopting and onboarding our technology resources, (ii) monitoring IT controls to better ensure compliance with cybersecurity and other related legal and regulatory requirements, (iii) assessing adherence by critical and material third parties we partner with to ensure that the appropriate risk management standards are met, (iv) ensuring essential business functions remain available during a business disruption, and (v) regularly developing and updating response plans to address potential IT or cyber incidents should they occur. AB's security, risk and compliance resources are designed to prioritize IT and cybersecurity risk areas, identify solutions that minimize such risks, pursue optimal outcomes and maintain compliance standards. We also rely on AB's ISP to maintain an operation security function that has a real time response capability that triages potential incidents and triggers impact mitigation protocols.


text: Additionally, we rely on AB and the Adviser to utilize third parties to conduct periodic cybersecurity assessments, including assessments impacting the Fund, and AB's internal audit function includes certain cyber risk audits as part of any overall risk audit. We rely on AB to review the recommendations and findings from those assessments and audits and implement corrective and other measures as appropriate and as may be relevant to the Fund. AB's cybersecurity processes rely predominantly on internal resources, but also include important third party resources for certain matters, including the aforementioned assessments as well as our continuous cybersecurity threat monitoring and initial incident reporting system.


text: As part of the ISP that is applicable to the Fund, AB also performs cyber risk assessments on the Fund's critical and material third party vendors during onboarding and periodically thereafter.


text: During the reporting period, we have not had a cybersecurity incident that has materially affected, or was reasonably likely to materially affect, the Fund, including our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition, including as discussed in "Item 1A Risk factors – The failure in cyber security systems, as well as the occurrence of events unanticipated in the Fund's disaster recovery systems and management continuity planning could impair its ability to conduct business effectively," although we do not currently believe that such a result is reasonably likely.


text: Cyber Risk Governance The Board provides strategic oversight over the Fund generally and has delegated oversight on cybersecurity matters to the Fund's Audit Committee, including oversight of risks associated with cybersecurity threats. AB's CISO, the Adviser's Chief Compliance Officer and the Fund's Chief Compliance Officer periodically report to the Audit Committee, which in turn reports to the Board on the status of AB's ISP, cybersecurity risks, risk management policies and risk assessment initiatives. Such reports particularly emphasize any material risks concerning the Fund.


text: The Chief Compliance Officer of the Fund oversees the Fund's risk management function generally and relies on the Adviser's Chief Compliance Officer to assist with assessing and managing material risks from cybersecurity threats. The Adviser's Chief Compliance Officer has 12 years of experience in the financial services industry, and during such time has acquired relevant experience overseeing and actively managing cybersecurity and information security programs for financial services companies with complex information systems. The Fund's Chief Compliance Officer has been responsible for the general oversight function as Chief Compliance Officer to the Fund for 3 years and has worked in the financial services industry for 18 years, during which the Fund's Chief Compliance Officer has gained expertise in assessing and managing risk applicable to the Fund.


text: Management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, including through the receipt of notifications from service providers and reliance on communications with ISP personnel of the Adviser and AB.


text: The Trust does not have any material internal operations of its own that face material cybersecurity threats and is not a regulated financial institution subject to mandatory cybersecurity compliance under New York law (including, without limitation, the New York Code, Rules and Regulations), and therefore has not adopted any cybersecurity risk management program or formal processes for assessing or monitoring cybersecurity risk. However, the Trust does depend on the digital technologies of the Corporate Trustee and third parties, including EMI, Sony/ATV and their respective affiliates' information systems, infrastructure and cloud applications and services. Any sophisticated and deliberate attacks on, or security breaches in, the systems, infrastructure or cloud that benefit the Trust, including those of the Corporate Trustee and third parties, could lead to corruption, misappropriation or miscalculation of the gross royalty income arising from the Catalogue (or calculation of the Contingent Portion related thereto) and/or the Trust's assets, proprietary information and sensitive or confidential data. Because of the Trust's reliance on the technologies of the Corporate Trustee and third parties including EMI, Sony/ATV, their respective affiliates, the Trust also depends upon the personnel and the processes of such parties to protect against cybersecurity threats arising from their own operations in the ordinary course of their respective businesses. The Trust does not employ any operating personnel and has not contracted for the development of processes of its own for the purpose of data security protections and as such may not adequately protect against, or investigate and/or remediate any vulnerability to, cyber incidents. To the best knowledge of the Trustees, as of December 31, 2023, risks from cybersecurity threats, including any previous cybersecurity incidents, have not materially affected the Trust, but it is possible that any of these occurrences, or a combination of them, could have material adverse consequences on the Trust, including its results of operations or financial condition.

companyName: MILLS MUSIC TRUST

ticker: MMTRS


text: Cyber Risk Management and Strategy We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of the Investment Manager and other third-party service providers. The Investment Manager manages our day-to-day operations and has implemented the Investment Manager's Information Security Program ("ISP") that applies to the Company and its operations.

companyName: AB Commercial Real Estate Private Debt Fund, LLC


text: We rely on the digital technology of the Investment Manager to conduct our business operations and engage with our clients and business partners. The technology that our Investment Manager, clients, and business partners rely upon becomes more complex over time as do threats to our business operations from cyber intrusions, denial of service attacks, manipulation and other cyber misconduct. Information Security is an ongoing process of exercising due care that is designed to protect corporate, client and employee information and systems from unauthorized access, destruction, disclosure, disruption and modification of use.


text: Through a combination of security, risk and compliance resources, the Investment Manager implements information security through a dedicated ISP that is intended to identify, assess and manage material risks from cybersecurity threats applicable to the Company, and which includes a focus on safeguarding information and assets from cyber threats, engaging in cyber threat monitoring and responding to actual or potential cyber incidents. Our ISP is led by the Investment Manager's Chief Information Security Officer ("CISO") who actively partners with the Investment Manager's Chief Compliance Officer and Chief Risk Officer and, in turn, the Company's Board and Secretary. Ultimately, we rely on the Investment Manager's full enterprise risk framework, which includes the ISP, information technology, business continuity, resiliency and cybersecurity risk, in combination with a broader risk management team, including the Investment Manager's Chief Security Officer.


text: The Investment Manager's CISO, with assistance from internal and external resources, is responsible for implementing and providing oversight of the ISP that applies to the Company. The ISP employs a defense-in-depth strategy: an information assurance concept in which multiple layers of security controls are distributed throughout an operating environment. The concept manages risk with diverse defensive strategies, so that if one layer of defense fails, another layer of defense will attempt to compensate. The ISP features cybersecurity policies, standards and guidelines, committee governance, training, access controls and data controls.


text: The ISP, together with related risk and compliance resources, is designed to proactively manage the risk of threat from cybersecurity incidents through (i) implementing protocols to take cybersecurity considerations into account in adopting and onboarding our technology resources, (ii) monitoring IT controls to better ensure compliance with cybersecurity and other related legal and regulatory requirements, (iii) assessing adherence by critical and material third parties we partner with to ensure that the appropriate risk management standards are met, (iv) ensuring essential business functions remain available during a business disruption, and (v) regularly developing and updating response plans to address potential IT or cyber incidents should they occur. The Investment Manager's security, risk and compliance resources are designed to prioritize IT and cybersecurity risk areas, identify solutions that minimize such risks, pursue optimal outcomes and maintain compliance standards. We also rely on the Investment Manager's ISP to maintain an operation security function that has a real time response capability that triages potential incidents and triggers impact mitigation protocols.


text: Additionally, we rely on the Investment Manager to utilize third parties to conduct periodic cybersecurity assessments, including assessments impacting the Company, and the Investment Manager's internal audit function includes certain cyber risk audits as part of any overall risk audit. We rely on the Investment Manager to review the recommendations and findings from those assessments and audits and implement corrective and other measures as appropriate and as may be relevant to the Company. The Investment Manager's cybersecurity processes rely predominantly on internal resources, but also include important third party resources for certain matters, including the aforementioned assessments as well as our continuous cybersecurity threat monitoring and initial incident reporting system.


text: As part of the ISP that is applicable to the Company, the Investment Manager also performs cyber risk assessments on the Company's critical and material third party vendors during onboarding and periodically thereafter.


text: During the reporting period, we have not had a cybersecurity incident that has materially affected, or was reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition, including as discussed in " Item 1A. Risk factors – A failure in cyber security systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning could impair our ability to conduct business effectively," although we do not currently believe that such a result is reasonably likely.


text: Cyber Risk Governance The Board provides strategic oversight over the Company generally, including oversight of risks associated with cybersecurity threats. The Investment Manager's CISO and the Company's Secretary periodically report to the Board on the status of the Investment Manager's ISP, cybersecurity risks, risk management policies and risk assessment initiatives. Such reports particularly emphasize any material risks concerning the Company.


text: The Secretary of the Company relies on the Investment Manager's Chief Compliance Officer to assist with assessing and managing material risks from cybersecurity threats. The Investment Manager's Chief Compliance Officer has 12 years of experience in the financial services industry, and during such time has acquired relevant experience overseeing and actively managing cybersecurity and information security programs for financial services companies with complex information systems. The Company's Secretary has been responsible for the general oversight function as Secretary to the Company since its inception and has worked in the financial services industry for 10 years.


text: Management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with ISP personnel of the Investment Manager.


text: As a blank check company, we do not have any operations and our sole business activity has been to search for and consummate an initial business combination. However, because we have investments in our Trust Account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, the management team will report to the Board of Directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: TortoiseEcofin Acquisition Corp. III


text: We are a SPAC with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: Global Technology Acquisition Corp. I


text: The Trust does not have a board of directors; therefore, the Trustee is responsible for oversight of the Trust's risks from cybersecurity threats.

companyName: CROSS TIMBERS ROYALTY TRUST

ticker: CRT


text: The Trustee has dedicated personnel that are responsible for assessing and managing the Trust's cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee's information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. External partners are a key part of the Trustee's cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee's overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third-party vendor, of the Trustee's cyber risk management program.


text: Other, non-technical protocols include securing of documents and work areas that could contain personal, non-public information and independent verification of information changes by outside vendors.


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust's business, financial condition, results of operations, or cash flows. See Item 1A. Risk Factors—The Trust may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.


companyName: HUGOTON ROYALTY TRUST

ticker: HGTXU


text: The Trustee has dedicated personnel that are responsible for assessing and managing the Trust's cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee's information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: External partners are a key part of the Trustee's cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust's business, financial condition, results of operations, or cash flows. See Item 1A. Risk Factors – The Trust may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.


text: As an externally managed company, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Operating Manager, an indirect subsidiary of Apollo. Apollo determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for us and other affiliated entities managed by Apollo, and we rely on Apollo for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Apollo Infrastructure Co LLC


text: Apollo's Board of Directors is involved in overseeing Apollo's risk management program, including with respect to cybersecurity, which is a critical component of Apollo's overall approach to enterprise risk management (" ERM "). Apollo's cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas:


text: As discussed further under the heading "Cybersecurity Governance," Apollo's Board of Directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer (" CISO ") and the Chief Information Security Officer of Athene Holding Ltd. (" AHL's CISO "), a subsidiary of Apollo, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, and also receive support, as appropriate, from our executive officers and other representatives of the Operating Manager and its affiliates.


text: Collaborative Approach. Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by Apollo management, in consultation with our management and our Board as applicable, in a timely manner.


text: Technical Safeguards. Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence.


text: Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness. Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.


text: Apollo engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. Apollo regularly engages third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to Apollo's risk management function, and Apollo adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews.


text: To our knowledge, cybersecurity threat risks have not materially affected our company, including our business strategy, results of operations or financial condition.


text: The AGM Board of Directors' oversight of Apollo's cybersecurity risk management is supported by the audit committee of the AGM Board of Directors (the " AGM audit committee "), the AAM Global Risk Committee (" AGRC "), the Operational Risk Forum (the " ORF "), the Cybersecurity Working Group and management. The AGM Board of Directors, the AGM audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from Apollo's risk management professionals, AGM's Chief Security Officer (" CSO "), its CISO, and other members of Apollo's management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from Apollo's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM's board of directors and/or the AGM audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM Board of Directors or the AGM audit committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from Athene's CISO, at least annually.


text: AGM's CSO holds an undergraduate degree in Management Information Systems and Business Administration, which he received magna cum laude. He has over 25 years of cyber-related experience, having served in various roles in technology and cybersecurity, including as Head of IT Risk Management, Executive Director of IT & Risk Compliance, and Global IT Risk Evaluation Lead at large financial institutions and consulting firms. He was also previously AGM's CISO for nearly eight years. AGM's CISO holds a master's degree in Business Information Systems and has served in various roles in information technology and information security for over 25 years across a number of large financial institutions, including as Director, Cybersecurity and Risk.


text: The AGM CISO, in coordination with the Apollo Technology and ERM teams, works collaboratively across Apollo to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of Apollo's cybersecurity risk management program, multidisciplinary teams throughout Apollo are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the AGM audit committee or AGM Board of Directors, as appropriate.


text: As part of the risk management oversight (including oversight of cyber risks) of the Company's Board, the Board will regularly interact with, and receive reports from, management of the Company, the Operating Manager, Apollo, and other service providers. The Company's Board is expected to receive presentations and reports on cybersecurity risks from AGM's CSO or CISO, at least annually, addressing a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Apollo's peers and third parties. Additionally, Apollo and other service providers are expected to periodically report to management as it relates to the Company's cybersecurity practices.


text: Apollo's cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to the Company's management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to the Company, the Operating Manager, and evaluation of the adequacy of the Company's cybersecurity program (as coordinated through the Operating Manager and Apollo), including risk mitigation, compliance and controls.


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face material cybersecurity threats. However, we do depend on the digital technologies of third parties, including information systems, infrastructure and cloud applications and services, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.

companyName: Direct Selling Acquisition Corp.


text: We are a special purpose acquisition company with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any.

companyName: Four Leaf Acquisition Corp

ticker: FORL


text: On April 28, 2023, we identified a payment of $54,300 was incorrectly made to an unauthorized payee as a result of a phishing attack. Our management team, at the direction of the board of directors, investigated the matter and concluded that the phishing attack was an isolated incident perpetrated by an external source. With the assistance of our bank, we were ultimately able to recover all of these funds on June 29, 2023. As a result of this phishing attack, we have implemented additional controls related to vendor verification and additional review procedures of each payment made by several authorized individuals.


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating prospective acquisition candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Target Global Acquisition I Corp.

ticker: TGAAF


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Invest Acquisition Corp


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying, evaluating suitable acquisition transaction candidates and completing the merger with our target acquisition companies. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: AltEnergy Acquisition Corp

ticker: AEAE


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. However, because we have investments in our Trust Account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Investcorp AI Acquisition Corp.

ticker: IVCAF


text: We are a special purpose acquisition company with no business operations. Since the IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not believe that we currently face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since the IPO.

companyName: INTEGRATED RAIL & RESOURCES ACQUISITION CORP


text: We are dedicated to protecting the integrity, confidentiality, and availability of our data, infrastructure and operating systems. As part of our commitment to safeguarding our operations against cybersecurity threats, we employ a comprehensive strategy for the assessment, identification, and management of cybersecurity risks. We engage a third-party CIO consulting firm and a managed services provider, which work together to provide wide-ranging services including risk assessments, threat detection, monitoring and response strategies, security audits and cybersecurity services, tools and training. An enterprise firewall; Implementation of Multi-Factor Authentication (MFA); Adherence to the Zero Trust model; Utilization of Managed Detection and Response (MDR); Endpoint Detection and Response (EDR) technologies;

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: 24x7 Security Operations Center (SOC); and Employment of Security Information and Event Management (SIEM) systems to continuously monitor our network and respond to threats in real time.


text: Risk Assessment Procedures: We conduct periodic risk assessments to identify potential cybersecurity threats and vulnerabilities within our IT infrastructure. These assessments are conducted using various software tools and methodologies that enable us to evaluate our systems critically and comprehensively. Our risk assessment process includes the analysis of: Hardware and software configurations; Network and data access protocols; Encryption standards; and Compliance with relevant industry and regulatory standards.


text: Threat Identification: We utilize advanced threat detection tools and services that continuously monitor our network for signs of unauthorized access, anomalies, and potential breaches. Our third-party cybersecurity provider is equipped with sophisticated detection technologies that help to swiftly identify even the most subtle signs of compromise. We focus on: Real-time monitoring of our networks; Regularly updated intrusion detection systems (IDS);


text: Deployment of endpoint detection and response (EDR) solutions; and Utilization of threat intelligence platforms to stay abreast of emerging threats.


text: Threat Management: Upon identification of a potential threat, our managed service provider's dedicated incident response team takes immediate action to mitigate any adverse impacts. Our threat management procedures include: Immediate isolation of affected systems to prevent the spread of threats; Application of appropriate remediation measures, such as patches and software updates; Conducting a thorough investigation to understand the breach's nature and scope; and Implementing enhancements to prevent future occurrences.


text: Our incident response plan provides a concise strategy of how we will respond to an incident, including who will respond and their roles and responsibilities, the facilities that are in place to help with the management of the incident, how decisions will be taken with regard to our response to an incident, how communication will be handled both internally and externally, and defining what will happen once the incident is resolved and how we can learn and improve from the situation.