text: The general objectives for our cybersecurity program are to protect our information systems from cyber threats and to protect the confidentiality, integrity and availability of systems and information used, owned, or managed by Tradeweb and our customers. This involves a comprehensive and ongoing effort to protect against, detect, and respond to cybersecurity threats and vulnerabilities. Our cybersecurity program includes a number of components, such as: • conducting regular risk assessments to identify potential vulnerabilities and threats; • implementing strong cybersecurity frameworks by adopting policies, standards and guidelines derived from a combination of ISO/IEC 27001 principles, the National Institute of Standards and Technology Cybersecurity Framework and industry best practices; • enforcing strict access control policies as appropriate; • implementing strong encryption protocols; • utilizing advanced threat detection systems; • conducting regular security audits and penetration testing; • conducting thorough security assessment of third-party vendors and service providers on an ongoing basis; and • continuous monitoring of our and third-party systems.


text: As part of our cybersecurity program, we have robust incident response and business continuity plans designed to provide a framework for quick and effective remediation of cyber issues, which are tested periodically throughout the year. Additionally, we have worked to create a culture of security by providing regular cybersecurity training to employees to raise awareness about various cyber threats like phishing, social engineering, and insider threats. We provide additional targeted training to individuals responsible for managing our information systems. We also maintain cyber insurance coverage intended to mitigate certain costs associated with certain cybersecurity events.

companyName: Tradeweb Markets Inc.

ticker: TW

secItem: Item 1C


text: In addition, each year, we undergo System and Organization Controls ("SOC") 1 and SOC 2 audit reviews performed by an independent third-party firm to test our information technology systems internal controls. In 2023, we also engaged a third-party service provider to conduct a cybersecurity maturity assessment of our information security program. We also regularly engage additional assessors, auditors and service providers in connection with the implementation, assessment, enhancement and evaluation of our cybersecurity program, including our risk management processes.


text: We have not been a victim of a cyber-attack or other cybersecurity incident that has had a material impact on us, our business strategy, results of operations or financial condition; however, we have from time to time experienced non-significant cybersecurity events, including attempted denial of service attacks, malware infections, phishing and other information technology events that are typical for an electronic financial services company of our size. An actual, threatened or perceived cyber-attack or breach of our security could materially affect us, including our business strategy, results of operations and financial condition in many ways, including through the loss of clients or client confidence, expenditure of significant costs to repair system, network or infrastructure damages as well as to protect against future cyber-attacks, security breaches or harm and potential litigation or other claims or actions, including from regulatory agencies. For additional information regarding risks related to cybersecurity threats, see Part I, Item 1A. – "Risk Factors — Risks Relating to Cybersecurity and Intellectual Property — Actual or perceived security vulnerabilities in our systems, networks and infrastructure, breaches of security controls, unauthorized access to confidential or personal information or cyber-attacks could harm our business, reputation and results of operations" and "— Systems failures, interruptions, delays in service, catastrophic events and resulting interruptions in the availability of our platforms or solutions could materially harm our business and reputation."


text: Role of our Board of Directors The Board of Directors of Tradeweb Markets Inc. exercises direct oversight of the strategic risks to the Company. The Audit Committee of the Board reviews guidelines and policies governing the process by which senior management assesses and manages our exposure to risk, including our major financial and operational risk exposures including those derived from cybersecurity risk, and the steps management takes to monitor and control such exposures. Our Board and our Audit Committee each receive periodic reports from our Chief Information Security Officer and Chief Risk Officer to assess key cybersecurity risks for the Company and the measures implemented to mitigate them, as well as updates regarding changes to our cybersecurity risk profile or newly identified significant risks. In addition, the Audit Committee reports to the Board on these matters at each regularly scheduled Board meeting. The Board and Audit Committee provide feedback and recommendations accordingly.


text: Role of Management We operate on a "three lines of defense" risk governance model, with partnership and communication across the three lines. The first line of defense is comprised of the business and technology managers, the second line of defense is comprised of the Compliance, Risk and Information Security teams and the third line of defense is comprised of the Internal Audit function. The second and third lines of defense focus on providing the first line of defense with advisory and assurance functions for informed and actionable risk-based decisions. The Enterprise Risk Committee (the "ERC") is chaired by our Chief Risk Officer and includes our President, Chief Technology Officer, General Counsel, Global Head of Enterprise Risk, Chief Information Security Officer, Head of Global Compliance, Global Head of Human Resources, Head of Internal Audit and various global heads of business lines and corporate functions. The ERC is responsible for the governance and oversight of our Risk Framework, which includes cybersecurity risks. Its responsibilities include, supervising risk mitigation strategies and their implementation, overseeing compliance and regulatory aspects, managing crisis, approving risk tolerance, reviewing and approving material policy changes and evaluating the effectiveness of the organization's risk management practices. The ERC regularly obtains reports from the Chief Information Security Officer who maintains the primary responsibility for assessing and managing the cybersecurity risks, to evaluate the principal cybersecurity risks for the Company and review strategies in place to mitigate them. The ERC meets quarterly and reports to senior management, including the Chief Executive Officer and Chief Financial Officer. Senior management provides oversight and support in aligning cyber risk management with the Company's strategic decisions, fostering a culture of risk awareness across the organization and allocating adequate resources to support the initiatives.


text: Our Chief Information Security Officer leads a highly qualified cybersecurity team in assessing, managing and reducing material risks from cybersecurity threats to protect critical operations and delivery of service. Our Chief Information Security Officer has over 25 years of industry experience, with more than a decade of CISO experience at various financial institutions. Many members of the cybersecurity team hold Certified Information Systems Security Professional and Certified Information Systems Auditor certifications. In addition, our Global Head of Enterprise Risk has over a decade of experience managing enterprise risk programs and maintains multiple information security certifications. We also belong to several professional and recognized industry organizations related to cybersecurity, including FS-ISAC, FCA Cyber Coordination Group and SIFMA in order to stay up-to-date on industry-wide trends.


text: As a leader in building and operating electronic marketplaces, we face a broad set of cybersecurity risks stemming from managing complex technology systems, handling sensitive data, and the digital nature of our business. Managing cybersecurity risk is critically important to our business. We have comprehensive cybersecurity risk management and governance systems in place across our global operations designed to support successful operation of our systems.


text: We operate in an environment where cybersecurity risk is dynamic and evolving. We are committed to appropriately managing and minimizing the impact of cybersecurity risk on the achievement of our business objectives. We view cybersecurity risk management as a fundamental business process essential to our overall success. As such, we have integrated our cybersecurity program into our comprehensive Risk Framework, which is in place to support the management and oversight of risk across our organization. The Risk Framework establishes a consistent approach for identifying, assessing, measuring, mitigating, and reporting on material risks, including cybersecurity risks. The Risk Framework is composed of process components such as risk governance, risk identification and assessment, risk measurement, risk response and remediation and risk analysis and reporting.


text: The general objectives for our cybersecurity program are to protect our information systems from cyber threats and to protect the confidentiality, integrity and availability of systems and information used, owned, or managed by Tradeweb and our customers. This involves a comprehensive and ongoing effort to protect against, detect, and respond to cybersecurity threats and vulnerabilities. Our cybersecurity program includes a number of components, such as: • conducting regular risk assessments to identify potential vulnerabilities and threats; • implementing strong cybersecurity frameworks by adopting policies, standards and guidelines derived from a combination of ISO/IEC 27001 principles, the National Institute of Standards and Technology Cybersecurity Framework and industry best practices; • enforcing strict access control policies as appropriate; • implementing strong encryption protocols; • utilizing advanced threat detection systems; • conducting regular security audits and penetration testing; • conducting thorough security assessments of third-party vendors and service providers on an ongoing basis; and • continuous monitoring of our and third-party systems.


text: In addition, each year, we undergo System and Organization Controls ("SOC") 1 and SOC 2 audit reviews performed by an independent third-party firm to test our information technology systems internal controls. We also regularly engage additional assessors, auditors and service providers in connection with the implementation, assessment, enhancement and evaluation of our cybersecurity program, including our risk management processes.


text: We have not been a victim of a cyber attack or other cybersecurity incident that has had a material impact on us, our business strategy, results of operations or financial condition; however, we have from time to time experienced non-significant cybersecurity events, including attempted denial of service attacks, malware infections, phishing, subversion of internal security controls and other information technology events that are typical for an electronic financial services company of our size. An actual, threatened or perceived cyber attack or breach of our security could materially affect us, including our business strategy, results of operations and financial condition in many ways, including through the loss of clients or client confidence, expenditure of significant costs to repair system, network or infrastructure damages as well as to protect against future cyber attacks, security breaches or harm and potential litigation or other claims or actions, including from regulatory agencies. These risks extend to the third parties we rely on to provide certain services, including technology services, to us. Please see Part I, Item 1A. —"Risk Factors—Risks Relating to the Operation and Performance of Our Business—We rely on third parties to perform certain key functions, and their failure to perform those functions could result in the interruption of our operations and systems and could result in significant costs and reputational damage to us." For additional information regarding risks related to cybersecurity threats, see also Part I, Item 1A. – "Risk Factors — Risks Relating to Cybersecurity and Intellectual Property Actual or perceived security vulnerabilities in our systems, networks and infrastructure, breaches of security controls, unauthorized access to confidential or personal information or cyber attacks could harm our business, reputation and results of operations" and "— Systems failures, interruptions, delays in service, catastrophic events and resulting interruptions in the availability of our platforms or solutions could materially harm our business and reputation."


text: Role of our Board of Directors The Board of Directors of Tradeweb Markets Inc. exercises direct oversight of the strategic risks to the Company. The Audit and Risk Committee of the Board reviews guidelines and policies governing the process by which senior management assesses and manages our exposure to risk, including our major financial and operational risk exposures including those derived from cybersecurity risk, and the steps management takes to monitor and control such exposures. Our Board and our Audit and Risk Committee each receive periodic reports from our Chief Information Security Officer, Chief Risk Officer and Chief Administrative Officer to assess key cybersecurity risks for the Company and the measures implemented to mitigate them, as well as updates regarding changes to our cybersecurity risk profile or newly identified significant risks. In addition, the Audit and Risk Committee reports to the Board on these matters at each regularly scheduled Board meeting. The Board and Audit and Risk Committee provide feedback and recommendations accordingly.


text: Role of Management We operate on a "three lines of defense" risk governance model, with partnership and communication across the three lines. The first line of defense is comprised of the business and technology managers, the second line of defense is comprised of the Compliance, Risk and Information Security teams and the third line of defense is comprised of the Internal Audit function. The second and third lines of defense focus on providing the first line of defense with advisory and assurance functions for informed and actionable risk-based decisions. The Enterprise Risk Committee (the "ERC") is chaired by our Chief Risk Officer and includes our Chief Technology Officer, General Counsel, Chief Administrative Officer, Global Head of Enterprise Risk, Chief Information Security Officer, Head of Global Compliance, Global Head of Human Resources, Head of Internal Audit and various global heads of business lines and corporate functions. The ERC is responsible for the governance and oversight of our Risk Framework, which includes cybersecurity risks. Its responsibilities include, supervising risk mitigation strategies and their implementation, overseeing compliance and regulatory aspects, managing crises, approving risk tolerance, reviewing and approving material policy changes and evaluating the effectiveness of the organization's risk management practices. The ERC regularly obtains reports from the Chief Information Security Officer who maintains the primary responsibility for assessing and managing the cybersecurity risks, to evaluate the principal cybersecurity risks for the Company and review strategies in place to mitigate them. The ERC meets quarterly and reports to senior management, including the Chief Executive Officer and Chief Financial Officer. Senior management provides oversight and support in aligning cyber risk management with the Company's strategic decisions, fostering a culture of risk awareness across the organization and allocating adequate resources to support the initiatives.


text: Our Chief Information Security Officer leads a highly qualified cybersecurity team in assessing, managing and reducing material risks from cybersecurity threats to protect critical operations and delivery of service. Our Chief Information Security Officer has over 25 years of industry experience, with more than a decade of CISO experience at various financial institutions. Many members of the cybersecurity team hold Certified Information Systems Security Professional and Certified Information Systems Auditor certifications. In addition, our Global Head of Enterprise Risk has more than a decade of experience managing enterprise risk programs and maintains multiple information security certifications. We also belong to several professional and recognized industry organizations related to cybersecurity, including FS-ISAC, FCA Cyber Coordination Group and SIFMA in order to stay up-to-date on industry-wide trends.


text: We maintain a cyber risk management program that is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The design of our program is based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework.

companyName: STEM, INC.

ticker: STEM


text: We have implemented a cyber incident response standard operating procedure (the "SOP") detailing actions to be taken in the event of a cyber incident. Pursuant to the SOP, any suspected cyber breaches or detected vulnerabilities are promptly reported by our cybersecurity team to our Chief Technology Officer ("CTO") and Chief Legal Officer ("CLO") for further assessment and/or remediation. In addition, we require our employees to regularly participate in mandatory cybersecurity training that covers critical aspects of digital security, including phishing prevention, threat awareness, and safe data handling practices. Cybersecurity risk considerations are also incorporated into our broader business continuity planning. In addition to our internal processes, our partnerships with various third-party vendors comprise a key component of our cyber risk management program. We engage several reputable third-party companies to monitor and maintain the performance and effectiveness of our products and services, as well as to conduct System and Organization Controls (SOC) assessments and our mandatory cybersecurity training for employees.


text: Our Compliance and Security Officer ("CSO") is the head of our experienced cybersecurity team and is responsible for assessing and managing our cyber risk management program. Our CSO collaborates with our business, engineering, human resources, legal, and other functions to implement and enforce our cyber policies. Our CSO reports to our CTO, and they collectively inform our senior management regarding the prevention, detection, mitigation, and remediation of incidents and vulnerabilities.


text: The Audit Committee of the Board of Directors (the "Board") oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Each quarter,, our CTO updates the Audit Committee on the development and effectiveness of our cyber risk management program. In addition, the Audit Committee is responsible for periodically reviewing and discussing with management our practices with respect to cybersecurity and information security risk management. In addition, cybersecurity risks are reviewed by the Board as part of the Company's corporate risk mapping exercise.


text: Although we have experienced, and will continue to experience, cyber incidents in the normal course of our business, prior cyber incidents have not had a material adverse effect on our business. For a further explanation of the cybersecurity risks and threats that we could be subject, see "A failure of our information technology and data security infrastructure could adversely affect our business and operations" in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: We have implemented a cyber incident response standard operating procedure (the "SOP") detailing actions to be taken in the event of a cyber incident. Pursuant to the SOP, any suspected cyber breaches or detected vulnerabilities are promptly reported by our cybersecurity team to our Chief Technology Officer ("CTO") and Chief Legal Officer ("CLO") for further assessment and/or remediation. In addition, we require our employees to regularly participate in mandatory cybersecurity training that covers critical aspects of digital security, including phishing prevention, threat awareness, and safe data handling practices. Cybersecurity risk considerations are also incorporated into our broader business continuity planning. In addition to our internal processes, our partnerships with various third-party vendors comprise a key component of our cyber risk management program. We engage several reputable third-party companies to monitor and work to maintain the performance and effectiveness of our products and services, as well as to conduct System and Organization Controls (SOC) assessments and our mandatory cybersecurity training for employees. We are also implementing systems and processes designed to oversee, identify and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use.


text: Our Compliance and Security Officer ("CSO"), who has extensive cybersecurity knowledge and skills gained from more than 20 years of work experience at the Company and elsewhere, is the head of our experienced cybersecurity team and is responsible for assessing and managing our cyber risk management program. The CSO receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CSO collaborates with our business, engineering, human resources, legal, and other functions to implement and enforce our cyber policies. Our CSO reports to our CTO, and they collectively inform our senior management regarding the prevention, detection, mitigation, and remediation of incidents and vulnerabilities.


text: The Audit Committee of the Board of Directors (the "Board") oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Each quarter, our CTO updates the Audit Committee on the development and effectiveness of our cyber risk management program. In addition, the Audit Committee is responsible for periodically reviewing and discussing with management our practices with respect to cybersecurity and information security risk management. In addition, cybersecurity risks are reviewed by the Board as part of the Company's corporate risk mapping exercise.


text: Although we have experienced, and will continue to experience, cyber incidents in the normal course of our business, as of the date of this report, prior cyber incidents have not had a material adverse effect on the Company, including our business strategy, results of operations, and financial conditions. For a further explanation of the cybersecurity risks and threats to which we could be subject, see "A failure of our information technology and data security infrastructure could adversely affect our business and operations" in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and approved medications ("Information Systems and Data").

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: Our information security team, supported by our legal and compliance departments, help identify, assess and manage our cybersecurity threats and risks. Our information security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, depending on the context, including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing certain reports of threats and threat actors, conducting scans of certain environments, evaluating our and our industry's risk profile, evaluating certain threats reported to us, conducting third-party threat assessments, coordinating with law enforcement about certain threats, conducting internal audits and threat assessments, and conducting vulnerability assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident detection and response procedures and policies; disaster recovery/business continuity plans; risk assessments; implementation of certain security controls; encryption of certain data; network security, access, and physical controls for certain systems; management, tracking and disposal of certain assets; systems monitoring; employee training; penetration tests by third-party service providers; tabletop exercises conducted by third parties; and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the information security team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional service firms such as legal counsel, threat intelligence providers, cybersecurity consultants and software providers, penetration testing services, and other third-party service providers including for identity management solutions.


text: We use third-party service providers to perform a variety of functions throughout our business application providers, hosting companies, contract research organizations (CROs), contract manufacturing organizations (CMOs), supply chain resources, and other business-related SaaS platforms. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes conducting risk assessments of certain vendors, reviewing certain vendors' security assessments, reviewing reports of certain of our vendors' security, and reviewing the written information security program of certain vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our business is subject to complex, stringent and evolving U.S. and foreign laws, regulations, and rules, contractual obligations, industry standards, policies and other obligations relating to privacy and data protection. Our actual or perceived failure to comply with such obligations could result in regulatory investigations or actions, litigations (including class claims) and mass arbitration demands, fines and penalties, disruptions of and changes to our business practices, monetary penalties, reputational harm, loss of revenue or profits, and other adverse business consequences."; and "If our information technology systems, or those used by our CMOs, CROs, commercial vendors or other contractors, consultants or third parties with whom we work, or our data are or were compromised, we could experience material adverse consequences, including but not limited to regulatory investigation, actions, litigation, fines and penalties, disruptions of our business operations, reputation harm, loss of revenue or profits, and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director of Information Technology/Information Security, Vice President, Legal, Chief Compliance Officer ("CCO"), and Chief Financial Officer ("CFO"). Our Executive Director of Information Technology/Information Security has over ten years of experience in information technology and security, and previously held positions such as Associate Director of Informational Technology and Operations, Senior Manager of Informational Technology, and similar roles at other companies.


text: Our Executive Director of Information Technology/Information Security is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, helping prepare for cybersecurity incidents, approving cybersecurity processes, reviewing security assessments and other security-related reports, and communicating key priorities to relevant personnel. Our CFO is responsible for approving budgets as related to cybersecurity.


text: Our incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Executive Director of Information Technology/Information Security, Data Protection Officer, and the Vice President, Legal. These individuals work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee of the board of directors receives annual reports from our Senior Director of Information Technology/Information Security concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee of the board of directors also receives and has access to various presentations related to cybersecurity threats, risk and mitigation.


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Lyft, Inc.

ticker: LYFT


text: We conduct a regular risk assessment process with monthly management reviews of the cybersecurity risk landscape to identify threats and may conduct further assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we may accept identified risks; re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Head of Security & Privacy who reports to our Chief Information Officer ("CIO"), to manage the risk assessment and mitigation process.


text: As part of our risk management processes, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings. We require relevant third-party service providers to confirm that they have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We regularly discuss our internal controls over financial reporting with our independent registered public accounting firm and other service providers assist us in evaluating the design and implementation of our cybersecurity controls and procedures, as well as to monitor and test our safeguards.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Any actual or perceived security or privacy breach or incident could interrupt our operations, harm our brand and adversely affect our reputation, brand, business, financial condition and results of operations."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors has oversight responsibilities for material risk for the company, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function as a whole, as well as through the audit committee.


text: Our Head of Security & Privacy has primary responsibility for assessing and managing our material risks from cybersecurity threats in partnership with our CIO and other business leaders. The Head of Security and Privacy has served in various roles within the cybersecurity field for over 15 years, including security leadership roles in multiple organizations. The Head of Security and Privacy holds an undergraduate degree in information security and forensics and a graduate degree in information assurance and has attained various professional certifications within the field including Certified Information Systems Security Professional and Certified Ethical Hacker certifications.


text: Our Head of Security & Privacy oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes and procedures by which our Head of Security & Privacy is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include our incident response process, tracking in our centralized risk repository, and our vulnerability management process. Our Incident Response policy describes and supports the activities we take to prepare for discovery, response, and recovery from cybersecurity incidents, which include processes to determine severity, escalation, and response to incidents, as well as those necessary to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: Our Head of Security & Privacy or other business leaders provide quarterly updates to the audit committee regarding our company's cybersecurity risks and activities. These updates include any relevant recent cybersecurity incidents and related mitigation and remediation efforts, cybersecurity systems testing, status updates on Security and Privacy team efforts, and the like. Our audit committee provides updates to the board of directors on material cybersecurity risks and activities.


text: Following these risk assessments, we may accept identified risks; re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer (CISO), who reports to our Chief Information Officer ("CIO"), to manage the risk assessment and mitigation process.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors, " in this annual report on Form 10-K, including the risk factor entitled "Any actual or perceived security or privacy breach or incident could interrupt our operations, harm our brand and adversely affect our reputation, brand, business, financial condition and results of operations."


text: Our CISO has primary responsibility for assessing and managing our material risks from cybersecurity threats in partnership with our CIO and other business leaders. The CISO has served in various roles within the cybersecurity field for over 15 years, including security leadership roles in multiple organizations. The CISO holds an undergraduate degree in information security and forensics and a graduate degree in information assurance and has attained various professional certifications within the field including Certified Information Systems Security Professional and Certified Ethical Hacker certifications.


text: Our CISO oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes and procedures by which our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include our incident response process, tracking in our centralized risk repository, and our vulnerability management process. Our Incident Response policy describes and supports the activities we take to prepare for discovery, response, and recovery from cybersecurity incidents, which include processes to determine severity, escalation, and response to incidents, as well as those necessary to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: Our CISO or other business leaders provide quarterly updates to the audit committee regarding our company's cybersecurity risks and activities. These updates include any relevant recent cybersecurity incidents and related mitigation and remediation efforts, cybersecurity systems testing, status updates on Security and Privacy team efforts, and the like. Our audit committee provides updates to the board of directors on material cybersecurity risks and activities.


text: Maintaining our information security systems, communication networks, IT systems and data centers utilized by our business, and any outsourced service providers that may hold any data utilized by our business is crucial to the successful operation of our business.

companyName: Microvast Holdings, Inc.

ticker: MVST


text: The company has made investments in our technology to identify and manage the material risks of cybersecurity threats that could hinder our operations. As part of our regular cybersecurity risk management systems, we routinely reach out to external cybersecurity experts and third-party consultants to provide advice and implement changes in our current policies. The company also relies on the utilization of outsourced service providers who help provide certain functions that are key to the operations of our business. The company has taken steps to ensure the security of any data we might provide to these service providers and to ensure that our operations would be mitigated in terms of risk by engaging reputable service providers who maintain cybersecurity protection programs and protocols for their customers.


text: Microvast has established a combination of policies and procedures, and technologies have been designed and implemented, to prevent, detect, respond to, and recover from cybersecurity threats and incidents. Information security policies are regularly reviewed and updated. The policies were created using NIST-CSF framework to ensure that best practices for information security are being adhered to. Internal control tests are regularly performed to test the compliance of the policy processes and procedures and to remediate any identified gaps.


text: Effect of Cybersecurity Threats The company did not experienced a cybersecurity incident that materially impacted our operations during the year ended December 31, 2023, and the company is not aware of any active risks from cybersecurity incidents or risks that are reasonably likely to have a material impact on the operations of our business, including its business strategy, or financial condition. For more information on additional risks that the company might face regarding cyberattacks and cybersecurity, see "Risk Factors - Risks Related to our Business and Industry - Cyberattacks or risks related to cybersecurity could have a material effect on our business."


text: On July 26, 2023, the SEC adopted a final rule requiring registrants to disclose certain information related to the registrants' policies regarding cybersecurity risk management and strategy in addition to current policies regarding cybersecurity governance.


text: Microvast's SVP of Information Technology and the Information Security Manager are responsible for assessing as well as managing and determining the risks that could potentially have material impact on Microvast operations and business activity.


text: The SVP of Information Technology and the Information Security Manager have both worked in the Cybersecurity realm for many years. Both have led information security teams and have deep knowledge of the requirements for implementing and managing a cybersecurity program. Their expertise and experience include establishing policies and procedures, compliance enforcement, and the ability to identify potential security risks and develop strategies for mitigating those risks, incident response planning and threat mitigation.


text: The management team plays a crucial role in the cybersecurity process by setting the tone for the organization's approach to cybersecurity and ensuring that it is integrated into the overall business strategy. Key responsibilities of Microvast management in cybersecurity include: • setting security objectives: establishing clear security objectives that align with the organization's overall goals and risk tolerance. • resource allocation: ensuring sufficient resources, including budget, personnel, and technology, to effectively manage cybersecurity risks. • policy development: ensuring security policies and procedures align with industry standards and best practices. • risk Management: overseeing the organization's risk management program including conducting regular risk assessments and implementing controls to mitigate identified risks. • incident response: Providing oversight and ensuring that the organization has an effective incident response plan that has been tested and employees trained on how to effectively respond to cybersecurity incidents promptly and appropriately. • compliance: ensuring that the organization complies with relevant and applicable cybersecurity regulations and standards and stays abreast of emerging threats and best practices.


text: The Board reviews and evaluates the organization's effectiveness to manage cybersecurity threats. The SVP of Information Technology, the General Counsel, and the CEO are responsible for reporting and communicating cybersecurity threats that have material impact on the organization to the Board. The Board regularly reviews the organization's risk posture and provides guidance to minimize or mitigate risk.


text: The security and integrity of our information systems, communication networks, IT infrastructure, and data centers are critical to the successful operation of our business.


text: As such, we have invested in advanced technologies to identify and manage material cybersecurity risks that could impede our operations. We also engage reputable outsourced service providers to perform key operational functions, ensuring comprehensive protection of shared data and adherence to rigorous cybersecurity protocols.


text: Microvast utilizes a set of policies, procedures, and technologies designed to prevent, detect, respond to, and recover from cybersecurity threats and incidents. These policies, based on the NIST Cybersecurity Framework, are regularly reviewed and updated to integrate industry best practices. Internal control evaluations are conducted routinely to ensure compliance and address any identified vulnerabilities.


text: Our company did not experience any cybersecurity incidents that materially impacted our operations for the year ended December 31, 2024. We remain unaware of any active threats that could significantly affect our business strategy or financial condition. For more information on cybersecurity risks, see "Risk Factors — Risks Related to Our Business and Industry."


text: On July 26, 2023, the SEC adopted a rule requiring enhanced disclosure of cybersecurity risk management, strategy, and governance. Microvast's SVP of Information Technology, is responsible for risk assessment and management. This individual has experience in developing security policies, enforcing compliance, orchestrating incident responses, and implementing cybersecurity strategies.


text: Management is actively involved in cybersecurity governance, ensuring alignment with our overall business strategy. Their responsibilities include: • Security Objectives: Establishing security goals that correspond with corporate objectives and risk appetite. • Resource Allocation: Providing adequate resources, including budget and personnel, to address cybersecurity risks effectively. • Policy Development: Developing and maintaining policies that meet industry standards. • Risk Management: Directing risk management initiatives and instituting control measures to mitigate recognized risks. • Incident Response: Overseeing the implementation and regular testing of incident response plans, with employee training to ensure effective response capabilities. • Compliance: Ensuring adherence to applicable regulations, while remaining vigilant about emerging threats.


text: Our Board of Directors evaluates our readiness to manage cybersecurity threats, receiving regular updates from the SVP of Information Technology, General Counsel, and CEO regarding any materially impactful cybersecurity risks.


text: Specific Cybersecurity Measures Microvast has implemented various cybersecurity measures, including, but not limited to the following: • Establishing physical security protocols and securing network access via VPN. • Requiring multi-factor authentication for email and collaboration platforms. • Deploying endpoint detection and response (EDR) and antivirus solutions across all devices. • Enforcing strong password policies with a secured password vault for system credentials. • Minimizing attack vectors by eliminating external web-facing business-critical applications. • Utilizing encryption technologies to safeguard intellectual property and mitigate data loss risks. • Developing a comprehensive suite of information security policies and a strategic information security roadmap. • Implementing a Security Information and Event Management (SIEM) system.


text: These efforts, coupled with the isolation of industrial networks and structured software installation processes, demonstrate our continued commitment to maintaining robust cybersecurity defenses.


text: The Company's Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board of Directors is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and procedures are fully integrated into the Company's information technology practices and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Kontoor Brands, Inc.

ticker: KTB


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance


text: As discussed in more detail under the heading "Governance," The Board of Directors' oversight of cybersecurity risk management is led by the Audit Committee of the Board of Directors (the "Audit Committee"), which interacts quarterly with the Company's ERM function, the Company's Chief Information Security Officer ("CISO"), other members of management and relevant management committees and councils.


text: • Collaborative Approach The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. In the event that the Company experiences a cybersecurity incident it will take steps to contain, assess and remediate the incident. • Technical Safeguards The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Audit Committee, under the oversight of the Board of Directors, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board of Directors and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board of Directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: The CISO, in coordination with the Chief Information Officer ("CIO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.


text: The CISO has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Security Officer of two large international companies. The CISO holds an undergraduate degree in business and is pursuing a master's degree in business. The CISO also has attained the professional certification of Certified Information Systems Security Professional (CISSP). The CIO holds an undergraduate degree in business and has served in various roles in information technology for over 30 years, including serving as either the Chief Technology Officer or Chief Information Officer of four public companies. The Company's Chief Executive Officer and Chief Financial Officer each hold undergraduate and graduate degrees in their respective fields, and each have over 10 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Notwithstanding any of these measures, our systems, networks, products and services remain potentially vulnerable to known or unknown cybersecurity attacks and other threats, any of which could have a material adverse effect on our consolidated results of operations, financial condition and cash flows. We have experienced, and will continue to experience, cyber incidents in the normal course of our business. As of the date of this report, we have not identified any risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, our business strategy, results of operation or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on us will not occur in the future. For additional information on the risks we face from cybersecurity threats, please see the risk factor titled, "We are subject to data security and privacy risks that could negatively affect our business operations, results of operations or reputation" in Item 1A. "Risk Factors."


text: The Company's Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board of Directors is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes and procedures are fully integrated into the Company's information technology practices and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: As discussed in more detail below under the heading "Governance," the Board of Directors' oversight of cybersecurity risk management is led by the Audit Committee of the Board of Directors (the "Audit Committee"), which interacts quarterly with the Company's ERM function, the Company's Chief Information Security Officer ("CISO"), other members of management and relevant management committees and councils.


text: • Collaborative Approach The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. In the event the Company experiences a cybersecurity incident, it will take steps to contain, assess and remediate the incident. • Technical Safeguards The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The CISO, in coordination with the Chief Information Officer ("CIO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee and the Board of Directors when appropriate.


text: The CISO has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Security Officer of two large international companies. The CISO holds an undergraduate degree in business and a master's degree in business administration. The CISO also has attained the professional certification of Certified Information Systems Security Professional (CISSP). The CIO holds an undergraduate degree in business and has served in various roles in information technology for over 30 years, including serving as either the Chief Technology Officer or Chief Information Officer of four public companies. The Company's Chief Executive Officer and Chief Financial Officer each hold undergraduate and graduate degrees in their respective fields, and each have over 10 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: As part of our enterprise risk management function, we have implemented processes to assess, identify and manage the material risks facing our company, including risks from cybersecurity threats. Our enterprise risk management function represents our overall risk management system. Our cybersecurity program is built upon recognized security frameworks. We believe that our processes provide us with a comprehensive assessment of potential cybersecurity threats. We conduct regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage the material risks from cybersecurity threats include the risks arising from threats associated with third-party service providers, including cloud-based platforms.

companyName: Crown Electrokinetics Corp.

ticker: CRKN


text: We rely heavily on our information technology ("IT") systems across various aspects of our operations, from product development to customer relations. Given the innovative nature of our business, particularly in the realms of smart glass and fiber optics, ensuring the security, integrity, and availability of data is paramount. We operate in an environment where the protection of intellectual property and sensitive data, including proprietary technology information and customer data, is critical. We are therefore committed to a comprehensive cybersecurity strategy that encompasses not only compliance with relevant privacy laws but also proactive risk management.


text: Our cybersecurity framework is overseen its Information Technology ("IT") Team. The IT team is geared towards developing and refining a risk-informed decision-making process, emphasizing the early identification and mitigation of cybersecurity risks. The IT Leader leads the charge in implementing a cybersecurity risk management program, employing a mix of technological tools, rigorous processes, and external assessments to safeguard our assets. Regular training programs, including those focused on phishing and secure data handling, are mandatory for all employees, reinforcing the culture of cybersecurity awareness.


text: Despite robust security measures, we acknowledge the possibility of cyber threats breaching its defenses. We have developed a cybersecurity incident response plan that provides a documented framework for handling cybersecurity incidents and facilitates coordination across multiple parts of the Company. This includes a structured procedure for incident detection, analysis, containment, and recovery, underscored by the IT Leader for material incident evaluation and communication.


text: Given the integration of third-party services within our operational framework, we extend our cybersecurity vigilance to our partners and suppliers. This includes contractual safeguards and continuous monitoring to manage and mitigate risks presented by external entities.


text: To date, we have not experienced a cybersecurity incident that has had a material impact on our business strategy, results of operations or financial condition, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, as discussed more fully under "Item 1A. Risk Factors," cybersecurity attacks are continually evolving to become more sophisticated and, while we have invested in the protection of our data and information technology to reduce the risk of a cybersecurity incident, our efforts may not be effective in preventing breakdowns or breaches in our systems.


text: Board's Roles and Responsibilities The governance of cybersecurity within our is structured to ensure a clear delineation of oversight responsibilities. The Board of Directors, particularly through its Audit Committee, plays a crucial role in supervising our cybersecurity posture. The Audit Committee is composed of individuals with deep expertise in risk management, finance, and technology, enabling it to provide informed oversight of cybersecurity risks. Periodic briefings that are held ensures that the Board of Directors remains actively engaged in guiding and evaluating our cybersecurity strategy.


text: Management's Roles and Responsibilities Operational responsibility for cybersecurity falls to the management, led by the IT department. The management team is tasked with executing our cybersecurity strategy, focusing on risk assessment, incident prevention, and response. This includes conducting vulnerability assessments, ensuring continuous monitoring, and staying updated on cybersecurity trends and threats. The Software Engineer, with extensive experience in information security, works in close coordination with other key management roles to ensure a unified approach to cybersecurity across our company.


text: Our approach to cybersecurity is integral to its operations, reflecting a commitment to safeguarding its innovative technologies and sensitive data. Through a combination of strategic oversight by the Board of Directors and diligent execution by management, we aim to uphold the highest standards of cybersecurity resilience and integrity.


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company, from time-to-time, may engage third-party consultants, legal advisors, and audit firms to evaluate and test the Company's risk management systems and assess and remediate certain potential cybersecurity incidents, as appropriate.

companyName: Acreage Holdings, Inc.


text: As part of our enterprise risk management program, the Board of Directors (the "Board") meets with our senior management team, which includes our Chief Executive Officer, Chief Financial Officer, and General Counsel to address risks associated with cybersecurity threats on a regular basis. The Board receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been resolved.


text: Cybersecurity threats are one of the Company's most critical risks, with our Senior Director of Technology assigned as the executive risk owner. Our Senior Director of Technology, in coordination with our senior management team, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. Multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Senior Director of Technology and the senior management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Board, when appropriate.


text: Our Senior Director of Technology boasts over ten years of experience spearheading technology operations for organizations with a keen emphasis on cybersecurity. His extensive background has been pivotal in shaping our cybersecurity policies, implementing our cybersecurity program, and supervising information governance and compliance measures.


text: During the year ended December 31, 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. See "Item 1 A. Risk Factors" for more information on the Company's cybersecurity-related risks.


text: We have established certain processes designed to assess, identify and manage cybersecurity risks, which are built into our information technology functions and are designed to help protect our information assets and operations from internal and external cyber threats. Our cybersecurity risk management processes target integral areas such as data protection, access control, incident response and vulnerability management and are integrated into our overall enterprise risk management process. As part of our overall enterprise risk management process, our company's information technology functions, including our Information Technology department leaders and third-party service providers, identify, assess and evaluate cybersecurity risks impacting our operations across the Company.

companyName: Immunovant, Inc.

ticker: IMVT


text: Depending on the information systems and environment, our cybersecurity program includes various administrative, physical, and technical safeguards designed to manage and mitigate material risks from cybersecurity threats, including, for example: an incident response plan, incident detection and response, risk assessments, encryption of data, network security controls, data segregation, access controls, physical security, systems monitoring, a vendor risk management program, penetration testing, cybersecurity insurance, dedicated cybersecurity staff, and asset management, tracking and disposal. Additionally, we provide all employees, including part-time and temporary employees, with annual and ad hoc cybersecurity awareness training.


text: Our information technology functions identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including internal and external audits, penetration and vulnerability tests, automated tools, subscriptions to reports and services that identify cybersecurity threats, analysis of reports of threats and actors, use of external intelligence feeds, evaluations of our and our industry's risk profile, evaluation of threats reported to us, threat assessments for internal and external threats, scans of internal systems for threats, and incident response simulations (including third-party-conducted red/blue team testing and tabletop incident response exercises). We engage certain external service providers, including consultants, independent privacy assessors and computer security firms, as appropriate, to assess, test or otherwise assist with aspects of our security controls, including cybersecurity incident containment and remediation efforts, and enhance our cybersecurity oversight. We also use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example penetration testing firms, cybersecurity consultants, forensic investigators, cybersecurity software providers, managed cybersecurity service providers, and professional services firms (including legal counsel).


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. With respect to our use and oversight of third-party service providers, we use a risk-based approach to apply our cybersecurity processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and perform additional risk screenings and procedures, as appropriate. We use a number of means to assess cyber risks related to our third-party service providers, including risk assessments for each vendor, vendor security questionnaires and due diligence in connection with onboarding new vendors, and ongoing reviews and due diligence with key or high-risk third-party vendors. We also seek to collect and assess cybersecurity audit reports and other supporting documentation when available and include appropriate security terms in our contracts where applicable as part of our oversight of third-party providers.


text: For additional information regarding cybersecurity risks and their potential impacts on our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A. Risk Factors in this Annual Report, including the risk factor captioned "We are subject to stringent and changing privacy, data protection, and information security laws, contractual obligations, self-regulatory schemes, government regulation and standards related to data privacy and security. The actual or perceived failure by us, our CROs or vendors to comply with such obligations could result in harm to our reputation, regulatory investigations or actions, significant fines and liability, disruption of our clinical trials or other material adverse effects to our business."


text: The Audit Committee of our Board of Directors oversees our cybersecurity and data privacy risk management activities, and reports to the Board regarding such oversight as appropriate. The Audit Committee receives updates from management regarding cybersecurity matters not less than twice per year, and is notified between such updates regarding any significant new cybersecurity threats or incidents.


text: Our Vice President of Information Technology and Facilities and our Head of Cybersecurity lead the operational oversight of company-wide cybersecurity strategy, policy, standards and processes, and work across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The Vice President of Information Technology and Facilities has over 16 years of experience delivering systems across all functions of life science organizations, including support of infrastructure, security, software as a service (SaaS) systems and data integrations, along with ten years working with cybersecurity. The Head of Cybersecurity has approximately 15 years of cybersecurity expertise and has received Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP) certifications.


text: In the event of a cybersecurity incident, we maintain a cybersecurity incident response plan designed to govern the actions required for responding to and reporting security incidents involving our information assets, including by escalating certain incidents to members of management, including the Vice President of Information Technology and Facilities and the Head of Cybersecurity. Pursuant to the plan and its escalation protocols, and depending on the nature, severity, and other circumstances of each potential cybersecurity incident, designated personnel may be responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis.


text: Depending on the information systems and environment, our cybersecurity program includes various administrative, physical, and technical safeguards designed to manage and mitigate material risks from cybersecurity threats, including, for example: an incident response plan, incident detection and response, disaster recovery plans risk assessments, encryption of data, network security controls, data segregation, access controls, physical security, systems monitoring, a vendor risk management program, penetration testing, cybersecurity insurance, dedicated cybersecurity staff, and asset management, tracking and disposal. Additionally, we provide all employees, including part-time and temporary employees, with annual and ad hoc cybersecurity awareness training.


text: Our information technology functions identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including internal and external audits, penetration and vulnerability tests, automated tools, subscriptions to reports and services that identify cybersecurity threats, analysis of reports of threats and actors, use of external intelligence feeds, evaluations of our and our industry's risk profile, evaluation of threats reported to us, threat assessments for internal and external threats, scans of internal systems for threats and incident response simulations (including third-party-conducted tabletop incident response exercises). We engage certain external service providers, including consultants, independent privacy assessors and computer security firms, as appropriate, to assess, test or otherwise assist with aspects of our security controls, including cybersecurity incident containment and remediation efforts, and enhance our cybersecurity oversight. We also use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example penetration testing firms, cybersecurity consultants, forensic investigators, cybersecurity software providers, managed cybersecurity service providers and professional services firms (including legal counsel).


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors and supply chain resources. With respect to our use and oversight of third-party service providers, we use a risk-based approach to apply our cybersecurity processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and perform additional risk screenings and procedures, as appropriate. We use a number of means to assess cyber risks related to our third-party service providers, including risk assessments for each vendor, vendor security questionnaires and due diligence in connection with onboarding new vendors and ongoing reviews and due diligence with key or high-risk third-party vendors. We also seek to collect and assess cybersecurity audit reports and other supporting documentation when available and include appropriate security terms in our contracts where applicable as part of our oversight of third-party providers.


text: For additional information regarding cybersecurity risks and their potential impacts on our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A. Risk Factors in this Annual Report, including the risk factor captioned "We and the third parties with whom we work are subject to stringent and changing privacy, data protection, and information security laws, contractual obligations, self-regulatory schemes, government regulation, industry standards and other obligations related to data privacy and security. The actual or perceived failure by us or the third parties with whom we work to comply with such obligations could result in harm to our reputation, regulatory investigations or actions, significant fines and liability, disruption of our clinical trials or other material adverse effects on our business."


text: Our Vice President of Information Technology and Facilities and our Head of Cybersecurity lead the operational oversight of company-wide cybersecurity strategy, policy, standards and processes, and work across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The Vice President of Information Technology and Facilities has over 34 years of experience delivering systems across all functions of life science organizations, including support of infrastructure, security, software as a service (SaaS) systems and data integrations, along with ten years working with cybersecurity. The Vice President of Information Technology and Facilities has also received Chief Information Security Officer (C-CISO) certification. The Head of Cybersecurity has approximately 15 years of cybersecurity expertise and has received Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP) certifications.


text: In the event of a cybersecurity incident, we maintain a cybersecurity incident response plan designed to govern the actions required for responding to and reporting security incidents involving our information assets, including by escalating certain incidents to members of management, including the Vice President of Information Technology and Facilities and the Head of Cybersecurity. Pursuant to the plan and its escalation protocols, and depending on the nature, severity and other circumstances of each potential cybersecurity incident, designated personnel may be responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis.


text: At Clarivate, cybersecurity risk management is an integral part of our Enterprise Risk Management program. Because we are a global information services provider, our business is highly dependent on the protection of our proprietary software and content, as well as the timeliness, accuracy, and availability of our offerings. Consequently, we are highly sensitive to risks from cybersecurity threats to our information systems, particularly those threats that would affect our ability to continue to provide real-time access to our database content and analysis. To mitigate these threats, we utilize the following processes and governance structure.

companyName: CLARIVATE PLC

ticker: CLVT


text: Our Information Security Risk Management program is based on recognized industry governance frameworks, including the International Organization for Standardization. It provides a framework to identify, assess, and control cybersecurity threats and incidents. We perform an annual information security risk assessment with the assistance of independent security companies, with the aim to embed information security principles and objectives into our culture, business operations, and support functions.


text: Our cybersecurity efforts also include mandatory information security awareness training for all employees, clearly defined expectations for acceptable use policies, and certification of adherence to a code of conduct. The IT Governance, Risk, and Compliance ("IT GRC") team conducts periodic audits to evaluate policy and regulatory compliance, recording findings for subsequent review and remediation initiatives. We also leverage internal and external security subject matter experts to conduct comprehensive risk assessments, including architecture reviews, vulnerability scans, penetration tests, application security evaluations, and technical compliance reviews.


text: We maintain a security threat intelligence system that collects and analyzes data from internal vulnerability management tools, vendors, and third-party security organizations. Our patch management standard is designed to ensure that appropriate patching practices are consistently applied to our technology infrastructure, and a Security Operations Center enhances our real-time awareness, event correlation, and incident response capabilities.


text: As part of our risk management program, we also assess cybersecurity risks associated with third-party service providers. We have processes in place to oversee and identify material risks from cybersecurity threats associated with our engagement of such providers, including the use of cybersecurity risk criteria when determining the selection and oversight of those service providers.


text: The Board of Directors, acting directly and through its committees, is responsible for the oversight of our risk management programs. The Board's Risk & Sustainability Committee has the delegated responsibility for the oversight of key enterprise risks, including risks from cybersecurity threats. The committee also provides oversight of our policies and processes for monitoring and mitigating such risks. Among other duties, the Risk & Sustainability Committee receives and reviews periodic reports from management pertaining to cybersecurity programs and data protection controls, as well as other information security reports that the committee deems appropriate. The committee meets at least quarterly, and the chair of the committee gives regular reports to the Audit Committee and the full Board of Directors on its activities.


text: Management is responsible for day-to-day risk management activities, including those relating to information systems and cybersecurity. We employ an internal chief information security officer ("CISO") who has more than 25 years of technology industry leadership, cybersecurity expertise, and engineering and operations experience. Our CISO and his team of certified security subject matter experts (collectively, "Information Security") have deep experience and expertise in cybersecurity and lead our organizational efforts to assess and manage material risks associated with our information systems and cybersecurity threats. Our dedicated Information Security Steering Committee regularly reviews our most significant information security risks, strategic projects, and KPIs. On a quarterly basis, Information Security also meets with business segment leadership to discuss the most significant risks, including identifying potentially material risks and developing, implementing, and applying reasonable risk mitigation processes.


text: Our risk management programs are developed, implemented, managed, and reviewed at the direction of Information Security and business segment leaders, with subsequent actions determined based on the results of these preventive and detective controls. We have implemented incident response procedures that define our approach when potential security incidents are identified, with clear definition of the escalation path, including when notification to the Risk & Sustainability Committee is required. Depending on the assessed severity of the incident, the Risk & Sustainability Committee may be notified immediately or at its next regularly scheduled meeting.


text: Our cybersecurity efforts also include mandatory information security awareness training for all employees, clearly defined expectations for acceptable use policies, and certification of adherence to a code of conduct. The IT Governance, Risk, and Compliance team conducts periodic audits to evaluate policy and regulatory compliance, recording findings for subsequent review and remediation initiatives. We also leverage internal and external security subject matter experts to conduct comprehensive risk assessments, including architecture reviews, vulnerability scans, penetration tests, application security evaluations, and technical compliance reviews.


text: The Board of Directors, acting directly and through its committees, is responsible for the oversight of our risk management programs. The Board's Audit Committee has the delegated responsibility for the oversight of key enterprise risks, including risks from cybersecurity threats. The committee also provides oversight of our policies and processes for monitoring and mitigating such risks. Among other duties, the Audit Committee receives and reviews periodic reports from management pertaining to cybersecurity programs and data protection controls, as well as other information security reports that the committee deems appropriate. The committee meets at least quarterly, and the chair of the committee gives regular reports to the full Board of Directors on its activities.


text: Management is responsible for day-to-day risk management activities, including those relating to information systems and cybersecurity. We employ an internal chief information security officer ("CISO") who has more than 25 years of technology industry leadership, cybersecurity expertise, and engineering and operations experience. Our CISO and his team of certified security subject matter experts (collectively, "Information Security") have deep experience and expertise in cybersecurity and lead our organizational efforts to assess and manage material risks associated with our information systems and cybersecurity threats. Our dedicated Information Security Steering Committee regularly reviews our most significant information security risks, strategic projects, and key performance indicators. On a quarterly basis, Information Security also meets with business segment leadership to discuss the most significant risks, including identifying potentially material risks and developing, implementing, and applying reasonable risk mitigation processes.


text: Our risk management programs are developed, implemented, managed, and reviewed at the direction of Information Security and business segment leaders, with subsequent actions determined based on the results of these preventive and detective controls. We have implemented incident response procedures that define our approach when potential security incidents are identified, with clear definition of the escalation path, including when notification to the Audit Committee is required. Depending on the assessed severity of the incident, the Audit Committee may be notified immediately or at its next regularly scheduled meeting.


text: The Fund's Cybersecurity Risk Management Approach The Fund utilizes and relies on CIM for its IT and IT administration. CIM's cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. CIM's cybersecurity risk management policies and procedures include, among other things: enterprise-wide hardware and software management and security controls; employee training; security assessments; penetration testing; security audits and ongoing risk assessments; due diligence on, and monitoring and oversight of, key third-party providers; vulnerability management; and management oversight to assess, identify and manage material risks from cybersecurity threats. CIM's controls leverage the National Institute of Standards and Technology Cyber Security Framework. CIM also utilizes industry and government associations, the results from regular internal and third-party audits and other similar resources to inform its cybersecurity processes and to allocate resources.

companyName: CIM Opportunity Zone Fund, L.P.


text: In addition, all CIM employees receive mandatory training on cybersecurity matters at such employee's new hire and annually thereafter, periodic training and information updates that address new cybersecurity threats and trends, and quarterly "phishing" and social engineering testing to evaluate the effectiveness of the cybersecurity training program and raise employee awareness of cybersecurity threats.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: For further discussion of cybersecurity risks, see "Item 1A. Risk Factors—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and or damage to our business relationships, all of which could negatively impact the Fund."


text: Management Oversight of Cybersecurity Risk Management CIM's internal processes require escalation of material cybersecurity risks to its management and its Cybersecurity Committee (the "Committee") for evaluation. The Committee consists of CIM's Chief Technology Officer (the "CTO"), CIM's Chief Compliance Officer (the "CCO") as well as representatives from CIM's operations, compliance and accounting departments. The Committee is responsible for CIM's cybersecurity policy and overseeing the activities of CIM's cybersecurity practices, including assessing CIM's risks and controls. The Committee is chaired by the CTO and has more than 30 years' experience in the field of information technology, cybersecurity and adjacent roles, including serving on cybersecurity advisory councils. In addition, members of the Committee have relevant industry experience in enterprise risk management and compliance. The team responsible for developing and implementing our cybersecurity program collectively holds an MS in Cybersecurity and Information Assurance and has multiple cybersecurity certifications, including CRISC, CISM, CISA, NCSP-NIST, CISSP, CASP+, CySA+ and Security+.


text: The Committee has established a Cybersecurity Subcommittee (the "Subcommittee"). The Subcommittee consists of, among other things, the CCO, the CTO, the chief financial officers of CIM companies that are subject to the SEC's cybersecurity rule adopted in 2023 and are managed by CIM. The Subcommittee is tasked with assisting CIM-managed companies that are subject to the SEC's cybersecurity rule adopted in 2023, including us, in complying with such cybersecurity rule.


text: The Committee and Subcommittee each conduct both regular quarterly and as-needed meetings throughout the year during which members of the CIM's IT Department provide updates and report on meaningful cybersecurity risks, threats, incidents and vulnerabilities in accordance with the Committee's and the Subcommittee's respective reporting frameworks, as well as related priorities, mitigation and remediation activities, financial and employee resource levels, regulatory compliance, technology trends and third-party provider risks. To help inform this reporting framework, CIM maintains incident response plans and other policies and procedures designed to respond to, mitigate and remediate cybersecurity incidents based on the potential impact to CIM's business, IT systems, network or data, including data held by third parties, or to the IT or other critical services provided by third-party vendors and service providers.


text: CIM's personnel responsible for cybersecurity policy comprises of individuals with either formal education and degrees in IT or cybersecurity, or with experience working in IT and cybersecurity, including relevant industry experience in security related industries.


text: We believe that the processes, policies and procedures established by the Committee and the Subcommittee provide guidance for consistent and effective incident handling and response and set standards for internal notifications and escalations, as well as external notification considerations with respect to a cybersecurity event or incident requiring disclosure or notification in accordance with applicable laws. Pursuant to CIM's cybersecurity policy, management of the Fund will be promptly notified of any material cybersecurity incident required to be disclosed under Item 105 of Regulation S-K and shall oversee the Fund's response to such matter.